PT-2026-56113

Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavutil/imgutils.c:353:9 in image copy plane...

PT-2026-58104

Name of the Vulnerable Software and Affected Versions Pillow versions prior to 12.3.0 Description An out-of-bounds read issue exists in the PyImaging MapBuffer function within src/map.c when loading uncompressed McIdas AREA images from a filename using the mmap raw codec path. The software fails ...

CVE-2026-30041

An integer overflow in the PSD parser compnent of FastStone Image Viewer v8.3 allows attackers to execute arbitrary code or cause a Denial of Service DoS via supplying a crafted PSD file...

PT-2026-52971

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The TIFF decoder can panic when processing an invalid image that contains an out-of-bounds strip offset. A panic is a critical error that causes a program to cra...

CVE-2026-30040

A heap-based buffer overflow exists in the FSViewer.exe process of FastStone Image Viewer versions 8.3 and earlier . The vulnerability is triggered during the parsing of JPEG 2000 (JP2) files due to a malformed QCD (quantization default, 0xFF5C) marker . An attacker can exploit this by providing ...

PT-2026-52817

Contributor Local File Inclusion in Panorama Viewer – 360 Degree Image + Video Viewer = 1.6.1 versions...

CVE-2026-30040

A heap overflow in the FSViewer.exe process of FastStone Image Viewer v8.3 allows attackers to cause a execute arbitrary code in the context of the current process via supplying a crafted JPEG 2000 JP2 file...

PT-2026-52721

Mattermost versions 10.11.x = 10.11.18, 11.6.x = 11.6.3, 11.5.x = 11.5.6 fail to properly apply markdown image rendering restrictions to AI bot tool result posts, which allows an authenticated attacker to exfiltrate data to an attacker-controlled server via injecting markdown image syntax into to...

PT-2026-53016

Name of the Vulnerable Software and Affected Versions Incus versions prior to 7.2.0 Description An arbitrary file write exists in the Incus client. This occurs when a malicious image server returns a specially crafted Incus-Image-Hash header. The client uses this header to determine the destinati...

CVE-2026-30040

A heap overflow in the FSViewer.exe process of FastStone Image Viewer v8.3 allows attackers to cause a execute arbitrary code in the context of the current process via supplying a crafted JPEG 2000 JP2 file...

CVE-2026-30041

FastStone Image Viewer versions 8.3 and earlier are vulnerable to an integer overflow within the PSD parser component. The root cause is a lack of proper validation for the height value in PSD files, which leads to a subsequent heap-based buffer overflow. Attackers can exploit this by supplying a...

CVE-2026-30041: Uncontrolled Resource Consumption

An integer overflow in the PSD parser compnent of FastStone Image Viewer v8.3 allows attackers to execute arbitrary code or cause a Denial of Service DoS via supplying a crafted PSD file...

CVE-2026-3472: Protection Mechanism Failure

Mattermost versions 10.11.x = 10.11.18, 11.6.x = 11.6.3, 11.5.x = 11.5.6 fail to properly apply markdown image rendering restrictions to AI bot tool result posts, which allows an authenticated attacker to exfiltrate data to an attacker-controlled server via injecting markdown image syntax into to...

CVE-2026-30041

An integer overflow in the PSD parser compnent of FastStone Image Viewer v8.3 allows attackers to execute arbitrary code or cause a Denial of Service DoS via supplying a crafted PSD file...

PT-2026-53027

Name of the Vulnerable Software and Affected Versions Statamic versions prior to 5.73.24 Statamic versions prior to 6.20.1 Description The Glide image proxy contains a flaw where URL validation in src/Imaging/RemoteUrlValidator.php and src/Imaging/GuzzleAdapter.php can be bypassed via DNS...

PT-2026-53024

Name of the Vulnerable Software and Affected Versions regclient affected versions not specified Description Authentication credentials for a registry may be leaked to external servers. This occurs when a malicious registry server, a malicious blob store, or a registry that fails to restrict...

CVE-2025-68074: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Image Carousel = 1.0.0.41 versions...

ROS-20260626-73-0003

The vulnerability in golang-x-image is related to incorrect calculations. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2026-52793

Author Cross Site Scripting XSS in Featured Image = 2.1 versions...

PT-2026-52718

Name of the Vulnerable Software and Affected Versions Image Carousel versions prior to 1.0.0.42 Description Cross Site Scripting XSS exists in the Contributor role, allowing an attacker to execute malicious scripts in the browser of other users. Recommendations Update Image Carousel to a version...