61966 matches found
CVE-2026-18806
The CVE-2026-18806 entry concerns pardus-image-writer (before 1.0.4) with an external control of the file name or path vulnerability. The issue is described across CVE/NVD/CVELIST as affecting pardus-image-writer and enabling potential unauthorized modification of file targets, with CVSS 3.1 vect...
CVE-2026-18806
External control of file name or path vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-image-writer allows Removing Important Client Functionality. This issue affects pardus-image-writer: before 1.0.4...
CVE-2026-18806 Arbitrary Block Device Write via Missing Validation in TÜBİTAK BİLGEM's pardus-image-writer
External control of file name or path vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-image-writer allows Removing Important Client Functionality. This issue affects pardus-image-writer: before 0.9.0...
image-builder (>=0.1.1rc0, <=0.2.0), shortesttrack-sdk (>=1.2.0rc1, <=1.4.1) +1 more potentially affected by CVE-2026-69248 via cryptography (2.2.1)
cryptography PYPI version 2.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - image-builder =0.1.1rc0, =1.2.0rc1, =0.0.3a0, =0.1.10 Source cves: CVE-2026-69248 Source advisory: OSV:PYSEC-2026-3554...
image-builder (>=0.1.1rc0, <=0.2.0), shortesttrack-sdk (>=1.2.0rc1, <=1.4.1) +1 more potentially affected by CVE-2026-69249 via cryptography (2.2.1)
cryptography PYPI version 2.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - image-builder =0.1.1rc0, =1.2.0rc1, =0.0.3a0, =0.1.10 Source cves: CVE-2026-69249 Source advisory: OSV:PYSEC-2026-3553...
Flyto2 Core: Arbitrary file write via image.download (and other file-writing modules)
Summaryimage.download fetches a URL and writes the response to disk. It does not use the central path guard validatepathwithenvconfig, which confines writes to FLYTOSANDBOXDIR; instead it confines the output to outputdir, but outputdir is itself a caller parameter. Since the attacker sets both th...
PYSEC-2026-3568 Flyto2 Core: Arbitrary file write via image.download (and other file-writing modules)
Summary image.download fetches a URL and writes the response to disk. It does not use the central path guard validatepathwithenvconfig, which confines writes to FLYTOSANDBOXDIR; instead it confines the output to outputdir, but outputdir is itself a caller parameter. Since the attacker sets both t...
foundation-cancer-image-biomarker (>=1.0.1a4, <=1.0.1a5), lpw (0.2.5.0) +1 more potentially affected by CVE-2026-61632 via pymdown-extensions (10.12.0)
pymdown-extensions PYPI version 10.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - foundation-cancer-image-biomarker =1.0.1a4, =1.0.1a5 - lpw 0.2.5.0 - quizwiz 1.0.0 Source cves: CVE-2026-61632 Source...
PYSEC-2026-3604 Open WebUI: POST /api/v1/images/edit bypasses the global image-edit switch and the per-user image-generation permission
Summary POST /api/v1/images/edit performed no authorization beyond requiring a verified account. Every other image-editing surface in Open WebUI enforces the global image-edit switch and the per-user image-generation permission — the /api/v1/images/generations route, the built-in editimage tool,...
PYSEC-2026-3609 PyMdown Extensions: Path traversal in the b64 extension lets <img src> read files outside base_path
Summary The b64 extension inlines images referenced by as base64 data URIs. When resolving the src path it joins it onto the configured basepath with os.path.normpath and opens the result directly, with no check that the resolved path stays inside basepath. A src containing ../ sequences, or an...
Open WebUI: POST /api/v1/images/edit bypasses the global image-edit switch and the per-user image-generation permission
SummaryPOST /api/v1/images/edit performed no authorization beyond requiring a verified account. Every other image-editing surface in Open WebUI enforces the global image-edit switch and the per-user image-generation permission — the /api/v1/images/generations route, the built-in editimage tool, a...
PyMdown Extensions: Path traversal in the b64 extension lets <img src> read files outside base_path
SummaryThe b64 extension inlines images referenced by as base64 data URIs. When resolving the src path it joins it onto the configured basepath with os.path.normpath and opens the result directly, with no check that the resolved path stays inside basepath. A src containing ../ sequences, or an...
PYSEC-2026-3611 pypdf: Possible large memory usage for wrong image dimensions
Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires loading images where the declared size values are much too large compared to the actual data. Patches This has been fixed in pypdf==6.14.0. Workarounds If you cannot upgrade yet, consid...
pypdf: Possible infinite loop for not terminated inline images
ImpactAn attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page with a not terminated inline image, as done when extracting the page text for example. PatchesThis has been fixed in pypdf==6.14.1. WorkaroundsIf you...
pypdf: Possible large memory usage for wrong image dimensions
ImpactAn attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires loading images where the declared size values are much too large compared to the actual data. PatchesThis has been fixed in pypdf==6.14.0. WorkaroundsIf you cannot upgrade yet, consider...
CVE-2026-16069
The Brizy WordPress plugin, in versions prior to 2.8.19 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to sanitize or escape featured-image focal-point coordinates submitted via an AJAX action before they are stored and subsequently echoed into HTML attribute...
CVE-2026-16069 Brizy - Page Builder < 2.8.19 - Contributor+ Stored XSS via Featured Image Focal Point
The Brizy WordPress plugin before 2.8.19 does not sanitize or escape featured-image focal-point coordinates submitted through one of its AJAX actions before storing them and later echoing them into HTML attributes in the post editor's Featured Image meta box, allowing users with the Contributor...
CVE-2026-16069
The Brizy WordPress plugin before 2.8.19 does not sanitize or escape featured-image focal-point coordinates submitted through one of its AJAX actions before storing them and later echoing them into HTML attributes in the post editor's Featured Image meta box, allowing users with the Contributor...
remove-ai-watermarks v0.25.0
Remove AI Watermarks Remove AI provenance marks from images and video you generated yourself: known visible labels such as the Gemini sparkle and vendor text marks; invisible pixel watermarks through diffusion regeneration; C2PA, EXIF, XMP, IPTC, and related AI metadata. Video support covers...
