CVE-2026-46604

The TIFF decoder can panic when decoding an invalid image with an out-of-bounds strip offset...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: mattermost, k9s-fips, kubescape-server-fips, cloudbeat, elastic-agent-fips, drone, cert-manager, chisel, commercial-grafana, kubernetes-fips, zarf-fips, tekton-pipelines-fips, tigera-operator, zarf, tekton-pipelines, gatekeeper, vault, gatekeeper-fips, kots, k9s,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: mattermost, k9s-fips, kubescape-server-fips, step-issuer, k8sgpt, cloudbeat, elastic-agent-fips, tkn, drone, cert-manager, gh, slsa-verifier, kyverno-policy-reporter-plugins-kyverno-fips, chisel, commercial-grafana, crossplane-provider-azure-servicebus,...

GHSA-89GR-R52H-F8RX vulnerabilities

Vulnerabilities for packages: mattermost, k9s-fips, kubescape-server-fips, step-issuer, k8sgpt, cloudbeat, elastic-agent-fips, tkn, drone, cert-manager, gh, slsa-verifier, kyverno-policy-reporter-plugins-kyverno-fips, chisel, commercial-grafana, crossplane-provider-azure-servicebus,...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: mattermost, k9s-fips, kubescape-server-fips, cloudbeat, elastic-agent-fips, drone, cert-manager, chisel, commercial-grafana, kubernetes-fips, zarf-fips, tekton-pipelines-fips, tigera-operator, zarf, tekton-pipelines, gatekeeper, vault, gatekeeper-fips, kots, k9s,...

GHSA-VGWF-H737-FF37 vulnerabilities

Vulnerabilities for packages: mattermost, k9s-fips, kubescape-server-fips, cloudbeat, elastic-agent-fips, drone, cert-manager, gh, chisel, commercial-grafana, prometheus-podman-exporter, kubernetes-fips, gomplate-fips, witness, peerdb-flow, pulumi, chainctl-fips, zarf-fips, tekton-pipelines-fips,...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: kubescape-server-fips, terraform-provider-acme-fips, docker-compose-fips, crossplane-provider-aws-s3, k8sgpt, chainloop-control-plane, crossplane-provider-aws-ecs, tkn, gh, slsa-verifier, crossplane-provider-aws-cognitoidentity-fips,...

GHSA-78MQ-XCR3-XM33 vulnerabilities

Vulnerabilities for packages: mattermost, k9s-fips, kubescape-server-fips, cloudbeat, elastic-agent-fips, cert-manager, commercial-grafana, prometheus-podman-exporter, kubernetes-fips, gomplate-fips, witness, pulumi, chainctl-fips, zarf-fips, tekton-pipelines-fips, terragrunt, tigera-operator, ac...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: flux-kustomize-controller, cilium-cli, gh, spire-server, go-discover, flux-source-controller, snyk-cli, neuvector-sigstore-interface, kubernetes-dashboard, buildah, mods, aactl, argo-events, splunk-otel-collector, teleport, mattermost, docker-cli-buildx, buildkitd,...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: external-dns, fscrypt, knative-serving, trivy, minio, cilium-cli, nerdctl, chisel, flux-image-automation-controller, zarf, spire-server, k3s, prometheus-operator, cilium, flux-source-controller, snyk-cli, flux, helm, kubernetes-dashboard, aactl,...

CVE-2026-46601

A flaw was found in the golang.org/x/image/webp library's WebP decoder. A remote attacker could exploit this vulnerability by providing a specially crafted WebP image containing a VP8 chunk with mismatched dimensions. This could cause the decoder to panic, leading to a denial of service DoS for...

CVE-2026-44696

OpenProject is open-source, web-based project management software. Prior to 17.4.0, OpenProject's rich text markdown rendering pipeline uses Sanitize::Config::RELAXED:css for inline style sanitization. This configuration permits essentially all CSS properties in style attributes on permitted HTML...

libtiff: libtiff: Arbitrary code execution or denial of service via signed integer overflow in TIFF file processing

A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile function by providing a specially crafted TIFF file. This flaw can lead to an out-of-bounds heap write due to incorrect memory pointer calculations,...

Interpretation Conflict

Overview Affected versions of this package are vulnerable to Interpretation Conflict via the downloadImage process. An attacker can execute arbitrary scripts in the context of the application by tricking a user into visiting a crafted link that proxies malicious content through the image proxy...

GHSA-4C8J-MGM4-QQVP Remark42: Cross-Site Scripting (XSS) on /api/v1/img via content-type spoofing

Summary The remark42 image proxy fetches an arbitrary remote URL and re-serves the response from remark42's own origin. The download path decides whether the fetched resource is an image by looking only at the Content-Type header the remote server claims — it never inspects the actual bytes. The...

EUVD-2026-37511

Remark42: Cross-Site Scripting XSS on /api/v1/img via content-type spoofing...

Remark42: Cross-Site Scripting (XSS) on /api/v1/img via content-type spoofing

Summary The remark42 image proxy fetches an arbitrary remote URL and re-serves the response from remark42's own origin. The download path decides whether the fetched resource is an image by looking only at the Content-Type header the remote server claims — it never inspects the actual bytes. The...

CVE-2026-46386 OpenProject: Pre-authentication RCE in openproject/openproject Docker image via default `SECRET_KEY_BASE=OVERWRITE_ME` and `cookies_serializer = :marshal`

OpenProject is open-source, web-based project management software. Prior to , the official openproject/openproject Docker image ships ENV SECRETKEYBASE=OVERWRITEME as the default Rails master key. Combined with cookiesserializer = :marshal, this gives any logged-in user a deterministic...

CVE-2026-46386 OpenProject: Pre-authentication RCE in openproject/openproject Docker image via default `SECRET_KEY_BASE=OVERWRITE_ME` and `cookies_serializer = :marshal`

OpenProject is open-source, web-based project management software. Prior to , the official openproject/openproject Docker image ships ENV SECRETKEYBASE=OVERWRITEME as the default Rails master key. Combined with cookiesserializer = :marshal, this gives any logged-in user a deterministic...

CVE-2026-46386

OpenProject’s official docker image ships SECRET_KEY_BASE=OVERWRITE_ME and cookies_serializer = :marshal, creating a deterministic Marshal-deserialization path reachable via the /my/two_factor_devices cookie reader. This enables potential pre-authentication remote code execution, as noted in the ...