EUVD-2026-43172

ImageMagick before 7.1.2-19 contains a heap buffer overflow vulnerability in the magnify operation that allows attackers to read out of bounds memory. An unrecognized magnify:method value triggers an out of bounds read, potentially exposing sensitive information or causing denial of service...

CVE-2026-56372

ImageMagick before 7.1.2-19 contains a heap buffer overflow vulnerability in the magnify operation that allows attackers to read out of bounds memory. An unrecognized magnify:method value triggers an out of bounds read, potentially exposing sensitive information or causing denial of service...

RHSA-2026:38091 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Bulletin has no description...

CVE-2026-56373

A flaw was found in ImageMagick. This use-after-free vulnerability CWE-416 exists within the PDB Program Database decoder. A remote attacker could exploit this by tricking a user into processing a specially crafted malicious PDB file. This could lead to a denial of service DoS due to application...

CVE-2026-56366

A flaw was found in ImageMagick. This vulnerability, categorized as a memory leak CWE-401, occurs in the META reader when processing APP1JPEG input paths. A remote attacker could exploit this by providing specially crafted APP1JPEG image files. Successful exploitation leads to resource exhaustion...

[SECURITY] Fedora 44 Update: python-pillow-12.3.0-1.fc44

Python image processing library, fork of the Python Imaging Library PIL This library provides extensive file format support, an efficient internal representation, and powerful image processing capabilities. There are four subpackages: tk tk interface, qt PIL image wrapper for Qt, devel developmen...

[SECURITY] Fedora 44 Update: OpenImageIO-3.1.15.0-1.fc44

OpenImageIO is a library for reading and writing images, and a bunch of relat ed classes, utilities, and applications. Main features include: - Extremely simple but powerful ImageInput and ImageOutput APIs for reading a nd writing 2D images that is format agnostic. - Format plugins for TIFF,...

PT-2026-57443

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7.1.2-26 ImageMagick versions prior to 6.9.13-51 Description ImageMagick fails to verify the allowed memory allocation limit during matrix-backed operations, such as the -canny operation. A remote attacker can...

PT-2026-57447

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7.1.2-26 Description A memory leak exists in the VIFF encoder that occurs when memory allocation fails. An attacker can cause a denial of service by processing specially crafted VIFF images to exhaust available...

PT-2026-57395

Name of the Vulnerable Software and Affected Versions Swiss Toolkit For WP versions prior to 1.4.7 Description An arbitrary file upload issue exists due to flawed file type validation in the upload extension files function. The function uses strpos to check if a filename contains a configured...

PT-2026-57446

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7.1.2-26 Description A use-after-free issue exists in the FormatMagickCaption function. This occurs when memory allocation fails, causing a dangling pointer to reference memory that has already been freed. An...

GHSA-9VCR-P3RJ-Q5Q6 vulnerabilities

Vulnerabilities for packages: docker-fips, trivy, policy-controller, ratify-fips, crossplane, policy-controller-fips, cloudbeat-fips, trivy-fips, tflint, falcoctl, kubescape-server, tbot, tkn-fips, kyverno-fips, tekton-chains-fips, zarf-fips, kyverno, kyverno-notation-aws, image-factory-fips,...

CVE-2026-55469

Snipe-IT prior to 8.6.2 is affected. An authenticated user with import and assets.update permissions can inject a path traversal string into an asset image field via CSV import, which can trigger image deletion and lead to deletion of arbitrary files accessible to the server process. The issue is...

CVE-2026-55469 Snipe-IT: Path traversal vulnerability via CSV import `image` field

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated user with import and assets.update permissions can place a path traversal string in an asset image field through CSV import and then trigger image deletion, allowing deletion of arbitrary files accessible to the...

EUVD-2026-43000

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated user with import and assets.update permissions can place a path traversal string in an asset image field through CSV import and then trigger image deletion, allowing deletion of arbitrary files accessible to the...

CVE-2026-55469 Snipe-IT: Path traversal vulnerability via CSV import `image` field

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated user with import and assets.update permissions can place a path traversal string in an asset image field through CSV import and then trigger image deletion, allowing deletion of arbitrary files accessible to the...

Allocation of Resources Without Limits or Throttling

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the forceResize process in fallbackUrl, which passes unbounded dimension parameters t...

CVE-2026-55890

Grav is a file-based Web platform. Prior to 2.0.0-rc.9, Grav's incomplete fix for stored XSS through the Markdown media attribute action CVE-2026-42841 leaves the sibling MediaObjectTrait::style method reachable through the same Markdown excerpt-action pipeline, allowing an editor to save Markdow...

CVE-2026-55781

NanaZip is the 7-Zip derivative intended for the modern Windows experience. Prior to 6.5.1749.0, NanaZip's UFS and FFS image handler in NanaZip.Codecs.Archive.Ufs.cpp validates the superblock block size only against the MINBSIZE lower bound and does not validate the fsfsize fragment size, allowin...

CVE-2026-53653

Grav is a file-based Web platform. Prior to 1.7.53 and 2.0.0-rc.8, Grav allows an unauthenticated visitor to exhaust server memory and CPU by requesting image derivatives with oversized dimensions through URL query image actions such as forceResize in Grav::fallbackUrl, which passes request...