CVE-2026-70654

libvips (image processing library) versions prior to 8.18.3 contain a heap buffer overflow in vips_source_read_to_memory (libvips/iofuncs/source.c). The function incorrectly uses VIPS_MAX instead of VIPS_MIN when selecting the remaining read size. Applications that define custom libvips sources a...

CVE-2026-70654 libvips: A well-crafted PPM image processed via a custom source could lead to possible heap buffer write overflow

libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, applications that define unusual custom libvips sources and use them to process untrusted uncompressed PPM images can trigger a max/min error in vipssourcereadtomemory in libvips/iofuncs/source.c. The...

CVE-2026-70654 libvips: A well-crafted PPM image processed via a custom source could lead to possible heap buffer write overflow

libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, applications that define unusual custom libvips sources and use them to process untrusted uncompressed PPM images can trigger a max/min error in vipssourcereadtomemory in libvips/iofuncs/source.c. The...

CVE-2026-70654 libvips: A well-crafted PPM image processed via a custom source could lead to possible heap buffer write overflow

libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, applications that define unusual custom libvips sources and use them to process untrusted uncompressed PPM images can trigger a max/min error in vipssourcereadtomemory in libvips/iofuncs/source.c. The...

CVE-2026-70653

libvips versions prior to 8.18.3 contain a heap-based out-of-bounds read in the old-style Radiance RLE decoder (libvips/foreign/radiance.c). When processing a repeat marker at the beginning of a scanline in scanline_read_old, the code reads q[-1] before any prior pixel exists, allowing a crafted ...

CVE-2026-70653 libvips: Possible heap-based buffer read overflow when decoding a well-crafted RLE Radiance image

libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, the old-style Radiance RLE decoder in libvips/foreign/radiance.c can process a repeat marker at the beginning of a scanline in scanlinereadold and read q-1 before any prior pixel exists. A crafted Radiance...

Server-side Request Forgery (SSRF)

Overview @platejs/docx-io is a DOCX import/export for Plate - file-based document conversion Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the buildImage and buildParagraph functions in render-document-file.ts and xml-builder.ts, which unconditionally...

EUVD-2026-63652

libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, libvips built with libultrahdr support can incorrectly size an output buffer in libvips/foreign/uhdrsave.c within vipsforeignsaveuhdrsetrawhdr when a pipeline enlarges an incoming JPEG to a very large outpu...

CVE-2026-70652

libvips versions before 8.18.3 mis-size an output buffer in vips_foreign_save_uhdr_set_raw_hdr (libvips/foreign/uhdrsave.c) when a pipeline enlarges a JPEG before encoding a gain map, causing a heap buffer over-read that can leak adjacent data or crash the process. Upgrade to 8.18.3 to remediate....

CVE-2026-69242 libvips: Integer overflow leading to heap buffer overflow leading to possible attacker-controlled mmap-resident write

libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, a crafted many-band TIFF processed through VipsForeignLoadTiff can evade scanline validation in libvips/iofuncs/image.c and cause an integer overflow in vipsimagesanity. The resulting buffer-region...

CVE-2026-69242

libvips versions prior to 8.18.3 are affected by an integer overflow in vips_image_sanity within libvips/iofuncs/image.c. A crafted many-band TIFF processed through VipsForeignLoadTiff evades scanline validation, causing the overflow. The resulting buffer-region calculation can access attacker-co...

GHSA-7MPF-4465-7FC2 Winter: Stored XSS through Backend List widget image columns

Impact Backend\Widgets\Lists::evalImageTypeValue interpolated the resolved image URL into a single-quoted src attribute without escaping it. Where a list column of type image rendered an attacker-influenced value, that value could break out of the attribute and inject arbitrary attributes —...

Winter: Stored XSS through Backend List widget image columns

Impact Backend\Widgets\Lists::evalImageTypeValue interpolated the resolved image URL into a single-quoted src attribute without escaping it. Where a list column of type image rendered an attacker-influenced value, that value could break out of the attribute and inject arbitrary attributes —...

EUVD-2026-41150

Wagtail: Reflected XSS in dynamic image URL generator view...

Wagtail: Reflected XSS in dynamic image URL generator view

Impact A reflected cross-site scripting XSS vulnerability exists on the dynamic image URL generator view within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin could craft a URL that, when viewed by a user with higher privileges, could perform...

GHSA-R6P4-GRQ7-XM4M Wagtail: Improper permission handling in image preview

Impact Due to a missing permission check on the image preview endpoint, a user with access to the Wagtail admin can preview any image. The existing data of the image object itself is not exposed. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin...

EUVD-2026-41148

Wagtail: Improper permission handling in image preview...

Wagtail: Improper permission handling in image preview

Impact Due to a missing permission check on the image preview endpoint, a user with access to the Wagtail admin can preview any image. The existing data of the image object itself is not exposed. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin...

GHSA-F2P5-J6FG-5CXF Wagtail: Denial of service via unbounded filter specs in the image preview

Impact An authenticated admin user can trigger expensive rendition processing with purposefully crafted filter specs resulting in potentially service degradation. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. Patches Patched versions have be...

Wagtail: Denial of service via unbounded filter specs in the image preview

Impact An authenticated admin user can trigger expensive rendition processing with purposefully crafted filter specs resulting in potentially service degradation. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. Patches Patched versions have be...