CVE-2026-50563

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, Fission's Container Executor path lets a tenant supply Function.spec.podspec directly; the executor merges it into the...

CVE-2026-46642

draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.12, a crafted .drawio file can execute arbitrary JavaScript in the editor's origin when the file is opened. The vulnerability is not in the label sanitizer which works correctly on the rendering path but in...

CVE-2026-46642 draw.io: XSS via crafted cell label when opening a .drawio file

draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.12, a crafted .drawio file can execute arbitrary JavaScript in the editor's origin when the file is opened. The vulnerability is not in the label sanitizer which works correctly on the rendering path but in...

EUVD-2026-36077

draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.12, a crafted .drawio file can execute arbitrary JavaScript in the editor's origin when the file is opened. The vulnerability is not in the label sanitizer which works correctly on the rendering path but in...

CVE-2026-50565 Fission builder pods auto-mount the fission-builder ServiceAccount token in the user-supplied builder container

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, Fission builder pods were created with ServiceAccountName: fission-builder and no AutomountServiceAccountToken: false, so the...

GHSA-3WW4-5JV9-J5GM vLLM's Artifact Pin Decay allows pinned deployments to load unpinned code, weights, and processors

Summary vLLM's revision pinning controls do not consistently apply to all artifacts loaded for a model. A deployment that supplies --revision or --code-revision can still load dynamic code, GGUF files, image processors, retrieval side weights, or same-repository subfolder weights/config from an...

vLLM's Artifact Pin Decay allows pinned deployments to load unpinned code, weights, and processors

Summary vLLM's revision pinning controls do not consistently apply to all artifacts loaded for a model. A deployment that supplies --revision or --code-revision can still load dynamic code, GGUF files, image processors, retrieval side weights, or same-repository subfolder weights/config from an...

Openshift Migration Advisor: Broken access control in migration-planner image-url endpoint exposes other users' OVA images and agent JWTs

A flaw was found in migration-planner. An authenticated attacker could exploit an improper access control vulnerability in the /api/v1/sources/id/image-url endpoint. This flaw allows the attacker to bypass an ownership check and obtain presigned S3 URLs for Open Virtual Appliance OVA images...

GHSA-V5M8-5455-QW2X Openshift Migration Advisor: Broken access control in migration-planner image-url endpoint exposes other users' OVA images and agent JWTs

A flaw was found in migration-planner. An authenticated attacker could exploit an improper access control vulnerability in the /api/v1/sources/id/image-url endpoint. This flaw allows the attacker to bypass an ownership check and obtain presigned S3 URLs for Open Virtual Appliance OVA images...

image-size: JXL and HEIF parsers allow denial of service through infinite loops

image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted image buffer with a zero-valued size field in a recognized box-type. Attackers can trigger an infinite loop in the JXL or...

0xuath-sdk-react (>=0.0.2, <=0.0.23), 11ty-tools (>=1.0.0-alpha.1, <=2.0.0) +14007 more potentially affected by CVE-2025-71330 via image-size (>=0.6.3, <=2.0.2)

image-size NPM version =0.6.3, =0.0.2, =1.0.0-alpha.1, =1.0.5, =1.0.0, =1.0.0, =1.0.0, =1.0.21, =1.0.2, =0.0.1, =1.0.3, =0.0.2, =0.0.1, =4.11.0, =0.1.1, =0.0.1-251008.90016, =0.3.0 and more Source cves: CVE-2025-71330 Source advisory: OSV:GHSA-W3RX-R6R6-PGPR...

0xuath-sdk-react (>=0.0.2, <=0.0.23), 11ty-tools (>=1.0.0-alpha.1, <=2.0.0) +4825 more potentially affected by CVE-2025-71329 via image-size (>=1.2.0, <=2.0.2)

image-size NPM version =1.2.0, =0.0.2, =1.0.0-alpha.1, =1.0.8, =1.0.3, =0.1.1, =0.0.1-251008.90016, =1.0.1, =0.10.0, =1.0.0-beta.1, =2.11.1, =2.11.3 and more Source cves: CVE-2025-71329 Source advisory: OSV:GHSA-5P2G-FCMC-QVQQ...

0xuath-sdk-react (>=0.0.2, <=0.0.23), 11ty-tools (>=1.0.0-alpha.1, <=2.0.0) +14007 more potentially affected by CVE-2025-71330 via image-size (>=0.6.3, <=2.0.2)

image-size NPM version =0.6.3, =0.0.2, =1.0.0-alpha.1, =1.0.5, =1.0.0, =1.0.0, =1.0.0, =1.0.21, =1.0.2, =0.0.1, =1.0.3, =0.0.2, =0.0.1, =4.11.0, =0.1.1, =0.0.1-251008.90016, =0.3.0 and more Source cves: CVE-2025-71330 Source advisory: GHSA-W3RX-R6R6-PGPR...

0xuath-sdk-react (>=0.0.2, <=0.0.23), 11ty-tools (>=1.0.0-alpha.1, <=2.0.0) +4825 more potentially affected by CVE-2025-71329 via image-size (>=1.2.0, <=2.0.2)

image-size NPM version =1.2.0, =0.0.2, =1.0.0-alpha.1, =1.0.8, =1.0.3, =0.1.1, =0.0.1-251008.90016, =1.0.1, =0.10.0, =1.0.0-beta.1, =2.11.1, =2.11.3 and more Source cves: CVE-2025-71329 Source advisory: GHSA-5P2G-FCMC-QVQQ...

GHSA-5P2G-FCMC-QVQQ image-size: JXL and HEIF parsers allow denial of service through infinite loops

image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted image buffer with a zero-valued size field in a recognized box-type. Attackers can trigger an infinite loop in the JXL or...

GHSA-W3RX-R6R6-PGPR image-size: ICNS parser allows denial of service through an infinite loop

image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted ICNS image buffer. Attackers can craft an ICNS buffer containing valid magic bytes and a zero-valued entry length field to...

CVE-2026-34031

Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. The server did not sufficiently validate user-supplied image URLs, allowing arbitrary external content to be embedded as profile images, which could expose users to...

02vue_toast_demo (>=1.0.1, <=1.0.4), 06-tekbooks (0.1.0) +30808 more potentially affected by CVE-2025-71319 +1 more via image-size (>=0.0.16, <=2.0.4)

image-size NPM version =0.0.16, =1.0.1, =0.0.2, =0.0.3, =1.0.0-alpha.1, =1.0.5, =5.0.0, =2.3.0, =2.0.0, =1.0.0, =1.0.0, =1.3.3 and more Source cves: CVE-2025-71319, CVE-2025-71329 Source advisory: SNYK:JS-IMAGESIZE-17295814...

Infinite loop

Overview Affected versions of this package are vulnerable to Infinite loop in the extractPartialStreams and corresponding extraction functions for HEIF, JP2, and JXL. An attacker supplying an image whose requested box declares a size of zero can hang the parser indefinitely. Note: This is a bypas...

org.webjars.npm:datauri (>=1.1.0, <=2.0.0), org.webjars.npm:image-thumbnail (1.0.15) +1 more potentially affected by CVE-2025-71319 +1 more via org.webjars.npm:image-size (>=0.5.5, <=2.0.0-alpha.1)

org.webjars.npm:image-size MAVEN version =0.5.5, =1.1.0, =2.7.1, =2.7.2 Source cves: CVE-2025-71319, CVE-2025-71329 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-17295815...