53238 matches found
CVE-2026-6694
A flaw was found in GIMP's file-png plugin. A remote attacker can exploit this by crafting a malicious Animated Portable Network Graphics APNG image containing an oversized tRNS chunk. This can lead to a stack-based buffer overflow CWE-121, causing the file-png plugin to crash and resulting in a...
CVE-2026-6695
A flaw was found in GIMP. A remote attacker could exploit this by tricking a user into opening a specially crafted PAA Paint Shop Pro Array image file. This vulnerability, a heap-based out-of-bounds write in the decodelzss function of the PAA file format plugin, allows data to be written beyond t...
CVE-2026-6695
A flaw was found in GIMP. A remote attacker could exploit this by tricking a user into opening a specially crafted PAA Paint Shop Pro Array image file. This vulnerability, a heap-based out-of-bounds write in the decodelzss function of the PAA file format plugin, allows data to be written beyond t...
CVE-2026-6695
CVE-2026-6695 affects GIMP via the PAA file format plugin. The root cause is a heap-based out-of-bounds write in the decode_lzss() routine when processing crafted PAA images, which could corrupt heap metadata and allow arbitrary code execution. Documents specify the vulnerability as remote code e...
EUVD-2026-52151
A flaw was found in GIMP. A remote attacker could exploit this by tricking a user into opening a specially crafted PAA Paint Shop Pro Array image file. This vulnerability, a heap-based out-of-bounds write in the decodelzss function of the PAA file format plugin, allows data to be written beyond t...
CVE-2026-6695 Gimp: gimp: remote code execution via crafted paa file
A flaw was found in GIMP. A remote attacker could exploit this by tricking a user into opening a specially crafted PAA Paint Shop Pro Array image file. This vulnerability, a heap-based out-of-bounds write in the decodelzss function of the PAA file format plugin, allows data to be written beyond t...
CVE-2026-6694 Gimp: gimp file-png plugin: denial of service via oversized apng trns chunk
A flaw was found in GIMP's file-png plugin. A remote attacker can exploit this by crafting a malicious Animated Portable Network Graphics APNG image containing an oversized tRNS chunk. This can lead to a stack-based buffer overflow CWE-121, causing the file-png plugin to crash and resulting in a...
CVE-2026-6694
A flaw was found in GIMP's file-png plugin. A remote attacker can exploit this by crafting a malicious Animated Portable Network Graphics APNG image containing an oversized tRNS chunk. This can lead to a stack-based buffer overflow CWE-121, causing the file-png plugin to crash and resulting in a...
CVE-2026-6694
CVE-2026-6694 affects GIMP’s file-png plugin. A crafted APNG with an oversized tRNS chunk may trigger a stack-based buffer overflow (CWE-121), causing the plugin to crash and resulting in a Denial of Service. The available documents specify the vulnerability and impact but do not provide remediat...
CVE-2026-6695
A flaw was found in GIMP. A remote attacker could exploit this by tricking a user into opening a specially crafted PAA Paint Shop Pro Array image file. This vulnerability, a heap-based out-of-bounds write in the decodelzss function of the PAA file format plugin, allows data to be written beyond t...
CVE-2026-20486
In imgsensor, there is a possible application crash due to incorrect error handling. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11012302; Issue ID: MSV-7833...
CVE-2026-20486
In imgsensor, a local escalation of privilege could occur due to incorrect error handling causing an application crash when a System-privilege context is already held. The advisory notes no user interaction is required for exploitation. The publicly referenced fix is Patch ID ALPS11012302 (Issue ...
CVE-2026-20486
In imgsensor, there is a possible application crash due to incorrect error handling. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11012302; Issue ID: MSV-7833...
PT-2026-67267
A flaw was found in GIMP. A remote attacker could exploit this by tricking a user into opening a specially crafted PAA Paint Shop Pro Array image file. This vulnerability, a heap-based out-of-bounds write in the decode lzss function of the PAA file format plugin, allows data to be written beyond...
CVE-2026-12231
The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ exadinfoboximage’ parameter in all versions up to, and including, 2.7.9.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...
CVE-2026-12231
CVE-2026-12231 affects the WordPress plugin Exclusive Addons for Elementor . The vulnerability is a Stored Cross-Site Scripting via the exad_infobox_image parameter, present in all versions up to 2.7.9.8, due to insufficient input sanitization and output escaping. Exploitation requires authentica...
EUVD-2026-51984
The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ exadinfoboximage’ parameter in all versions up to, and including, 2.7.9.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...
CVE-2026-12231
The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ exadinfoboximage’ parameter in all versions up to, and including, 2.7.9.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...
CVE-2026-12231 Exclusive Addons for Elementor <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'exad_infobox_image'
The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ exadinfoboximage’ parameter in all versions up to, and including, 2.7.9.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...
