PT-2026-99078

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.1.2 Description An issue exists where attacker-controlled HTML in inbound emails or tickets can bypass the image URL sanitizer using path traversal sequences. When an authenticated agent views the content, the browse...

EUVD-2026-87085

A Server-Side Request Forgery SSRF vulnerability exists in the Image API v2 of OpenStack Glance. When the showmultiplelocations configuration option is enabled in glance-api.conf, an authenticated attacker can manipulate the locations attribute of an image in the queued state by sending a crafted...

RockyLinux 10 : cockpit-image-builder (RLSA-2026:71543)

The remote RockyLinux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RLSA-2026:71543 advisory. fast-uri: fast-uri: Server-Side Request Forgery via repeated hostname percent-decoding CVE-2026-75899 fast-uri: fast-uri: Server-side request forgery v...

FreeBSD : p5-Image-ExifTool -- code injection via crafted media (bba381b5-b842-11f1-8205-107c614c014e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the bba381b5-b842-11f1-8205-107c614c014e advisory. ExifTool versions up to 13.53 contain a code injection flaw in the Processmrld function of...

CVE-2026-51772

A Server-Side Request Forgery (SSRF) vulnerability exists in the Image API (v2) of OpenStack Glance . When the show_multiple_locations configuration option is enabled in glance-api.conf, an authenticated attacker can manipulate the locations attribute of an image in the queued state by sending a ...

CVE-2026-51772

A Server-Side Request Forgery SSRF vulnerability exists in the Image API v2 of OpenStack Glance. When the showmultiplelocations configuration option is enabled in glance-api.conf, an authenticated attacker can manipulate the locations attribute of an image in the queued state by sending a crafted...

CVE-2026-96795: Improper Control of Generation of Code

Horilla is an HR and CRM software. Prior to 2.0.0, HorillaListView.exportdata in horillaviews/generic/cbv/views.py accepts an authenticated user's columns POST parameter, takes fieldtuple1, interpolates it into dynamicfnstr as Python source, and passes the generated function definition to exec. A...

Oracle Linux 10 : cockpit-image-builder (ELSA-2026-71543)

The remote Oracle Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-71543 advisory. 94.4-1.0.1 - Switch to old frotend Orabug: 38011073 Orabug: 37856296 Orabug: 37856375 - Replaced additional upstream url Orabug: 37856187 - Replaced...

CVE-2026-26830

CVE-2026-26830: pdf-image의 OS 명령 삽입 요약 pdf-image 버전 2.0.0까지는 pdfFilePath 인자를 통해 OS 명령 삽입이 가능합니다. 이 패키지는 util.format으로 셸 명령 문자열을 구성한 다음 childprocess.exec로 실행합니다. 애플리케이션이 공격자가 제어하는 파일 경로를 PDFImage에 전달하면 해당 경로의 셸 메타문자로 인해 임의의 명령 실행으로 이어질 수 있습니다. 영향받는 제품 제품| 영향받는 버전| 수정 버전 ---|---|--- pdf-image|...

cve-2019-5420

CVE-2019-5420 これはCvedの一部です: 脆弱なdockerコンテナを管理するツール。 Cved: https://github.com/git-rep-src/cved イメージソース: https://github.com/cved-sources/cve-2019-5420 イメージ作者: https://github.com/knqyf263/CVE-2019-5420...

go-pillage-registries

go-pillage-registries 이 프로젝트는 Docker 레지스트리를 가져와 카탈로그에 있는 각 이미지의 매니페스트와 구성을 약탈합니다. Google의 crane 명령 패키지를 사용하며, docker의 keychain 의미 체계를 따릅니다. 이 동작을 재정의하려면 https://github.com/google/go-containerregistry/tree/master/pkg/authn/k8schain에 설명된 대로 authn.DefaultKeychain을 변경하면 됩니다. 설치: git clone...

