USN-8868-1: LibreOffice vulnerabilities

It was discovered that LibreOffice incorrectly handled WMF image imports. An attacker could possibly use this issue to cause LibreOffice to crash, resulting in a denial of service, or execute arbitrary code. CVE-2026-63272 It was discovered that LibreOffice incorrectly handled PDF document import...

CVE-2021-22204

CVE-2021-22204 Description Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image Script Script Link Script usage: System cmd: bash CVE-2021-2204.sh "system'id'" happy.jpg Reverse shell bash...

CVE-2021-22205

Vuln Impact An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution. Vuln Product Gitlab CE/EE 13.10.3 Gitlab CE/EE 13.9.6 Gitlab CE/EE...

CVE-2026-66917

IDOR + Stored XSS via Broken Object-Level Authorization in JoomGallery JoomGallery ≤ 4.3.0 — Editor-Role User Hijacks Any Gallery Image and Stores XSS Payload, Enabling Admin Session Takeover SUMMARY UserimageController::save in JoomGallery checks checkACL'edit', ... instead of checkACL'edit.own'...

dasel-hardened-container

dasel v3.3.1 hardened container This is a melange package and apko container image for dasel v3.3.1 with a build-time patch for CVE-2026-33320 unbounded YAML alias expansion. The image is built entirely from a locally-produced APK - no prebuilt upstream image is used. Prerequisites Tool| Tested...

Astra Linux – Vulnerability in ffmpeg5

When decoding an OpenEXR file that uses DWAA or DWAB compression, there is an implicit assumption that the height and width are divisible by 8. If the height or width of the image is not divisible by 8, the copy operation will loop at positions 0 and 1, continuing to write until a multiple of 8 i...

Astra Linux – Vulnerability in libjpeg-turbo

Libjpeg-turbo 1.5.2 has a NULL Pointer Dereference issue in files jdpostct.c and jquant1.c, due to a malicious JPEG file...

Astra Linux – Vulnerability in exiv2

Exiv2 0.27.2 allows attackers to cause a crash in the Exiv2::getULong function in types.cpp, when called from Exiv2::Internal::CiffDirectory::readDirectory in crwimageint.cpp. This occurs because there is no validation of the relationship between the total size and the offset and size...

Astra Linux – Vulnerability in exiv2

In Exiv2 versions 0.27.1, an uncontrolled memory allocation for PngChunk::parseChunkContent allows an attacker to cause a denial of service crash due to a std::badalloc exception through a crafted PNG image file...

Astra Linux – Vulnerability in ntfs-3g

A properly crafted NTFS image can lead to a out-of-bounds read in ntfsielookup in NTFS-3G before version 2021.8.22...

Astra Linux – Vulnerability in Firefox

The “Copy Image Link” context menu action would copy the final image URL after redirects. By embedding an image that triggered authentication flows—in conjunction with a Content Security Policy that stopped a redirection chain in the middle—the final image URL could contain an authentication toke...

Astra Linux – Vulnerability in imagemagick

A flaw was discovered in ImageMagick version 7.0.11. In this version, an integer overflow in the WriteTHUMBNAILImage function in the coders/thumbnail.c file may lead to undefined behavior when processing a specially crafted image file submitted by an attacker. The greatest threat posed by this...

Astra Linux – Vulnerability in exiv2

Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An infinite loop was discovered in Exiv2 versions v0.27.4 and earlier. This infinite loop occurs when Exiv2 is used to modify the metadata of a specially crafted image file. ...

Astra Linux – Vulnerability in openexr

A flaw was discovered in OpenEXR’s TiledInputFile functionality. This flaw allows an attacker who can submit a crafted single-part non-image file to have it processed by OpenEXR, resulting in a floating-point exception error. The greatest threat posed by this vulnerability is to system availabili...

CVE-2023-40600

CVE-2023-40600 EWWW Image Optimizer = 7.2.0 - Unauthenticated Sensitive Information Exposure via Debug Log Description The EWWW Image Optimizer plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.2.0 via the debuglog function. This makes it...

CVE-2026-104409

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Chill Image Photo Gallery Final Tiles Grid final-tiles-grid-gallery-lite allows Stored XSS.This issue affects Image Photo Gallery Final Tiles Grid: from n/a through 3.6.13...

CVE-2026-100103

Perforce P4 Search container images prior to version 2026.4.2 are vulnerable to an authentication bypass because the service authentication token is reset to a publicly documented default value . An unauthenticated attacker with network access can exploit this to obtain the highest application pr...

CVE-2026-104409

The WP Chill Image Photo Gallery Final Tiles Grid plugin (specifically the final-tiles-grid-gallery-lite component) is vulnerable to Stored Cross-Site Scripting (XSS) in versions 3.6.13 and below . The root cause is the improper neutralization of input during web page generation . Exploitation de...

CVE-2026-104409 WordPress Image Photo Gallery Final Tiles Grid plugin <= 3.6.13 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Chill Image Photo Gallery Final Tiles Grid final-tiles-grid-gallery-lite allows Stored XSS.This issue affects Image Photo Gallery Final Tiles Grid: from n/a through 3.6.13...

EUVD-2026-92284

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Chill Image Photo Gallery Final Tiles Grid final-tiles-grid-gallery-lite allows Stored XSS.This issue affects Image Photo Gallery Final Tiles Grid: from n/a through 3.6.13...