OPENSUSE-SU-2026:21391-1 Security update for ImageMagick

This update for ImageMagick fixes the following issues - CVE-2026-55628: Policy Bypass in concatenate operation due to missing checks bsc1270081. - CVE-2026-56362: Heap-buffer-overflow read in GetPixelIndex due to metadata-cache desynchronization in OpenPixelCache bsc1271100. - CVE-2026-56366: ME...

CVE-2026-13432

The ThumbPress WordPress plugin before 6.2.2 does not perform a capability check on one of its AJAX actions, allowing authenticated users with subscriber-level access or higher to deactivate the ThumbPress WordPress plugin before 6.2.2, disrupting the site's image-handling functionality...

CVE-2026-13432 ThumbPress < 6.2.2 - Subscriber+ Plugin Deactivation

The ThumbPress WordPress plugin before 6.2.2 does not perform a capability check on one of its AJAX actions, allowing authenticated users with subscriber-level access or higher to deactivate the ThumbPress WordPress plugin before 6.2.2, disrupting the site's image-handling functionality...

EUVD-2026-45891

The ThumbPress WordPress plugin before 6.2.2 does not perform a capability check on one of its AJAX actions, allowing authenticated users with subscriber-level access or higher to deactivate the ThumbPress WordPress plugin before 6.2.2, disrupting the site's image-handling functionality...

CVE-2026-13432

The ThumbPress WordPress plugin before 6.2.2 does not perform a capability check on one of its AJAX actions, allowing authenticated users with subscriber-level access or higher to deactivate the ThumbPress WordPress plugin before 6.2.2, disrupting the site's image-handling functionality...

MAL-2026-10827 Malicious code in @gocortexio/npmgremlinbox-jpl-image (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ba27e14255b949c635452dafe1c837fa1146d33e5f4261ca7b5441f84e2fd388 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Important: libheif

Issue Overview: Heap Information Disclosure via Grid Image Gap + Uninitialized Pixel Plane Allocation CVE-2026-47247 libheif crashes in the public C API heifimagehandlegetimagetiling when a malformed uncompressed HEIF image item has an associated uncC property but no associated ispe property. In...

PT-2026-61728

Name of the Vulnerable Software and Affected Versions Spectra Gutenberg Blocks – Website Builder for the Block Editor versions prior to 2.19.29 Description Stored Cross-Site Scripting occurs via the uagb/image block due to insufficient input sanitization and output escaping. This allows...

PT-2026-61607

Name of the Vulnerable Software and Affected Versions maalfer Pentestify versions prior to 1.1.0 Description Stored Cross-site Scripting occurs in the client-side report rendering functions renderPreview, renderEditor, and renderAuditData located in js/app.js. A remote, authenticated attacker can...

Amazon Linux 2023 : heif-pixbuf-loader, libheif, libheif-devel (ALAS2023-2026-1971)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1971 advisory. Heap Information Disclosure via Grid Image Gap + Uninitialized Pixel Plane Allocation CVE-2026-47247 libheif crashes in the public C API heifimagehandlegetimagetiling when a malformed...

PT-2026-62013

These are all security issues fixed in the ImageMagick-7.1.2.27-3.1 package on the GA media of openSUSE Tumbleweed...

RHEL 10 : libtiff (RHSA-2026:41892)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:41892 advisory. The libtiff packages contain a library of functions for manipulating Tagged Image File Format TIFF files. Security Fixes: libtiff:...

Linux Distros Unpatched Vulnerability : CVE-2026-35591

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libvips is a fast image processing library with low memory needs. The tiffload operation in libvips versions before and including 8.18.1 could incorrectly...

Linux Distros Unpatched Vulnerability : CVE-2026-64612

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in libcupsfilters and cups-filters. The PNG image reading function creates a libpng reader without installing an error recovery handler, causin...

PT-2026-61632

Name of the Vulnerable Software and Affected Versions libvips versions prior to 8.18.1 Description The vipsload operation can incorrectly determine image dimensions, which leads to an integer overflow and a subsequent heap-based buffer overflow. A heap-based buffer overflow occurs when a program...

PT-2026-61668

Name of the Vulnerable Software and Affected Versions libcupsfilters affected versions not specified cups-filters affected versions not specified Red Hat Enterprise Linux 10 affected versions not specified Description A flaw exists in the PNG image reading function of libcupsfilters and...

Linux Distros Unpatched Vulnerability : CVE-2026-64167

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: kho: skip KHO for crash kernel khofillkimage unconditionally populates the kimage with KHO...

[SECURITY] [DSA 6392-1] tiff security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6392-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 19, 2026 https://www.debian.org/security/faq -...

CVE-2026-64167

In the Linux kernel, the following vulnerability has been resolved: kho: skip KHO for crash kernel khofillkimage unconditionally populates the kimage with KHO metadata for every kexec image type. When the image is a crash kernel, this can be problematic as the crash kernel can run in a small...

CVE-2026-64097

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Validate GPIO pin LUT table size before iterating Why&How The GPIO pin table parsers in getgpioi2cinfo and biosparsergetgpiopininfo derive an element count from the VBIOS tableheader.structuresize field, then...