PT-2026-62010

Name of the Vulnerable Software and Affected Versions Malcolm versions prior to 26.07.0 Description The safe-extract.py script extracts uploaded archives without imposing limits on the number of entries, directory depth, total entries, or output size. An attacker can use a small malicious archive...

PT-2026-62100

djangoSIGE through 1.10 commit a6fe7e8 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to cancel sales or purchase orders on behalf of authenticated users by exploiting order-cancellation logic implemented inside HTTP GET method handlers in...

📄 WordPress AI Image 1.5.1 Unauthenticated Shell Upload

WordPress AI Image WP AI Image Generator plugin version 1.5.1 contains an unauthenticated arbitrary file upload to remote code execution vulnerability. A remote attacker can upload executable PHP code and achieve remote code execution. This proof of concept exploit demonstrates the vulnerable...

EulerOS Virtualization 2.12.0 : qemu (EulerOS-SA-2026-2802)

According to the versions of the qemu packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked...

PT-2026-67411

Name of the Vulnerable Software and Affected Versions Grav CMS version 2.0.10 Description A path traversal issue exists in the ImageMedium::watermark function, which passes an unsanitized $image argument to RocketThemeToolboxResourceLocatorUniformResourceLocator::findResource. The file:// scheme...

KLA91164 Multiple vulnerabilities in Mozilla Firefox

Multiple vulnerabilities were found in Mozilla Firefox. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, obtain sensitive information, spoof user interface. Below is a complete list of vulnerabilities: 1. Security...

KLA91170 Multiple vulnerabilities in Mozilla Thunderbird

Multiple vulnerabilities were found in Mozilla Thunderbird. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, obtain sensitive information, spoof user interface. Below is a complete list of vulnerabilities: 1. Denia...

KLA91169 Multiple vulnerabilities in Mozilla Thunderbird ESR

Multiple vulnerabilities were found in Mozilla Thunderbird ESR. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, obtain sensitive information. Below is a complete list of vulnerabilities: 1. Denial of service...

Important: libtiff security update

The libtiff packages contain a library of functions for manipulating Tagged Image File Format TIFF files. Security Fixes: libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image CVE-2026-12912 For more details about the security issues, including the impact, a CVSS...

Fedora 45 : golang-x-image (2026-3e4b43a4cd)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-3e4b43a4cd advisory. Automatic update for golang-x-image-0.44.0-1.fc45. Changelog Tue Jul 21 2026 Packit - 0.44.0-1 - Update to 0.44.0 upstream release - Resolves: rhbz2343804 -...

EulerOS Virtualization 2.12.1 (EulerOS-SA-2026-2738)

According to the versions of the package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the...

Incorrect Regular Expression

Overview @astrojs/netlify is a Deploy your site to Netlify Affected versions of this package are vulnerable to Incorrect Regular Expression in the remotePatternToRegex process. An attacker can access unintended image URLs on the allowed host by crafting requests that exploit unescaped regex...

@astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escaped

Summary The @astrojs/netlify adapter converts each image.remotePatterns entry into a regular expression that is written to .netlify/v1/config.json under images.remoteimages. Netlify's Image CDN uses these regexes as the allowlist that decides which remote image URLs it will optimize...

GHSA-HP3V-MFQW-H74C @astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escaped

Summary The @astrojs/netlify adapter converts each image.remotePatterns entry into a regular expression that is written to .netlify/v1/config.json under images.remoteimages. Netlify's Image CDN uses these regexes as the allowlist that decides which remote image URLs it will optimize...

Pillow: Controlled heap out-of-bounds write in Pillow `ImageCmsTransform.apply()` via output mode mismatch

Summary Pillow's public ImageCms.ImageCmsTransform.applyim, imOut API can trigger controlled native heap corruption when the caller supplies an output image whose mode does not match the transform's declared output mode. For example, a transform built as RGBA - RGBA can be applied to an L output...

GHSA-9HW9-CH79-4VH6 Pillow: Controlled heap out-of-bounds write in Pillow `ImageCmsTransform.apply()` via output mode mismatch

Summary Pillow's public ImageCms.ImageCmsTransform.applyim, imOut API can trigger controlled native heap corruption when the caller supplies an output image whose mode does not match the transform's declared output mode. For example, a transform built as RGBA - RGBA can be applied to an L output...

Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service

Summary src/libImaging/Jpeg2KDecode.c:853 accumulates totalcomponentwidth across every tile in a JPEG2000 image instead of recomputing it per tile. That accumulated value is then used in the tilebytes calculation at src/libImaging/Jpeg2KDecode.c:868, which can make the decoder grow state-buffer v...

GHSA-PG7V-JWJ7-P798 Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service

Summary Pillow's EPS parser PIL/EpsImagePlugin.py accepts a negative byte count in the %%BeginBinary directive. A crafted EPS file can cause Image.open to seek backwards to the same directive and parse it repeatedly, resulting in an infinite loop and CPU denial of service. The issue is triggered...

EUVD-2026-43739

Pillow: Heap out-of-bounds write Image.paste / Image.crop via signed coordinate overflow...

Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow

Summary Pillow's public image coordinate APIs can trigger a native heap out-of-bounds write when given coordinates near the signed 32-bit integer limits. In 4-byte pixel modes such as RGBA, this becomes a controlled backward heap underwrite: for a source image of width W, Pillow writes 4 W...