SUSE SLED15 / SLES15 Security Update : tiff (SUSE-SU-2026:3054-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3054-1 advisory. This update for tiff fixes the following issues - CVE-2026-12912: heap-based buffer overflow when processing...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : .NET vulnerabilities (USN-8553-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8553-1 advisory. Artur Stetsko discovered that the .NET did not properly validate authentication data. An attacker could possibly use this issue t...

RHEL 9 : gimp (RHSA-2026:40751)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:40751 advisory. The GIMP GNU Image Manipulation Program is an image composition and editing program. GIMP provides a large image manipulation toolbox,...

Linux Distros Unpatched Vulnerability : CVE-2026-59205

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pillow is a Python imaging library. Prior to 12.3.0, Pillow's ImageCms.ImageCmsTransform.applyim, imOut API can trigger controlled native heap corruption when t...

Linux Distros Unpatched Vulnerability : CVE-2026-59199

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pillow is a Python imaging library. Prior to 12.3.0, Pillow public image coordinate APIs can trigger a native heap out-of-bounds write when given coordinates ne...

Huawei HarmonyOS Image Codec Module Out-of-Bounds Read Vulnerability

Huawei HarmonyOS is an operating system developed by Chinese company Huawei. It is a full-scenario distributed operating system based on a microkernel architecture. The Huawei HarmonyOS’s media coding and decoding module contains a out-of-bounds read vulnerability, which allows attackers to...

Huawei HarmonyOS Image Codec Module Out-of-Bounds Reading Vulnerability (CNVD-2026-29425)

Huawei HarmonyOS is an operating system developed by Chinese company Huawei. It is a full-scenario distributed operating system based on a microkernel architecture. The Huawei HarmonyOS’s media coding and decoding module contains a out-of-bounds read vulnerability, which allows attackers to explo...

Linux Distros Unpatched Vulnerability : CVE-2026-61872

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the TIFF encoder when an invalid tiff:tile-geometry is specified. Supplying malformed tile...

PT-2026-60487

SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.241.203, the authenticated GET /api/user/info/ and GET /api/user/profile-image/ endpoints in application/single app/route backend users.py accepted a caller-supplie...

Huawei HarmonyOS Buffer Overflow Vulnerability (CNVD-2026-29729)

Huawei HarmonyOS is a distributed operating system developed by Huawei for various scenarios. Version 6.1.0 of Huawei HarmonyOS contains a buffer overflow vulnerability. This vulnerability arises from failing to correctly validate the input range when reading image data, resulting in the reading ...

CVE-2026-45368: Improper Neutralization of Input During Web Page Generation

Kirby is an open-source content management system. In versions prior to 4.9.1 and 5.4.1, the underlying URL methods for the KirbyTags and image blocks components did not filter out malicious URL values that resolve to script execution. The vulnerability affects four first-party Kirby renderers th...

CVE-2026-44019: External Control of File Name or Path

Docling Core defines core data types and transformations for the document processing application Docling. In versions 2.5.0 and above, prior to 2.74.1, docling-core could allow local file:// image references and accepted inline data: content without a decoded-size limit. In applications that acce...

CVE-2026-3031: Use of Unmaintained Third Party Components

Image::EPEG versions through 0.15 for Perl embeds an unsupported version of the Epeg library. Image::EPEG includes Epeg 0.9.0 that was last updated in 2004. Epeg is a fast JPEG thumbnail library that was once part of the Englightenment Project...

Huawei HarmonyOS Image Codec Module Out-of-Bounds Reading Vulnerability

Huawei HarmonyOS is an operating system. The image codec module of Huawei HarmonyOS has a out-of-bounds read vulnerability, which stems from insufficient validation of input data. Attackers can exploit this vulnerability to compromise the confidentiality of services...

PT-2026-60501

Image::EPEG versions through 0.15 for Perl embeds an unsupported version of the Epeg library. Image::EPEG includes Epeg 0.9.0 that was last updated in 2004. Epeg is a fast JPEG thumbnail library that was once part of the Englightenment Project...

GIFLIB Memory Reclamation DoS

The vulnerability of the GIFLIB library for working with GIF files is related to a memory reclamation error. Exploiting this vulnerability could allow an attacker to cause a service failure...

PT-2026-60665

Vulnerability report without repro case. Repro case may be added later after harness is complete. Preconditions 4: - Tenant can create EnvoyExtensionPolicy baseline - Controller has egress to attacker-controlled OCI registry - No registry allowlist none exists in code - Layer presents Docker/OCI...

Linux Distros Unpatched Vulnerability : CVE-2026-61866

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the JNG encoder when a blob cannot be opened. Attackers can trigger the memory leak by...

image-builder security update

58-1.0.1 - v58 with osbuild/images v0.256.0 with OL support patches - Add Azure image type - Correct dnf-plugin-spacewalk package filters 56-1.0.1 - v56 with osbuild/images v0.254.0 with OL support patches - Add gce gcp image type to OL distro types 55-1.0.1 - v55 with osbuild/images v0.252.0 wit...

DRUPAL-CORE-2026-010

The Image module allows you to define and configure image fields. The module doesn't sufficiently check access to image style derivatives when those files are served via a file stream other than private://. This vulnerability is mitigated by the fact that Drupal must be configured to use a...