CVE-2026-28666: Incorrect Authorization

In multiple functions of LocalImageResolver.java, there is a possible Remote Persistent Denial of Service due to a DNG image rendering check bypass. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

EUVD-2026-74260

Silverpeas Core =6.4.6 is vulnerable to Cross Site Scripting XSS in the wysiwyg-CKEditor image upload feature...

PT-2026-88461

Silverpeas Core =6.4.6 is vulnerable to Cross Site Scripting XSS in the wysiwyg-CKEditor image upload feature...

OPENSUSE-SU-2026:11719-1 gdk-pixbuf-loader-libheif-1.23.4-1.1 on GA media

These are all security issues fixed in the gdk-pixbuf-loader-libheif-1.23.4-1.1 package on the GA media of openSUSE Tumbleweed...

ROS-20260908-73-0032

The vulnerability in golang-x-image is related to insufficient control over resources with dynamic management. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

PT-2026-87508

Out-of-bounds read in Windows Image Acquisition allows an authorized attacker to disclose information locally...

PT-2026-87522

Name of the Vulnerable Software and Affected Versions Windows Image Acquisition affected versions not specified Description A use-after-free condition occurs in Windows Image Acquisition, which allows an authorized attacker to elevate privileges locally. Use-after-free is a memory corruption issu...

PT-2026-87615

Use after free in Windows Image Acquisition allows an authorized attacker to elevate privileges locally...

CVE-2026-78741

Silverpeas Core =6.4.6 is vulnerable to Cross Site Scripting XSS in the wysiwyg-CKEditor image upload feature...

PT-2026-88231

In WriteImageToDisk of runtime image.cc, there is a possible file tampering due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-18090: Out-of-bounds Read

A flaw was found in gdk-pixbuf. This vulnerability allows a remote attacker to cause a heap out-of-bounds read by providing a specially crafted Apple Icon Image .icns file. The uncompress function, which handles RLE-encoded ICNS icon data, fails to validate the source buffer's boundaries during...

PT-2026-95731

A vulnerability in the underlying libheif library used by sharp which Next.js uses for image optimization can lead to remote code execution when AVIF files are optimized. Until a fix has propagated, optimization of AVIF files is disabled...

PT-2026-88232

Name of the Vulnerable Software and Affected Versions Android affected versions not specified Description A mimetype check bypass exists in the LocalImageResolver.java component within the SystemUI process. While a mimetype allowlist was implemented to prevent the use of bug-prone RAW decoders in...

CVE-2026-69483: Out-of-bounds Read

Out-of-bounds read in Windows Image Acquisition allows an authorized attacker to disclose information locally...

CVE-2026-69613: Use After Free

Use after free in Windows Image Acquisition allows an authorized attacker to elevate privileges locally...

PT-2026-87799

Integer overflow or wraparound in Microsoft WebP Image Extension allows an unauthorized attacker to execute code over a network...

CVE-2026-70351: Integer Overflow or Wraparound

Integer overflow or wraparound in Microsoft WebP Image Extension allows an unauthorized attacker to execute code over a network...

ROS-20260908-73-0030

The vulnerability in golang-x-image is related to writing beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

PT-2026-87382

Use after free in Windows Image Acquisition allows an authorized attacker to elevate privileges locally...

PT-2026-95729

A vulnerability in libheif, used by the default Sharp image service in Astro, can lead to remote code execution when a malicious AVIF image is optimized. Projects are affected when an attacker can cause Astro to process an untrusted AVIF image. The fix was released in Astro 7.2.8, which requires...