53234 matches found
CVE-2026-71209
Audiobookshelf CVE-2026-71209 describes an authentication-exemption bypass in server/routers/Auth.js. The regex checks unauthenticated GET routes against req.path, but because req.path can contain URL-encoded %2F sequences, an encoded directory traversal like ..%2f..%2f..%2ftmp%2fpwned escapes th...
EUVD-2026-53206
audiobookshelf's authentication-exemption check server/routers/Auth.js matches unauthenticated-allowed GET routes against req.path via a regex requiring a literal /items/:id/cover or /authors/:id/image shape, where req.path retains %2F sequences URL-encoded. Express's router decodes the :id route...
CVE-2026-70378
imagecli's carve pipeline operation Carve::apply in src/imageops.rs only asserts ratio = 1.0, never validating that the ratio is positive. A negative ratio e.g. -5 causes the computed target width to saturate to 0 via Rust's defined float-to-uint cast, which is then passed to...
EUVD-2026-53197
imagecli's scale pipeline operation Scale::apply in src/imageops.rs computes output width/height as dimension as f32 ratio as u32 with no upper-bound validation on the CLI-supplied ratio, which is parsed via nom::number::complete::float with no range check. A large ratio e.g. 100000 causes an...
EUVD-2026-53101
The Bit Form WordPress plugin before 3.2.0 does not sanitize an uploaded signature image before storing it, allowing unauthenticated attackers to upload a crafted SVG file containing JavaScript that executes when the file is viewed, leading to Stored Cross-Site Scripting...
CVE-2026-16573
The CVE-2026-16573 vulnerability affects the Bit Form WordPress plugin prior to version 3.2.0. An unauthenticated attacker can upload a crafted SVG signature image that contains JavaScript, which is not sanitized before storage and executes when viewed, enabling Stored XSS. This is tied to the pl...
EUVD-2026-53100
The Sunshine Photo Cart WordPress plugin before 3.6.12 does not perform access control checks in one of its AJAX actions, allowing unauthenticated users to retrieve the comments of images belonging to private, password-protected or otherwise access-restricted galleries...
Photon OS 5.0: Imagemagick PHSA-2026-5.0-91-0790
An update of the ImageMagick package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-91-0790. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...
Photon OS 5.0: Imagemagick PHSA-2026-5.0-91-0728
An update of the ImageMagick package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-91-0728. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...
RHEL 9 : libtiff (RHSA-2026:50774)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:50774 advisory. The libtiff packages contain a library of functions for manipulating Tagged Image File Format TIFF files. Security Fixes: libtiff: libtiff: Heap-bas...
MiracleLinux 8 : java-17-openjdk-17.0.20.0.8-1.1.el8 (AXSA:2026-1403:11)
The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1403:11 advisory. JDK: Enhance TLS certificate handling CVE-2026-46968 JDK: Improve DTLS handshaking CVE-2026-46917 JDK: Enhance JPEG handling CVE-2026-47010 JDK:...
The vulnerability of the ImageMedium::watermark() function in the Grav CMS system allows a hacker to disclose protected information.
The vulnerability of the ImageMedium::watermark function in the Grav CMS system is related to an incorrect limitation on the path to the catalog. Exploiting this vulnerability could allow a malicious actor to disclose protected information...
CVE-2026-70591
Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a Server-Side Request Forgery in Ghost Admin image fetching allowed any staff-level user to perform a blind HTTP GET request against internal hosts. No output was returned, but this could have been used to probe open ports on...
GHSA-7MPP-R37J-X5WH Ghost: Session Fixation in Ghost Admin
Impact Ghost Admin did not invalidate existing sessions on login which could have allowed for session fixation attacks. Successful exploitation would have required another vulnerability on the same domain where Ghost Admin was hosted. Vulnerable versions This vulnerability is present in Ghost fro...
NPM: Ghost: Server-Side Request Forgery in Image Fetching
NPM: Ghost: Server-Side Request Forgery in Image Fetching vulnerability discovered by ? in WordPress Npm ghost versions = 0.10.0, 6.54.1...
GHSA-GCVV-72Q8-9V76 Ghost: Server-Side Request Forgery in Image Fetching
Impact A Server-Side Request Forgery SSRF in Ghost Admin allowed any staff-level user to perform a blind HTTP GET request against internal hosts. No output was returned, but this could have been used to probe open ports on internal hosts. Vulnerable versions This vulnerability is present in Ghost...
Ghost: Server-Side Request Forgery in Image Fetching
Impact A Server-Side Request Forgery SSRF in Ghost Admin allowed any staff-level user to perform a blind HTTP GET request against internal hosts. No output was returned, but this could have been used to probe open ports on internal hosts. Vulnerable versions This vulnerability is present in Ghost...
CVE-2026-70591
Ghost is a Node.js content management system. From version 0.10.0 up to 6.54.1, a Server-Side Request Forgery in Ghost Admin image fetching allowed any staff-level user to perform a blind HTTP GET to internal hosts; no output was returned but it could be used to probe internal ports. The issue is...
CVE-2026-70591 Ghost: Server-Side Request Forgery in Image Fetching
Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a Server-Side Request Forgery in Ghost Admin image fetching allowed any staff-level user to perform a blind HTTP GET request against internal hosts. No output was returned, but this could have been used to probe open ports on...