61629 matches found
SUSE CVE-2026-58586
Image::WebP versions before 0.3.0 for Perl bundle a vulnerable version of libwebp. Image::WebP does not link to the system libwebp. Instead, it uses a bundled copy of libwebp 0.3.0 released 2013-03-20. That version has multiple known vulnerabilities, including CVE-2023-4863. Any caller that decod...
PT-2026-64539
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the aix partition function where the system reads a physical volume descriptor into a fixed-size struct pvd and scans its physical-partition-extent array. The loop...
CVE-2026-64318: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: partitions: aix: bound the ppcount scan to the ppe array aixpartition reads the physical volume descriptor into a fixed-size struct pvd and then scans its physical-partition-extent array: int numpps = be16tocpupvd-ppcount; ... fo...
SUSE SLES15: ImageMagick / ImageMagick-config-7-SUSE / etc (SUSE-SU-2026:3219-1)
The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3219-1 advisory. - CVE-2026-55628: policy bypass in concatenate operation due to missing checks bsc1270081. - CVE-2026-56362: heap buffer overflow...
Heap-based Buffer Overflow
Overview Affected versions of this package are vulnerable to Heap-based Buffer Overflow in the pngwritechunk process. An attacker can cause heap memory corruption, process crashes, or potentially achieve arbitrary code execution by supplying a crafted PNG image containing a malicious eXIf chunk...
vantage6: Algorithm developer can edit another developer's algorithm that is pending / under review
Impact Edit permission lacks ownership check, so another developer could alter metadata that is later trusted by nodes. Worst they could do is update the image or image tag. If that is not noted, another image is approved than the one actually under review Patches No Workarounds No...
GHSA-47W6-GWP4-W6VC vantage6: Algorithm developer can edit another developer's algorithm that is pending / under review
Impact Edit permission lacks ownership check, so another developer could alter metadata that is later trusted by nodes. Worst they could do is update the image or image tag. If that is not noted, another image is approved than the one actually under review Patches No Workarounds No...
AperiSolve v3.7.1
Aperi'Solve Try it now: https://www.aperisolve.com Support Aperi'Solve: Aperi'Solve is an open-source steganalysis web platform that performs automated analysis on...
GHSA-G9J2-8W95-3VWV Cloudreve: Denial of Service - Image decompression / pixel bomb in thumbnail & avatar decoding crashes the server
Summary Cloudreve's built-in image processor decodes user-supplied images with Go's standard-library decoders image/png, image/jpeg, image/gif and guards only the compressed file size — never the decoded pixel dimensions. Go's decoders allocate a pixel buffer sized bytesPerPixel × width × height...
Cloudreve: Denial of Service - Image decompression / pixel bomb in thumbnail & avatar decoding crashes the server
Summary Cloudreve's built-in image processor decodes user-supplied images with Go's standard-library decoders image/png, image/jpeg, image/gif and guards only the compressed file size — never the decoded pixel dimensions. Go's decoders allocate a pixel buffer sized bytesPerPixel × width × height...
CVE-2026-66040 FFmpeg Heap Out-of-Bounds Write via PNG/APNG eXIf Encoder
FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows remote attackers to corrupt heap memory by supplying a crafted PNG image with a malicious eXIf chunk. Attackers can craft an eXIf chunk where multiple I...
EUVD-2026-48742
FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows remote attackers to corrupt heap memory by supplying a crafted PNG image with a malicious eXIf chunk. Attackers can craft an eXIf chunk where multiple I...
CVE-2026-66040 FFmpeg Heap Out-of-Bounds Write via PNG/APNG eXIf Encoder
FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows remote attackers to corrupt heap memory by supplying a crafted PNG image with a malicious eXIf chunk. Attackers can craft an eXIf chunk where multiple I...
Incorrect Authorization
Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Incorrect Authorization via the /api/v1/images/edit route. An attacker can trigger server-side image editing operations using administrator-configured credentials, even when global image editing is disabled o...
GHSA-RQJ7-6WRP-6G2G Open WebUI: POST /api/v1/images/edit bypasses the global image-edit switch and the per-user image-generation permission
Summary POST /api/v1/images/edit performed no authorization beyond requiring a verified account. Every other image-editing surface in Open WebUI enforces the global image-edit switch and the per-user image-generation permission — the /api/v1/images/generations route, the built-in editimage tool,...
Open WebUI: POST /api/v1/images/edit bypasses the global image-edit switch and the per-user image-generation permission
Summary POST /api/v1/images/edit performed no authorization beyond requiring a verified account. Every other image-editing surface in Open WebUI enforces the global image-edit switch and the per-user image-generation permission — the /api/v1/images/generations route, the built-in editimage tool,...
EUVD-2026-42618
Open WebUI: POST /api/v1/images/edit bypasses the global image-edit switch and the per-user image-generation permission...
GHSA-H22J-F9XW-XJJM ImageMagick: Integer Overflow in JNX decoder causes heap buffer over-write when processing extremly large files on 32-bit builds
When processing an extremely large JNX file on 32-bit platforms an integer overflow will happen that can cause a heap buffer over-write...
Out-of-bounds Write
Overview Magick.NET-Q16-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...
Out-of-bounds Write
Overview Magick.NET-Q16-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...