GHSA-QVQC-4C52-X6QP regclient may leak authentication credentials to external blob stores

Credentials for a registry may be inadvertently leaked to external servers. A prerequisite for this attack is a malicious registry server, a malicious blob store, or a registry that does not restrict the external URLs for foreign blobs. Example attack A malicious registry serves an OCI image...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read via the tiff decoder. An attacker can cause a panic and potentially disrupt service by providing a specially crafted image file with an out-of-bounds strip offset. Remediation Upgrade golang.org/x/image/tiff to versio...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read via the tiff decoder. An attacker can cause a panic and potentially disrupt service by providing a specially crafted image file with an out-of-bounds strip offset. Remediation Upgrade github.com/golang/image/tiff to...

DEBIAN-CVE-2026-46604

The TIFF decoder can panic when decoding an invalid image with an out-of-bounds strip offset...

CVE-2026-46604

The TIFF decoder can panic when decoding an invalid image with an out-of-bounds strip offset...

CVE-2026-46604

The TIFF decoder can panic when decoding an invalid image with an out-of-bounds strip offset...

UBUNTU-CVE-2026-46604

The TIFF decoder can panic when decoding an invalid image with an out-of-bounds strip offset...

mangadownloadlib (>=1.0.0, <=1.0.1), ml-trainer-sdk (>=0.1.0, <=0.4.1.10) +1 more potentially affected by CVE-2026-29509 via patool (>=4.0.0, <=4.0.4)

patool PYPI version =4.0.0, =1.0.0, =0.1.0, =0.20250314.0, =0.20260227.0 Source cves: CVE-2026-29509 Source advisory: SNYK:PYTHON-PATOOL-17816662...

JLSEC-2026-635

Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavutil/imgutils.c:353:9 in imagecopyplane...

CVE-2026-46604 Panic decoding image with out-of-bounds strip offset in x/image/tiff in golang.org/x/image

The TIFF decoder can panic when decoding an invalid image with an out-of-bounds strip offset...

CVE-2026-46604

The TIFF decoder can panic when decoding an invalid image with an out-of-bounds strip offset...

CVE-2026-46604 Panic decoding image with out-of-bounds strip offset in x/image/tiff in golang.org/x/image

The TIFF decoder can panic when decoding an invalid image with an out-of-bounds strip offset...

CVE-2026-46604

The TIFF decoder can panic when decoding an invalid image with an out-of-bounds strip offset...

CVE-2026-46604

The TIFF decoder is vulnerable to a panic condition when processing an invalid image containing an out-of-bounds strip offset . This vulnerability affects multiple software components, including rclone , keybase-client , mattermost , listmonk , mattermost-fips , rclone-fips , seaweedfs-fips , git...

EUVD-2026-39909

The TIFF decoder can panic when decoding an invalid image with an out-of-bounds strip offset...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: external-secrets-operator, calico-fips, cloudbeat-fips, frankenphp-8.4, k3s, gitlab-rails-ce-fips, kubescape, drone-fips, gitlab-kas, opentofu-fips, external-secrets-operator-fips, zarf, vault-fips, kubernetes-dashboard, gitlab-workhorse-ce-fips,...

GHSA-78MQ-XCR3-XM33 vulnerabilities

Vulnerabilities for packages: external-secrets-operator, calico-fips, wolfictl, cloudbeat-fips, frankenphp-8.4, k3s, gomplate-fips, gitlab-rails-ce-fips, kubescape, gitlab-kas, opentofu-fips, external-secrets-operator-fips, mapotf, zarf, vault-fips, kubernetes-dashboard, gitlab-workhorse-ce-fips,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: external-secrets-operator, terraform-provider-azurerm-fips, tflint, calico-fips, cosign, wolfictl, cloudbeat-fips, frankenphp-8.4, go-discover, k3s, fulcio, fulcio-fips, cluster-api-azure-controller, drone-fips, flux-kustomize-controller, gitlab-rails-ce-fips,...

GHSA-VGWF-H737-FF37 vulnerabilities

Vulnerabilities for packages: external-secrets-operator, calico-fips, wolfictl, cloudbeat-fips, frankenphp-8.4, k3s, gomplate-fips, gitlab-rails-ce-fips, kubescape, drone-fips, gitlab-kas, opentofu-fips, docker-cli-buildx-fips, external-secrets-operator-fips, mapotf, docker-fips, zarf, vault-fips...

GHSA-89GR-R52H-F8RX vulnerabilities

Vulnerabilities for packages: external-secrets-operator, terraform-provider-azurerm-fips, tflint, calico-fips, cosign, wolfictl, cloudbeat-fips, frankenphp-8.4, go-discover, k3s, fulcio, fulcio-fips, cluster-api-azure-controller, drone-fips, flux-kustomize-controller, gitlab-rails-ce-fips,...