CVE-2026-64112

A flaw was found in the Linux kernel's Rados Block Device RBD module. A race condition exists in the lockdwork draining mechanism during the unmapping of an image. This allows the lockdwork to be re-queued after it is expected to be finalized, potentially leading to rbdacquirelock executing on...

CVE-2026-59238

Stored Cross-site Scripting CWE-79 in the client-side report rendering functions renderPreview, renderEditor, renderAuditData in js/app.js in maalfer Pentestify before 1.1.0 allows a remote, authenticated attacker to execute arbitrary JavaScript in the browser of any user who views an affected...

EUVD-2026-45947

Stored Cross-site Scripting CWE-79 in the client-side report rendering functions renderPreview, renderEditor, renderAuditData in js/app.js in maalfer Pentestify before 1.1.0 allows a remote, authenticated attacker to execute arbitrary JavaScript in the browser of any user who views an affected...

ROOT-OS-DEBIAN-13-CVE-2026-61870 CVE-2026-61870 in rootio-imagemagick - Patched by Root

Root has patched CVE-2026-61870 in the rootio-imagemagick package for Root:Debian:13. Multiple fixed versions available...

CVE-2026-13432

The ThumbPress WordPress plugin before 6.2.2 does not perform a capability check on one of its AJAX actions, allowing authenticated users with subscriber-level access or higher to deactivate the ThumbPress WordPress plugin before 6.2.2, disrupting the site's image-handling functionality...

CVE-2026-13432

The ThumbPress WordPress plugin before 6.2.2 does not perform a capability check on one of its AJAX actions, allowing authenticated users with subscriber-level access or higher to deactivate the ThumbPress WordPress plugin before 6.2.2, disrupting the site's image-handling functionality...

EUVD-2026-45891

The ThumbPress WordPress plugin before 6.2.2 does not perform a capability check on one of its AJAX actions, allowing authenticated users with subscriber-level access or higher to deactivate the ThumbPress WordPress plugin before 6.2.2, disrupting the site's image-handling functionality...

CVE-2026-13432 ThumbPress < 6.2.2 - Subscriber+ Plugin Deactivation

The ThumbPress WordPress plugin before 6.2.2 does not perform a capability check on one of its AJAX actions, allowing authenticated users with subscriber-level access or higher to deactivate the ThumbPress WordPress plugin before 6.2.2, disrupting the site's image-handling functionality...

MAL-2026-10827 Malicious code in @gocortexio/npmgremlinbox-jpl-image (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ba27e14255b949c635452dafe1c837fa1146d33e5f4261ca7b5441f84e2fd388 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2026-61728

Name of the Vulnerable Software and Affected Versions Spectra Gutenberg Blocks – Website Builder for the Block Editor versions prior to 2.19.29 Description Stored Cross-Site Scripting occurs via the uagb/image block due to insufficient input sanitization and output escaping. This allows...

PT-2026-61607

Name of the Vulnerable Software and Affected Versions maalfer Pentestify versions prior to 1.1.0 Description Stored Cross-site Scripting occurs in the client-side report rendering functions renderPreview, renderEditor, and renderAuditData located in js/app.js. A remote, authenticated attacker can...

Amazon Linux 2023 : heif-pixbuf-loader, libheif, libheif-devel (ALAS2023-2026-1971)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1971 advisory. Heap Information Disclosure via Grid Image Gap + Uninitialized Pixel Plane Allocation CVE-2026-47247 libheif crashes in the public C API heifimagehandlegetimagetiling when a malformed...

Important: libheif

Issue Overview: Heap Information Disclosure via Grid Image Gap + Uninitialized Pixel Plane Allocation CVE-2026-47247 libheif crashes in the public C API heifimagehandlegetimagetiling when a malformed uncompressed HEIF image item has an associated uncC property but no associated ispe property. In...

PT-2026-62013

These are all security issues fixed in the ImageMagick-7.1.2.27-3.1 package on the GA media of openSUSE Tumbleweed...

Linux Distros Unpatched Vulnerability : CVE-2026-64612

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in libcupsfilters and cups-filters. The PNG image reading function creates a libpng reader without installing an error recovery handler, causin...

RHEL 10 : libtiff (RHSA-2026:41892)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:41892 advisory. The libtiff packages contain a library of functions for manipulating Tagged Image File Format TIFF files. Security Fixes: libtiff:...

Linux Distros Unpatched Vulnerability : CVE-2026-35591

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libvips is a fast image processing library with low memory needs. The tiffload operation in libvips versions before and including 8.18.1 could incorrectly...

PT-2026-61632

libvips is a fast image processing library with low memory needs. The vipsload operation in versions before and including 8.18.0 could incorrectly determine image dimensions leading to an integer overflow and a subsequent heap-based buffer overflow. This has been patched in version 8.18.1...

PT-2026-61668

Name of the Vulnerable Software and Affected Versions libcupsfilters affected versions not specified cups-filters affected versions not specified Red Hat Enterprise Linux 10 affected versions not specified Description A flaw exists in the PNG image reading function of libcupsfilters and...

Linux Distros Unpatched Vulnerability : CVE-2026-64167

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: kho: skip KHO for crash kernel khofillkimage unconditionally populates the kimage with KHO...