PhpSpreadsheet SSRF

The vulnerability in the Worksheet\Drawing::setPath function within the src/PhpSpreadsheet/Worksheet/Drawing.php file of the PhpSpreadsheet library is related to authorization process flaws. Exploitation of this vulnerability could enable a remote attacker to carry out an SSRF attack...

CLEANSTART-2024-CO14032 issue existed in the drawing of web page elements

Security vulnerability affects the webkit2gtk package. An issue existed in the drawing of web page elements...

CLEANSTART-2024-VJ18611 vulnerbiility was found in Openscad, where a DXF-format drawing with particular (not necessarily malformed!) properties may cause an out-of-bounds memory access when imported using import()

Security vulnerability affects the openscad package. A vulnerbiility was found in Openscad, where a DXF-format drawing with particular not necessarily malformed! properties may cause an out-of-bounds memory access when imported using import...

CVE-2026-119065

The Shipping Zones by Drawing for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'szbd-picked' checkout parameter in versions up to, and including, 3.3.0 The szbdcheckoutfieldupdateordermeta handler stores stripslashessanitizetextfield$POST'szbd-picked' in...

CVE-2026-119065 Shipping Zones by Drawing for WooCommerce <= 3.3.0 - Unauthenticated Stored Cross-Site Scripting via 'szbd-picked' Checkout Parameter

The Shipping Zones by Drawing for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'szbd-picked' checkout parameter in versions up to, and including, 3.3.0 The szbdcheckoutfieldupdateordermeta handler stores stripslashessanitizetextfield$POST'szbd-picked' in...

CVE-2026-119065 Shipping Zones by Drawing for WooCommerce <= 3.3.0 - Unauthenticated Stored Cross-Site Scripting via 'szbd-picked' Checkout Parameter

The Shipping Zones by Drawing for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'szbd-picked' checkout parameter in versions up to, and including, 3.3.0 The szbdcheckoutfieldupdateordermeta handler stores stripslashessanitizetextfield$POST'szbd-picked' in...

CVE-2026-119065

The Shipping Zones by Drawing for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 3.3.0 . The root cause lies in the szbd_checkout_field_update_order_meta() handler, which stores the szbd-picked checkout parameter in order meta w...

EUVD-2026-114614

The Shipping Zones by Drawing for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'szbd-picked' checkout parameter in versions up to, and including, 3.3.0 The szbdcheckoutfieldupdateordermeta handler stores stripslashessanitizetextfield$POST'szbd-picked' in...

CVE-2026-119065: arosoft Shipping Zones by Drawing for WooCommerce: The Shipping Zones by Drawing for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…

The Shipping Zones by Drawing for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'szbd-picked' checkout parameter in versions up to, and including, 3.3.0 The szbdcheckoutfieldupdateordermeta handler stores stripslashessanitizetextfield$POST'szbd-picked' in...

WordPress Shipping Zones by Drawing for WooCommerce plugin <= 3.3.0 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Sebastian Albrecht mySebbe in WordPress Plugin Shipping Zones by Drawing for WooCommerce versions = 3.3.0...

PT-2026-134454

Name of the Vulnerable Software and Affected Versions Shipping Zones by Drawing for WooCommerce versions prior to 3.3.1 Description Stored Cross-Site Scripting occurs via the szbd-picked checkout parameter. The szbd checkout field update order meta handler stores the szbd-picked value in order me...

SUSE CVE-2026-116148

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains an injection vulnerability in the MVG encoder, which does not properly neutralize user-specified drawing options before writing them into generated MVG output. Attackers who can supply drawing options can inject arbitrary MVG drawing...

GHSA-2PHH-27FW-Q4GC PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading

Summary PhpSpreadsheet's Worksheet\Drawing::setPath validates an external-image URL against an operator-supplied isWhitelisted callback once, on the initial URL only, then fetches it with filegetcontents using a stream context that does not set followlocation = 0. A whitelisted host that returns ...

PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading

Summary PhpSpreadsheet's Worksheet\Drawing::setPath validates an external-image URL against an operator-supplied isWhitelisted callback once, on the initial URL only, then fetches it with filegetcontents using a stream context that does not set followlocation = 0. A whitelisted host that returns ...

EUVD-2026-108264

PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading...

CVE-2026-109943

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol RDP server can trigger a Denial of Service DoS by causing a connecting client to crash. When asynchronous update processing is enabled, sending specially crafted polygon drawing orders can cause a double-free memory error during...

UBUNTU-CVE-2026-116148

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains an injection vulnerability in the MVG encoder, which does not properly neutralize user-specified drawing options before writing them into generated MVG output. Attackers who can supply drawing options can inject arbitrary MVG drawing...

Linux Distros Unpatched Vulnerability : CVE-2026-116148

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains an injection vulnerability in the MVG encoder, which does not properly neutralize user-specified...

Cross-site Scripting (XSS)

Overview Magick.NET-Q16-HDRI-OpenMP-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this...

Cross-site Scripting (XSS)

Overview Magick.NET-Q16-OpenMP-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package a...