CVE-2026-53505

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:proportion filter does not enforce an upper bound on and runs in the post-transform phase. An attacker can trigger extremely large resizes CPU/memory exhaustion and cause denial of service. This issu...

CVE-2026-53504

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the convolution filter regular expression performs exponential backtracking on crafted repeated numeric input, allowing a URL request to exhaust processing time. This issue is fixed in 7.8.0...

CVE-2026-53503

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:convolution, , filter passes the user-controlled value to a C extension thumbor/ext/filters/convolution.c where it is used as a divisor for % and / without validating columns 0. When columns=0, the C...

CVE-2026-53501

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor’s HMAC validation can be bypassed due to the use of Python’s .replace when removing the signature from the URL before validation. Since .replace removes all occurrences of the substring, an attacker can insert...

Brazil Arrests ‘USDoD,’ Hacker in FBI Infragard Breach

Brazilian authorities reportedly have arrested a 33-year-old man on suspicion of being "USDoD ," a prolific cybercriminal who rose to infamy in 2022 after infiltrating the FBI 's InfraGard program and leaking contact information for 80,000 members. More recently, USDoD was behind a breach at the...

Malicious code in globo-ab-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 949637eeae8b97408cbe154f684c069511664356161fe42ac82e4c87ea16d4bc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3391 Malicious code in globo-ab-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 949637eeae8b97408cbe154f684c069511664356161fe42ac82e4c87ea16d4bc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

api-cristo90anos-ssr.globo.com Cross Site Scripting vulnerability OBB-2160041

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...