Important: Red Hat Security Advisory: satellite/iop-vulnerability-engine-rhel9 container image available as a Technology Preview

A new satellite/iop-vulnerability-engine-rhel9 container image is now available as a Technology Preview in the Red Hat container registry. Red Hat Lightspeed in Satellite analyzes system health and configuration by applying predefined rules to a small set of local data, such as installed packages...

EUVD-2026-70732

A security flaw has been discovered in itsourcecode Online Medicine Delivery System 1.0. The affected element is the function doInsert of the file /rider/orders/controller.php?action=add of the component Order Management Controller. Performing a manipulation of the argument image results in...

CVE-2026-84773

Unauthenticated Cross Site Scripting XSS in EWWW Image Optimizer = 8.7.6 versions...

CVE-2026-84773 WordPress EWWW Image Optimizer plugin <= 8.7.6 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in EWWW Image Optimizer = 8.7.6 versions...

CVE-2026-84773 WordPress EWWW Image Optimizer plugin <= 8.7.6 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in EWWW Image Optimizer = 8.7.6 versions...

EUVD-2026-70576

Unauthenticated Cross Site Scripting XSS in EWWW Image Optimizer = 8.7.6 versions...

CVE-2026-84773

EWWW Image Optimizer for WordPress (versions

CVE-2026-80755

In the Linux kernel, the following vulnerability has been resolved: selinux: reject a permission value exceeding the class permission count permread bounds a permission value by SELVECMAX but never by the nprim of the owning class or common, which is taken verbatim from the policy image...

UBUNTU-CVE-2026-80755

In the Linux kernel, the following vulnerability has been resolved: selinux: reject a permission value exceeding the class permission count permread bounds a permission value by SELVECMAX but never by the nprim of the owning class or common, which is taken verbatim from the policy image...

CVE-2026-71220 Gfs2-utils: gfs2-utils: stack out-of-bounds write via unchecked di_height in gfs2_edit

A stack out-of-bounds write vulnerability was found in gfs2-utils. In gfs2edit, the diheight field from on-disk inode metadata is used as an array index without bounds checking, causing a stack buffer overflow that may lead to arbitrary code execution when processing crafted GFS2 filesystem image...

CVE-2026-85162 AVideo through c91b5975d CSRF via saveLive.php

AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in plugin/Live/saveLive.php that lacks forbidIfNotPost and forbidIfInvalidToken protections. Attackers can craft malicious image tags to overwrite authenticated streamers' RTMP keys, passwords, and titles, hijacki...

CVE-2026-85162

AVideo (through commit c91b5975d) contains a cross-site request forgery (CSRF) vulnerability in plugin/Live/saveLive.php , which lacks forbidIfNotPost and forbidIfInvalidToken protections. An attacker can craft malicious image tags to overwrite authenticated streamers' RTMP keys, passwords, and t...

RLSA-2026:62425 Important: gegl security update

GEGL Generic Graphics Library is a graph-based image processing framework. Security Fixes: gimp: gegl: GIMP: Remote code execution via integer overflow in HDR file parsing CVE-2026-18300 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other...

[SECURITY] Fedora 43 Update: exiv2-0.28.9-1.fc43

A command line utility to access image metadata, allowing one to: print the Exif metadata of Jpeg images as summary info, interpreted values, or the plain data for each tag print the Iptc metadata of Jpeg images print the Jpeg comment of Jpeg images set, add and delete Exif and Iptc metadata of...

PT-2026-85110

Unauthenticated Cross Site Scripting XSS in EWWW Image Optimizer = 8.7.6 versions...

openSUSE 16: emacs / emacs-el / emacs-eln / emacs-games / emacs-info / emacs-nox / etc (openSUSE-SU-2026:21711-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21711-1 advisory. Security issues fixed: - Arbitrary code execution when opening a specially crafted file bsc1275941. - CVE-2026-77219: integer overflow in the...

Next.js Framework 15.5.x < 15.5.21 / 16.x < 16.2.11 Image Optimization API DoS (GHSA-q8wf-6r8g-63ch)

The Next.js Framework on the remote host is affected by a denial of service vulnerability: - When self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely hosted images if configured not enabled by default. If those images contain malicious content, the...

PT-2026-89118

Name of the Vulnerable Software and Affected Versions libheif versions 1.19.0 through 1.23.2 Description A crafted image item containing a clap property and an ispe width or height greater than INT32 MAX + 1 can reach crop calculations through the heif image handle get image tiling function. The...

CVE-2026-85208: Unrestricted Upload of File with Dangerous Type

A security flaw has been discovered in itsourcecode Online Medicine Delivery System 1.0. The affected element is the function doInsert of the file /rider/orders/controller.php?action=add of the component Order Management Controller. Performing a manipulation of the argument image results in...

Oracle Linux 9 : image-builder (ELSA-2026-23228)

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-23228 advisory. 72.0.0-1.0.1 - Adopt upstream image-builder 72.0.0 tarball and spec file Orabug: 39666668 - Adopt Oracle Linux Support merged upstream in PR 2404...