CVE-2026-80899 erofs: remove fscache backend entirely

In the Linux kernel, the following vulnerability has been resolved: erofs: remove fscache backend entirely EROFS over fscache was introduced to provide image lazy pulling functionality. After the feature landed, the fscache subsystem made netfs a new hard dependency, which is unexpected for a loc...

CVE-2026-80892

CVE-2026-80892 affects the Linux kernel's EROFS filesystem driver (fs/erofs/decompressor_lzma.c). When the lzma_streams module parameter is unset, the global MicroLZMA stream pool is sized from num_possible_cpus() , and each stream preallocates an image-supplied dictionary of up to 8 MiB . On hig...

CVE-2026-85605

Slink before 1.12.3 fails to properly authorize access to image comment endpoints, allowing unauthenticated attackers to read comment threads via GET /api/image/imageId/comments and server-sent-events subscriptions. Attackers who obtain image IDs out of band can retrieve full comment threads on...

CVE-2026-85605 Slink before 1.12.3 Missing Authorization on Image Comment Endpoints

Slink before 1.12.3 fails to properly authorize access to image comment endpoints, allowing unauthenticated attackers to read comment threads via GET /api/image/imageId/comments and server-sent-events subscriptions. Attackers who obtain image IDs out of band can retrieve full comment threads on...

CVE-2026-85605 Slink before 1.12.3 Missing Authorization on Image Comment Endpoints

Slink before 1.12.3 fails to properly authorize access to image comment endpoints, allowing unauthenticated attackers to read comment threads via GET /api/image/imageId/comments and server-sent-events subscriptions. Attackers who obtain image IDs out of band can retrieve full comment threads on...

EUVD-2026-71221

Slink before 1.12.3 fails to properly authorize access to image comment endpoints, allowing unauthenticated attackers to read comment threads via GET /api/image/imageId/comments and server-sent-events subscriptions. Attackers who obtain image IDs out of band can retrieve full comment threads on...

CVE-2026-85605 Slink before 1.12.3 Missing Authorization on Image Comment Endpoints

Slink before 1.12.3 fails to properly authorize access to image comment endpoints, allowing unauthenticated attackers to read comment threads via GET /api/image/imageId/comments and server-sent-events subscriptions. Attackers who obtain image IDs out of band can retrieve full comment threads on...

CVE-2026-85605

Slink versions prior to 1.12.3 fail to properly authorize access to image comment endpoints, allowing unauthenticated attackers to read full comment threads via GET /api/image/{imageId}/comments and subscribe to live updates via server-sent-events — provided they obtain an image ID out of band. T...

Exploit for CVE-2024-36057

CVE-2024-36057 — Koha Library Software CVE ID: CVE-2024-3...

CVE-2026-84066

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9 does not verify that the requesting user owns the post being modified before writing uploaded file references to its metadata, allowing users with the subscriber role and above to overwrite image...

CVE-2026-16281

The Classified Listing WordPress plugin before 6.1.1 does not verify that the caller owns or can edit the target listing before its AI image-editing AJAX action deletes or attaches media, allowing any authenticated user, including a subscriber, to permanently delete attachments from, and attach...

EUVD-2026-70912

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9 does not verify that the requesting user owns the post being modified before writing uploaded file references to its metadata, allowing users with the subscriber role and above to overwrite image...

CVE-2026-16281 Classified Listing < 6.1.1 - Subscriber+ Arbitrary Attachment Deletion and Listing Image Tampering via IDOR

The Classified Listing WordPress plugin before 6.1.1 does not verify that the caller owns or can edit the target listing before its AI image-editing AJAX action deletes or attaches media, allowing any authenticated user, including a subscriber, to permanently delete attachments from, and attach...

CVE-2026-16281 Classified Listing < 6.1.1 - Subscriber+ Arbitrary Attachment Deletion and Listing Image Tampering via IDOR

The Classified Listing WordPress plugin before 6.1.1 does not verify that the caller owns or can edit the target listing before its AI image-editing AJAX action deletes or attaches media, allowing any authenticated user, including a subscriber, to permanently delete attachments from, and attach...

remove-ai-watermarks v0.37.1

Remove AI Watermarks Remove AI provenance marks from images and video you generated yourself: known visible labels such as the Google Gemini sparkle watermark and vendor text marks; invisible pixel watermarks through direct local-format disruption or diffusion regeneration; C2PA, EXIF, XMP, IPTC,...

CVE-2026-85605: Missing Authorization

Slink before 1.12.3 fails to properly authorize access to image comment endpoints, allowing unauthenticated attackers to read comment threads via GET /api/image/imageId/comments and server-sent-events subscriptions. Attackers who obtain image IDs out of band can retrieve full comment threads on...

CVE-2026-84066: Missing Authorization

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9 does not verify that the requesting user owns the post being modified before writing uploaded file references to its metadata, allowing users with the subscriber role and above to overwrite image...

Next.js 16.4.0-canary.13 Server-Side Request Forgery

Next.js version 16.4.0-canary.13 contains a DNS rebinding TOCTOU server-side request forgery vulnerability in the Image Optimizer's fetchExternalImage functionality. https://packetstorm.news/download/230572...

PT-2026-85538

Slink before 1.12.3 fails to properly authorize access to image comment endpoints, allowing unauthenticated attackers to read comment threads via GET /api/image/imageId/comments and server-sent-events subscriptions. Attackers who obtain image IDs out of band can retrieve full comment threads on...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: cups-filters (UTSA-2026-106457)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106457 advisory. A flaw was found in libcupsfilters and cups-filters. The PNG image reading function creates a libpng reader without installing an error recovery handler, causing the...