gimp: GIMP: Remote Code Execution via ICO File Parsing Vulnerability

A flaw was found in GIMP. This vulnerability, a heap-based buffer overflow, occurs during the parsing of ICO files. A remote attacker can exploit this by convincing a user to open a malicious file or visit a malicious web page, leading to arbitrary code execution. The issue is due to a lack of...

gimp: GIMP: Remote Code Execution via XWD file parsing vulnerability

A flaw was found in GIMP. A remote attacker can exploit this out-of-bounds write vulnerability by tricking a user into opening a specially crafted XWD X Window Dump file. This issue occurs due to improper validation of user-supplied data during XWD file parsing, leading to a write past the end of...

gimp: GIMP: Remote Code Execution via uninitialized memory in PGM file parsing

A flaw was found in GIMP. This uninitialized memory vulnerability allows a remote attacker to execute arbitrary code on affected installations. Successful exploitation requires user interaction, where the target must open a specially crafted PGM Portable Graymap image file. This can lead to...

CLSA-2026-1774266713 exiv2: Fix of 2 CVEs

CVE-2026-25884: fix out-of-bounds read in CRW image parser - CVE-2026-27596: fix integer underflow in preview component...

CLSA-2026-1774266009 exiv2: Fix of 2 CVEs

CVE-2026-25884: fix out-of-bounds read in CRW image parser - CVE-2026-27596: fix integer underflow in preview component...

OPENSUSE-SU-2026:20410-1 Security update for exiv2

This update for exiv2 fixes the following issues: Update to exiv2 0.28.8: - CVE-2024-24826: out-of-bounds read in QuickTimeVideo: NikonTagsDecoder bsc1219870. - CVE-2024-25112: denial of service due to unbounded recursion in QuickTimeVideo: multipleEntriesDecoder bsc1219871. - CVE-2024-39695:...

CVE-2026-30006

XnSoft NConvert 7.230 is vulnerable to Stack Buffer Overrun via a crafted .tiff file...

📄 AVideo Command Injection

The Metasploit exploit module targets a command injection vulnerability in AVideo. This module exploits a base64-encoded command injection flaw in AVideo Encoder's image processing endpoint, turning a simple URL parameter into remote code execution with multiple payload strategies. Versions prior...

The vulnerability of the ReadTIMImage function in the TIM image analyzer software (PSX TIM), a console-based image editing tool from ImageMagick, allows a hacker to cause a service failure.

The vulnerability of the ReadTIMImage function in the TIM image analyzer and the ImageMagick console-based graphics editor involves the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: gimp (UTSA-2026-006281)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006281 advisory. A flaw was found in GIMP. An integer overflow vulnerability exists in the GIMP Despeckle plug-in. The issue occurs due to unchecked multiplication of image dimension...

CVE-2026-30007

XnSoft NConvert 7.230 is affected by CVE-2026-30007: a Use-After-Free in processing crafted TIFF files. According to the provided metrics, the impact is Availability: High; Confidentiality/Integrity: None; Attack vector: Local; Privileges required: None; User interaction: None; Base score 6.2 (Me...

PT-2026-27148

XnSoft NConvert 7.230 is vulnerable to Stack Buffer Overrun via a crafted .tiff file...

RHEL 9 : gimp (RHSA-2026:5391)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:5391 advisory. The GIMP GNU Image Manipulation Program is an image composition and editing program. GIMP provides a large image manipulation toolbox,...

WWBN AVideo 代码问题漏洞

WWBN AVideo is a video platform building system written in PHP, developed by the WWBN team. Versions of WWBN AVideo prior to 26.0 contained code vulnerabilities. These vulnerabilities stemmed from a lack of extension file list checks in the ImageGallery::saveFile method, which could lead to remot...

PT-2026-27171

Name of the Vulnerable Software and Affected Versions AVideo versions up to and including 26.0 Description AVideo is an open source video platform. The plugin/Permissions/setPermission.json.php API endpoint accepts GET parameters for a state-changing operation that modifies user group permissions...

CVE-2026-30006

XnSoft NConvert 7.230 is affected by a vulnerability described as a Stack Buffer Overrun triggered by a crafted TIFF file. The issue relates to parsing TIFF data and can impact availability. The provided documents identify the affected product and the file type but do not disclose the exact root-...

PT-2026-27149

XnSoft NConvert 7.230 is vulnerable to Use-After-Free via a crafted .tiff file...

WordPress Autoptimize plugin <= 3.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lazy-loaded Image Attributes vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Lazy-loaded Image Attributes vulnerability discovered by stealthcopter in WordPress Plugin Autoptimize versions = 3.1.14...

CVE-2026-4542 SSCMS layerImage Endpoint LayerImageController.Submit.cs path traversal

A vulnerability has been found in SSCMS 4.7.0. The affected element is an unknown function of the file LayerImageController.Submit.cs of the component layerImage Endpoint. Such manipulation of the argument filePaths leads to path traversal. The attack may be performed from remote. The exploit has...

CVE-2026-4542

A vulnerability has been found in SSCMS 4.7.0. The affected element is an unknown function of the file LayerImageController.Submit.cs of the component layerImage Endpoint. Such manipulation of the argument filePaths leads to path traversal. The attack may be performed from remote. The exploit has...