62761 matches found
KubeV2V Migration assessment: Authorization issue vulnerability
Migration assessment is an open-source tool developed by KubeV2V for evaluating and providing migration recommendations for VMware environments. There is a security vulnerability in Migration assessment. This vulnerability stems from the /api/v1/sources/id/image-url endpoint, where improper acces...
CVE-2026-53470: Authorization Bypass Through User-Controlled Key
A flaw was found in migration-planner. An authenticated attacker could exploit an improper access control vulnerability in the /api/v1/sources/id/image-url endpoint. This flaw allows the attacker to bypass an ownership check and obtain presigned S3 URLs for Open Virtual Appliance OVA images...
CVE-2026-46703: Improper Limitation of a Pathname to a Restricted Directory
Boxlite is a sandbox service that allows users to create lightweight virtual machines Boxes and launch OCI containers within them to run untrusted code. Prior to version 0.9.0, Boxlite allows users to specify the OCI image used by containers in the sandbox. However, when processing tar entries in...
ImageMagick security vulnerabilities
ImageMagick is a set of open-source image processing software developed by the ImageMagick project. It allows for reading, converting, and writing images in various formats. Versions of ImageMagick prior to 6.9.13-50 and 7.1.2-25 contained security vulnerabilities. These vulnerabilities stemmed...
WordPress plugin Easy Image Collage has a cross-site scripting vulnerability
WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. WordPres...
ImageMagick security vulnerabilities
ImageMagick is a set of open-source image processing software developed by the ImageMagick project. It can read, convert, and write images in various formats. Versions of ImageMagick prior to 6.9.13-49 and 7.1.2-24 contained security vulnerabilities. These vulnerabilities stemmed from the...
ImageMagick buffer error vulnerability
ImageMagick is a set of open-source image processing software developed by the ImageMagick project. It can read, convert, and write images in various formats. Versions of ImageMagick prior to 6.9.13-50 and 7.1.2-25 contained a buffer error vulnerability. This vulnerability stemmed from an erroneo...
ImageMagick security vulnerabilities
ImageMagick is a set of open-source image processing software developed by the ImageMagick project. It allows for reading, converting, and writing images in various formats. Versions of ImageMagick prior to 6.9.13-49 and 7.1.2-24 contained security vulnerabilities. These vulnerabilities were due ...
ImageMagick buffer error vulnerability
ImageMagick is a set of open-source image processing software developed by the ImageMagick project. It allows for reading, converting, and writing images in various formats. Versions of ImageMagick prior to 6.9.13-48 and 7.1.2-23 contained a buffer error vulnerability. This vulnerability could be...
ImageMagick input validation vulnerability
ImageMagick is a set of open-source image processing software developed by the ImageMagick project. It can read, convert, and write images in various formats. Versions of ImageMagick prior to 6.9.13-48 and 7.1.2-24 contained a vulnerability related to input validation errors. This vulnerability...
ImageMagick security vulnerabilities
ImageMagick is a set of open-source image processing software developed by the ImageMagick project. It can read, convert, and write images in various formats. Versions of ImageMagick prior to 6.9.13-48 and 7.1.2-24 contained security vulnerabilities due to lack of return value checking. On 32-bit...
CVE-2025-71319
image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted image buffer with a zero-valued size field in a recognized box-type. Attackers can trigger an infinite loop in the JXL or...
CVE-2026-25860 OpenClinic GA 5.351.19 Reflected XSS via DICOM Image Upload Handler
OpenClinic GA 5.351.19 contains a reflected cross-site scripting vulnerability in the DICOM image upload handler that allows attackers to execute arbitrary JavaScript in a victim's browser by embedding malicious payloads in DICOM file metadata fields. Attackers can craft a DICOM file with...
CVE-2026-25860
OpenClinic GA 5.351.19 is affected by a reflected XSS in the DICOM image upload handler. An attacker can embed JavaScript in DICOM metadata (e.g., Study Description) which is reflected in popup.jsp and archiving/uploadfiles_jsp.java during the Upload DICOM images workflow, enabling arbitrary scri...
@adobe/helix-importer (>=3.4.65, <=3.4.79), @adobe/helix-md2docx (>=2.2.0, <=2.2.7) +57 more potentially affected by CVE-2025-71319 via image-size (>=2.0.0, <=2.0.1)
image-size NPM version =2.0.0, =3.4.65, =2.2.0, =2.6.5, =1.3.47, =1.4.2, =5.0.0-alpha.40, =7.12.0-main1711fab, =0.28.1-feature.esm.cjs.8, =0.28.1-feature.esm.cjs.8, =0.28.1-feature.esm.cjs.13, =0.28.1-feature.jose.vcdm.19, =0.28.1-feature.esm.cjs.18, =0.28.1-feature.esm.cjs.8,...
@adobe/helix-importer (>=3.1.2, <=3.4.79), @adobe/helix-md2docx (>=2.1.38, <=2.1.107) +146 more potentially affected by CVE-2025-71319 via image-size (>=1.1.0, <=1.2.0)
image-size NPM version =1.1.0, =3.1.2, =2.1.38, =1.0.0, =2.4.3, =1.1.1, =1.0.0, =1.0.0-B001, =0.0.28, =2.17.13, =0.17.6, =1.16.10, =7.1.0, =0.0.1, =1.1.69, =5.0.0-alpha.27, =5.0.0-alpha.39 and more Source cves: CVE-2025-71319 Source advisory: MEND:CVE-2025-71319...
CVE-2025-71319 image-size 2.0.2 Denial of Service via Infinite Loop in JXL/HEIF Parser
image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted image buffer with a zero-valued size field in a recognized box-type. Attackers can trigger an infinite loop in the JXL or...
EUVD-2025-210087
image-size 1.1.0 before 1.2.1 and 2.0.0 before 2.0.2 contain a denial of service vulnerability in the findBox function when processing specially crafted images with zero-sized boxes. Remote attackers can cause application hang by supplying malicious JXL, HEIF, or JP2 image files with box size zer...
CVE-2025-71319 image-size 2.0.2 Denial of Service via Infinite Loop in JXL/HEIF Parser
image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted image buffer with a zero-valued size field in a recognized box-type. Attackers can trigger an infinite loop in the JXL or...
CVE-2025-71319
image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted image buffer with a zero-valued size field in a recognized box-type. Attackers can trigger an infinite loop in the JXL or...