BIDO

BIDO 이 코드는 "BIDO: 이미지 기반 악성코드 탐지에서 주소 난독화 및 개념 변화 문제를 해결하기 위한 통합 접근 방식"에 속합니다. 저자 저자: Junhui Li1, Chengbin Feng2, Zhiwei Yang1, Qi Mo1, Wei Wang1. 소속 소속1：Yunnan University 소프트웨어 스쿨, Kunming, Yunnan 650091 중국. 소속2：University of New South Wales 정보시스템 스쿨, Sydney, NSW 2052 호주. 데이터셋 제공 데이터셋의 크기가 크기 때문...

LogoFail-PoC

🇮🇱 BringThemHome NeverAgainIsNow 🇮🇱 우리는 테러 조직 하마스에 의해 인질로 잡힌 모든 시민의 안전한 귀환을 요구합니다. 모든 인질이 석방되어 안전하게 집으로 돌아올 때까지 우리는 쉬지 않을 것입니다. 여러분도 그들을 집으로 데려오는 데 도움을 줄 수 있습니다.https://stories.bringthemhomenow.net/ BIOS 이미지 파서 익스플로잇 도구 💻 이 도구는 BIOS 이미지 파서의 버퍼 오버플로 취약점을 악용하는 데모입니다. 교육 목적으로만 제공됩니다. 개요 ℹ️ 이 익스플로잇은...

GHSA-4HQ8-GPF5-8P68 Podman: Malformed Image can trick podman run into leaking host environment variables into the container

Summary An container image that contains a environment variable with just a key and no value can trick podman into passing that variable from the host into the container. This is made worse by the fact that using an asterisk will cause podman to pass all host variables into the container. So...

FORT-validator

FORT Validator RPKI Relying Party 및 RTR 서버입니다. 문서 홈 설치 사용법 인수 Docker 이미지 docker/ 디렉터리를 참조하세요...

Copy-Fail-CVE-2026-31431-Kubernetes-PoC

Copy Fail CVE-2026-31431 — Kubernetes 컨테이너 탈출 PoC 완전히 권한이 없는 컨테이너 가 공유 컨테이너 이미지 레이어를 통해 CVE-2026-31431 Linux 커널 페이지-캐시 손상 버그를 악용하여 Kubernetes에서 노드 수준 코드 실행 을 달성할 수 있음을 보여주는 개념 증명입니다. 면책 조항: 이 저장소는 교육 및 방어 목적으로만 게시되었습니다. 소유한 시스템이나 명시적 테스트 권한이 있는 시스템에서만 사용하십시오. 배경 CVE-2026-31431"Copy Fail"은 페이지-캐시...

WordPress Modula Image Gallery – Photo Grid & Video Gallery plugin <= 3.0.1 - Missing Authorization to Unauthenticated Private Gallery Image Disclosure vulnerability

Missing Authorization to Unauthenticated Private Gallery Image Disclosure vulnerability discovered by Supakiad S. m3ez in WordPress Plugin Modula Image Gallery versions = 3.0.1...

CVE-2026-48072 Docmost: Public image fileName path traversal leads to unauthorized local file read

Docmost is open-source collaborative wiki and documentation software. Prior to 0.80.1, the public avatar and logo image endpoint accepts attacker-controlled fileName path segments and resolves them against local storage without confinement to the intended image directory. An unauthenticated...

CVE-2026-48072 Docmost: Public image fileName path traversal leads to unauthorized local file read

Docmost is open-source collaborative wiki and documentation software. Prior to 0.80.1, the public avatar and logo image endpoint accepts attacker-controlled fileName path segments and resolves them against local storage without confinement to the intended image directory. An unauthenticated...

CVE-2026-48072

Docmost , an open-source collaborative wiki and documentation software, is vulnerable to a path traversal flaw in versions prior to 0.80.1 . The public avatar and logo image endpoints fail to confine file path segments to the intended directory, allowing an unauthenticated attacker to traverse ou...