ALSA-2026:84744 Important: gimp:2.8 security update

The GIMP GNU Image Manipulation Program is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo. Security Fixes: gimp: gimp:...

CVE-2026-111440: Use of Externally-Controlled Input to Select Classes or Code

在 openGauss-connector-jdbc 的 pgjdbc/src/main/java/org/postgresql/log/LogFactory.java 中，LogFactory 根据 JDBC 连接参数中的 logger 类名调用 Class.forName 加载类后，直接反射调用以 String 为参数的构造函数，再转换为 Log。缺少 asSubclassLog.class 校验，非 Log 实现类也会在类型检查前被实例化。因此，当攻击者可控制 JDBC URL 或连接属性中的 logger 类名，且客户端 classpath...

RHEL 8 : gimp:2.8 (RHSA-2026:84744)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:84744 advisory. The GIMP GNU Image Manipulation Program is an image composition and editing program. GIMP provides a large image manipulation toolbox,...

PT-2026-117033

In the Linux kernel, the following vulnerability has been resolved: nvme: fix command effects log lifetime for multipath heads KASAN reported a use-after-free when an I/O passthrough command was sent through a multipath namespace head after the controller path that first created the head had been...

Astra Linux – Vulnerability in imagemagick

A flaw was discovered in ImageMagick, specifically in the MagickCore/visual-effects.c file. An attacker who submits a crafted file processed by ImageMagick could trigger undefined behavior, including division by zero in mathematics. The greatest threat of this vulnerability is to system...

Rocky Linux 9.6 [TuxCare] Security Update: gimp / gimp-devel / gimp-devel-tools / gimp-libs Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1791479721)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791479721 advisory. - GIMP DDS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers...

Important: gimp

Issue Overview: A flaw was found in GIMP. When processing a specially crafted lighting preset file, the Lighting Effects filter does not properly validate the number of light sources. This can lead to an out-of-bounds write, corrupting memory. An attacker could exploit this by convincing a user t...

Amazon Linux 2 : gimp (ALASGIMP-2026-021)

The version of gimp installed on the remote host is prior to 2.8.22-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2GIMP-2026-021 advisory. A flaw was found in GIMP. When processing a specially crafted lighting preset file, the Lighting Effects filter does not...

AlmaLinux 9.2 [TuxCare] Security Update: gimp / gimp-devel / gimp-devel-tools / gimp-libs Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1791539516)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1791539516 advisory. - A flaw was found in GIMP. When processing a specially crafted lighting preset file, the Lighting Effects filter does not properly...

datamodel-code-generator: Protobuf weak-import path traversal allows files to be written outside the temporary directory

Summary When processing an attacker-controlled Protobuf schema, vulnerable versions of datamodel-code-generator could write a generated weak-import stub outside the intended weakimports temporary directory. Absolute import paths and relative paths containing .. could escape this directory. An...

CVE-2026-107292 Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 until 2.30.0, the Agent.toweb and clai web development chat server does not validate the Host header, allowing a website visited by a developer to use DNS rebinding to reach a...

MAL-2026-17686 Malicious code in tailwindcss-effects-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 12c9b58efdc05227da51bfb1031a80205144b4c6945b06eb9cbad7d416ab4873 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview tailwindcss-effects-kit is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

PT-2026-108047

Name of the Vulnerable Software and Affected Versions Pydantic AI versions 1.34.0 through 1.107.4 Pydantic AI versions 2.0.0 through 2.29.9 Description The Agent.to web and clai web development chat server fails to validate the Host header of incoming requests. This allows a malicious website...

EUVD-2026-92790

Langflow : Cross-user flow access and vertex execution via deprecated /api/v1/build/flowid/vertices endpoints...

MiracleLinux 9 : gimp-3.0.4-4.el9_8.14 (AXSA:2026-1989:11)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1989:11 advisory. gimp: gimp: out-of-bounds write in lighting effects plugin via crafted preset file CVE-2026-90947 gimp: gimp: heap-based buffer overflow in ICO load...

AlmaLinux 9 : gimp (ALSA-2026:75575)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:75575 advisory. gimp: gimp: out-of-bounds write in lighting effects plugin via crafted preset file CVE-2026-90947 gimp: gimp: heap-based buffer overflow in ICO loader vi...

CVE-2026-105698 Langflow: Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints

Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.0.0 until 1.10.1, Langflow did not verify flow ownership in the deprecated POST /api/v1/build/flowid/vertices and POST /api/v1/build/flowid/vertices/vertexid handlers. Through version 1.7.1, an unauthenticated...

CVE-2026-105698 Langflow: Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints

Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.0.0 until 1.10.1, Langflow did not verify flow ownership in the deprecated POST /api/v1/build/flowid/vertices and POST /api/v1/build/flowid/vertices/vertexid handlers. Through version 1.7.1, an unauthenticated...

CVE-2026-105698

Langflow (versions 1.0.0 through 1.10.0) is vulnerable to cross-user flow access and unauthorized vertex execution due to a missing ownership check in deprecated handlers. Specifically, the POST /api/v1/build/{flow_id}/vertices and POST /api/v1/build/{flow_id}/vertices/{vertex_id} endpoints faile...