EUVD-2026-43000

Snipe-IT has a path traversal vulnerability via CSV import image field...

GHSA-XR9M-GPHC-9P63 Snipe-IT has a path traversal vulnerability via CSV import `image` field

Impact An authenticated user holding the import and assets.update permissions can delete arbitrary files on the server filesystem by injecting a path traversal string into an asset's image field via CSV import, then triggering the image deletion feature...

Snipe-IT has a path traversal vulnerability via CSV import `image` field

Impact An authenticated user holding the import and assets.update permissions can delete arbitrary files on the server filesystem by injecting a path traversal string into an asset's image field via CSV import, then triggering the image deletion feature...

SUSE CVE-2026-38348

An integer overflow in the libswscale/utils.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service DoS via supplying a crafted image file...

SUSE CVE-2026-38349

An integer overflow in the hScale16To19c function libswscale/output.c of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service DoS via supplying a crafted image file...

SUSE CVE-2026-78465

A flaw was found in the file-pcx plugin in GIMP, affecting 32-bit builds only. When processing a PCX image file, the plugin calculates memory allocation sizes based on the image dimensions and the number of color planes. If a crafted file sets the number of planes to 4 alongside sufficiently larg...

SUSE CVE-2026-80598

In the Linux kernel, the following vulnerability has been resolved: ntfs3: fix out-of-bounds read in decompresslznt decompresslznt does not validate array index bounds before accessing the decompression table. A corrupted NTFS3 image with invalid compressed data can trigger an out-of-bounds read...

SUSE CVE-2026-80656

In the Linux kernel, the following vulnerability has been resolved: hfsplus: Add a sanity check for btree node size Syzbot reported an uninit-value bug in 1 with a corrupted HFS+ image, during the file system mounting process, specifically while loading the catalog, a corrupted nodesize value of ...

SUSE CVE-2026-80672

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix u16 truncation of restart-area length check ntfscheckrestartarea validates that the $LogFile restart area and its trailing log client record array fit within the system page size: u16 raofs, ralen, caofs; ... ralen =...

CVE-2026-81285

Unauthenticated Denial of Service Attack in Smush Image Compression and Optimization = 4.2.0 versions...

CVE-2026-82330

A flaw was found in the file-pvr plugin in GIMP. When processing a specially crafted PVR image file, the VQ compressed decoder does not properly perform memory bounds checking. This missing validation results in a heap out-of-bounds read. This issue can result in an application crash, leading to ...

UBUNTU-CVE-2026-82324

A flaw was found in the file-iff IFF/ILBM plugin in GIMP. When processing a specially crafted IFF/ILBM image file, the plugin does not properly validate the HAM row size and improperly handles cases where the number of color planes nPlanes is zero. This causes a row size mismatch that bypasses...

CVE-2026-82330

A flaw was found in the file-pvr plugin in GIMP. When processing a specially crafted PVR image file, the VQ compressed decoder does not properly perform memory bounds checking. This missing validation results in a heap out-of-bounds read. This issue can result in an application crash, leading to ...

CVE-2026-82330

A flaw was found in the file-pvr plugin in GIMP. When processing a specially crafted PVR image file, the VQ compressed decoder does not properly perform memory bounds checking. This missing validation results in a heap out-of-bounds read. This issue can result in an application crash, leading to ...

CVE-2026-81285 WordPress Smush Image Compression and Optimization plugin <= 4.2.0 - Denial of Service Attack vulnerability

Unauthenticated Denial of Service Attack in Smush Image Compression and Optimization = 4.2.0 versions...

EUVD-2026-67728

Unauthenticated Denial of Service Attack in Smush Image Compression and Optimization = 4.2.0 versions...

CVE-2026-81285

Smush Image Compression and Optimization is a WordPress plugin affected by an unauthenticated Denial of Service vulnerability in versions ≤ 4.2.0 . The flaw allows a remote, unauthenticated attacker to trigger a denial of service over the network with low complexity and no user interaction requir...

CVE-2026-82328

A flaw was found in the file-ico plugin in GIMP. When processing a specially crafted ICO image file, the plugin does not properly validate the usedclrs palette count parameter. This incorrect validation leads to improper memory bounds checking, resulting in a heap out-of-bounds read. This issue c...

WordPress wpDiscuz plugin < 7.6.60 - Unauthenticated Stored XSS via Image URL Conversion vulnerability

Unauthenticated Stored XSS via Image URL Conversion vulnerability discovered by hieus in WordPress Plugin wpDiscuz versions 7.6.60...

WordPress Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin 8.5-8.9.2 - Subscriber+ Arbitrary Image Move vulnerability

Subscriber+ Arbitrary Image Move vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Directorist versions 8.5-8.9.2...