CVE-2026-63764

LMDeploy through 0.14.0, fixed in commit 03c3130, contains a server-side request forgery SSRF vulnerability in the loadhttpurl function within the connection.py media handler, where the private-IP guard validates only the original URL without re-validating hosts after HTTP redirects. An...

CVE-2026-63764 LMDeploy Server-Side Request Forgery via HTTP Redirect Bypass

LMDeploy through 0.14.0, fixed in commit 03c3130, contains a server-side request forgery SSRF vulnerability in the loadhttpurl function within the connection.py media handler, where the private-IP guard validates only the original URL without re-validating hosts after HTTP redirects. An...

CVE-2026-63764 LMDeploy Server-Side Request Forgery via HTTP Redirect Bypass

LMDeploy through 0.14.0, fixed in commit 03c3130, contains a server-side request forgery SSRF vulnerability in the loadhttpurl function within the connection.py media handler, where the private-IP guard validates only the original URL without re-validating hosts after HTTP redirects. An...

CVE-2026-63764

LMDeploy prior to 0.14.0 contains a server-side request forgery (SSRF) in the _load_http_url function of the media handler. The private-IP guard validates only the original URL; after HTTP redirects, hosts are not re-validated. An unauthenticated attacker can submit a crafted image_url to the cha...

CVE-2026-46556 FlaskBB: SSRF in get_image_info() via unrestricted avatar URL

FlaskBB is a Forum Software written in Python using the micro framework Flask. Prior to version 2.2.1, a Server-Side Request Forgery SSRF vulnerability in getimageinfo allows any authenticated user to force the server to send HTTP requests to arbitrary internal endpoints, including cloud metadata...

CVE-2026-46556 FlaskBB: SSRF in get_image_info() via unrestricted avatar URL

FlaskBB is a Forum Software written in Python using the micro framework Flask. Prior to version 2.2.1, a Server-Side Request Forgery SSRF vulnerability in getimageinfo allows any authenticated user to force the server to send HTTP requests to arbitrary internal endpoints, including cloud metadata...

Gitea Docker image: `REVERSE_PROXY_TRUSTED_PROXIES = *` default lets any source IP impersonate any user via `X-WEBAUTH-USER`

Summary The Gitea Docker images ship an app.ini template that hard-codes: REVERSEPROXYTRUSTEDPROXIES = The documented default for this setting, in custom/conf/app.example.ini, is 127.0.0.0/8,::1/128, i.e. only loopback is trusted. When an admin enables ENABLEREVERSEPROXYAUTHENTICATION = true to p...

AZL-93111 CVE-2026-56852 affecting package azurelinux-image-tools for versions less than 1.5.0-2

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes...

CVE-2026-47667

CImg Library is a C++ library for image processing. Prior to version 4.0.0 in loadanalyze, the headersize field is read as an unsigned int from the first 4 bytes of an Analyze/NIfTI file and passed directly to new unsigned charheadersize without being bounded against the actual file size. A value...

DEBIAN-CVE-2026-47667

CImg Library is a C++ library for image processing. Prior to version 4.0.0 in loadanalyze, the headersize field is read as an unsigned int from the first 4 bytes of an Analyze/NIfTI file and passed directly to new unsigned charheadersize without being bounded against the actual file size. A value...

UBUNTU-CVE-2026-47667

CImg Library is a C++ library for image processing. Prior to version 4.0.0 in loadanalyze, the headersize field is read as an unsigned int from the first 4 bytes of an Analyze/NIfTI file and passed directly to new unsigned charheadersize without being bounded against the actual file size. A value...

AperiSolve v3.4.2

Aperi'Solve Try it now: https://www.aperisolve.com Support Aperi'Solve: Aperi'Solve is an open-source steganalysis web platform that performs automated analysis on...

CVE-2026-47667

CImg Library is a C++ library for image processing. Prior to version 4.0.0 in loadanalyze, the headersize field is read as an unsigned int from the first 4 bytes of an Analyze/NIfTI file and passed directly to new unsigned charheadersize without being bounded against the actual file size. A value...

agentgateway (1.1.9), foundation-cancer-image-biomarker (>=1.0.1a4, <=1.0.1a5) +1 more potentially affected by CVE-2026-59890 via setuptools (75.4.0)

setuptools PYPI version 75.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - agentgateway 1.1.9 - foundation-cancer-image-biomarker =1.0.1a4, =1.0.1a5 - hushhai 0.0.1 Source cves: CVE-2026-59890 Source advisory:...

Security update for openexr

This update for openexr fixes the following issue CVE-2026-54920: unchecked integer overflows in Image::resize followed by an exception can lead to an invalid delete via uninitialized pointers bsc1269703. Patch Instructions: To install this SUSE update use the SUSE recommended installation method...

SUSE-SU-2026:3168-1 Security update for openexr

This update for openexr fixes the following issue - CVE-2026-54920: unchecked integer overflows in Image::resize followed by an exception can lead to an invalid delete via uninitialized pointers bsc1269703...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the asyncgetmediaimage function in the Shelly integration when processing the thumb field. An attacker can execute arbitrary HTML or JavaScript in the context of the Home Assistant web origin by supplying a...

CVE-2026-63964

A flaw was found in the Linux kernel's USB Type-C UCSI CCG driver. A local attacker with root privileges can provide a specially crafted firmware image without a required record header. This malformed image can cause a null pointer dereference within the doflash function, leading to a kernel cras...

GHSA-55JH-FWMH-39M4 Microsoft Security Advisory CVE-2026-50526 – .NET Tampering Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET SDK Microsoft.NET.Build.Containers. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A tampering...

CVE-2026-64824 Home Assistant Core < 2026.7.0 Symlink Path Traversal RCE via backup-restore

Home Assistant Core before 2026.7.0 contains a path traversal vulnerability in the backup-restore function that allows attackers to write files to arbitrary absolute filesystem paths by supplying a crafted tar archive with a SYMTYPE entry containing a benign member name paired with an absolute...