CVE-2025-12528

CVE-2025-12528 concerns the Pie Forms for WP WordPress plugin (versions <= 1.6). The issue is an Arbitrary File Upload due to insufficient file-type validation: validate_classic checks extensions but does not stop the upload, enabling unauthenticated attackers to upload dangerous extensions (e...

kimageformats:kimgio_rgb_fuzzer: Use-of-uninitialized-value in SGIImagePrivate::readImage

Project: git://anongit.kde.org/kimageformats Detailed Report: https://oss-fuzz.com/testcase?key=6304901283250176 Project: kimageformats Fuzzing Engine: libFuzzer Fuzz Target: kimgiorgbfuzzer Job Type: libfuzzermsankimageformats Platform Id: linux Crash Type: Use-of-uninitialized-value Crash...

OSV-2025-906 Use-of-uninitialized-value in QImage::pixel

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=461199967 Crash type: Use-of-uninitialized-value Crash state: QImage::pixel XCFImageFormat::copyGrayAToRGB XCFImageFormat::copyLayerToImage...

PT-2025-47285

Name of the Vulnerable Software and Affected Versions Enable SVG, WebP, and ICO Upload plugin for WordPress versions up to and including 1.1.2 Description The Enable SVG, WebP, and ICO Upload plugin for WordPress is susceptible to arbitrary file upload due to insufficient file type validation whe...

Open Babel Heap Buffer Overflow DoS

The vulnerability of the ChemKinFormat::CheckSpecies function in the Open Babel file format conversion software is related to the execution of operations outside the buffer boundaries in memory. Exploiting this vulnerability could allow an attacker to cause a system failure...

CVE-2025-56526

Kotaemon version 0.11.0 is vulnerable to Stored Cross-Site Scripting (XSS) due to the unsanitized rendering of content extracted from PDF files. Specifically, text, table markings, and image metadata are injected into the DOM without escaping, allowing a crafted PDF to execute arbitrary JavaScrip...

CVE-2025-56526

Cross site scripting XSS vulnerability in Kotaemon 0.11.0 allowing attackers to execute arbitrary code via a crafted PDF...

PT-2025-47259

Name of the Vulnerable Software and Affected Versions Pie Forms for WP plugin for WordPress versions prior to 1.7 Description The Pie Forms for WP plugin for WordPress is susceptible to an Arbitrary File Upload issue through the format classic function. Insufficient file type validation within th...

WordPress plugin “Enable SVG, WebP, and ICO Upload” – Cross-site scripting vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress is a blogging platform developed using the PHP language, which provides the ability to host personal blog sites on PHP and MySQL based...

CVE-2025-40936

A vulnerability has been identified in PS/IGES Parasolid Translator Component All versions V29.0.258, Simcenter Femap All versions V2512.0003, Solid Edge All versions V226.00 Update 03. The affected applications contains an out of bounds read vulnerability while parsing specially crafted IGS file...

[SECURITY] Fedora 42 Update: xmedcon-0.25.3-1.fc42

This project stands for Medical Image Conversion and is released under the GNU's LGPL license. It bundles the C source code, a library, a flexible command-line utility and a graphical front-end based on the amazing Gtk+ toolkit. Its main purpose is image conversion while preserving valuable medic...

[SECURITY] Fedora 43 Update: xmedcon-0.25.3-1.fc43

This project stands for Medical Image Conversion and is released under the GNU's LGPL license. It bundles the C source code, a library, a flexible command-line utility and a graphical front-end based on the amazing Gtk+ toolkit. Its main purpose is image conversion while preserving valuable medic...

[SECURITY] Fedora 43 Update: python-pdfminer-20251107-1.fc43

Pdfminer.six is a community maintained fork of the original PDFMiner. It is a tool for extracting information from PDF documents. It focuses on getting and analyzing text data. Pdfminer.six extracts the text from a page directly from the sourcecode of the PDF. It can also be used to get the exact...

PT-2025-47142

Name of the Vulnerable Software and Affected Versions PS/IGES Parasolid Translator Component versions prior to 29.0.258 Description The PS/IGES Parasolid Translator Component contains an out-of-bounds read issue when processing specifically designed IGS files. This could potentially allow an...

RHEL 9 : libtiff (RHSA-2025:21506)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:21506 advisory. The libtiff packages contain a library of functions for manipulating Tagged Image File Format TIFF files. Security Fixes: libtiff: Libtiff...

kimageformats:kimgio_xcf_fuzzer: Use-of-uninitialized-value in QImage::pixel

Project: git://anongit.kde.org/kimageformats Detailed Report: https://oss-fuzz.com/testcase?key=5281479564525568 Project: kimageformats Fuzzing Engine: libFuzzer Fuzz Target: kimgioxcffuzzer Job Type: libfuzzermsankimageformats Platform Id: linux Crash Type: Use-of-uninitialized-value Crash...

udsgltf Plugin RCE

The vulnerability of the usdGltf plugin relates to buffer overflow in dynamic memory. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

usdGltf Plugin Unauthorized Access

The vulnerability of the usdGltf plugin relates to the reading of data beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information through a specially created file...

usdGltf Plugin Unauthorized Access

The vulnerability of the usdGltf plugin relates to the reading of data beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information through a specially created file...

usdGltf Plugin Unauthorized Access

The vulnerability of the usdGltf plugin relates to the reading of data beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information through a specially created file...