PT-2026-60393

A missing output encoding call in print all bug page word.php allows any authenticated user to inject arbitrary HTML into an IMG tag's alt attribute via an image attachment with a crafted filename such as probe." onload="alert1. When any user views the HTML export page print all bug page...

PT-2026-81853

Name of the Vulnerable Software and Affected Versions GIMP affected versions not specified Description A flaw in the file-xwd plugin occurs when processing specially crafted XWD image files. The plugin validates image width and bytes-per-line parameters independently instead of ensuring their...

CVE-2026-58549: Buffer Copy without Checking Size of Input

Out-of-bounds read vulnerability in the image codec module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...

PT-2026-60119

Open WebUI before 0.9.5 contains a stored cross-site scripting vulnerability in the OAuth authentication flow where the picture claim URL MIME type is inferred from file extension rather than Content-Type header, allowing SVG files to bypass the profile image validator and be stored as data URIs...

PT-2026-60125

Out-of-bounds read vulnerability in the image codec module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...

PT-2026-60126

Out-of-bounds read vulnerability in the image codec module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...

PT-2026-60353

Name of the Vulnerable Software and Affected Versions Drupal core versions 0.0.0 through 10.6.13 Drupal core versions 11.3.0 through 11.3.14 Drupal core versions 11.4.0 through 11.4.4 Drupal core versions 0.0.0 through 11.0.x Drupal core versions 0.0.0 through 11.1.x Drupal core versions 0.0.0...

ImageMagick magick-distribute-cache Disclosure

The vulnerability of the magick-distribute-cache service in the console-based image editing tool ImageMagick is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to disclose protected information...

PT-2026-60156

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7.1.2-26 Description A memory leak exists in the JNG encoder when a blob cannot be opened. An attacker can trigger this issue by providing malformed JNG files that cause blob operations to fail, leading to resourc...

ImageMagick IPTC Metadata Data Compromise

The vulnerability of the IPTC writing module in the console-based image editing tool ImageMagick is related to the escape of operations from the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to compromise the confidentiality and accessibility of the protected...

Drupal 10.6.x < 10.6.13 / 11.3.x < 11.3.14 / 11.4.x < 11.4.4 Multiple Vulnerabilities (drupal-2026-07-15)

According to its self-reported version, the instance of Drupal running on the remote web server is 10.6.x prior to 10.6.13, 11.3.x prior to 11.3.14, or 11.4.x prior to 11.4.4. It is, therefore, affected by multiple vulnerabilities. - Drupal core 11.2 and above integrate the HTMX JavaScript librar...

PT-2026-60157

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7.1.2-26 Description A memory leak exists in the TIFF encoder that occurs when memory allocation fails. An attacker can trigger these allocation failures during the processing of TIFF images, leading to memory...

PT-2026-60159

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7.1.2-26 ImageMagick versions prior to 6.9.13-51 Description A memory leak exists in the MIFF encoder. This issue occurs when a memory allocation fails during the processing of MIFF images, which can result in a...

Malicious Package

Overview nativescript-swisspost-imagepicker is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

CVE-2026-61520

Simple Machines Forum 2.1 prior to commit 4bf35cf and 3.0 prior to commit b4d23df contains a server-side request forgery vulnerability in the image proxy that allows authenticated attackers to trigger internal HTTP requests by embedding attacker-controlled URLs in BBCode image tags, which the pro...

Missing Authorization

Overview drupal/core is an an open source content management platform powering millions of websites and applications. Affected versions of this package are vulnerable to Missing Authorization in the deliver method of ImageStyleDownloadController Image module, which classified any scheme other tha...

CVE-2026-61520

Simple Machines Forum 2.1 prior to commit 4bf35cf and 3.0 prior to commit b4d23df contains a server-side request forgery vulnerability in the image proxy that allows authenticated attackers to trigger internal HTTP requests by embedding attacker-controlled URLs in BBCode image tags, which the pro...

CVE-2026-61520 Simple Machines Forum SSRF via image proxy

Simple Machines Forum 2.1 prior to commit 4bf35cf and 3.0 prior to commit b4d23df contains a server-side request forgery vulnerability in the image proxy that allows authenticated attackers to trigger internal HTTP requests by embedding attacker-controlled URLs in BBCode image tags, which the pro...

EUVD-2026-44490

Simple Machines Forum 2.1 prior to commit 4bf35cf and 3.0 prior to commit b4d23df contains a server-side request forgery vulnerability in the image proxy that allows authenticated attackers to trigger internal HTTP requests by embedding attacker-controlled URLs in BBCode image tags, which the pro...

CVE-2026-61520 Simple Machines Forum SSRF via image proxy

Simple Machines Forum 2.1 prior to commit 4bf35cf and 3.0 prior to commit b4d23df contains a server-side request forgery vulnerability in the image proxy that allows authenticated attackers to trigger internal HTTP requests by embedding attacker-controlled URLs in BBCode image tags, which the pro...