CVE-2026-91457

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware component: Outside In Image Export SDK. The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Outside In...

CVE-2026-91459

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware component: Outside In Image Export SDK. The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Outside In...

CVE-2026-91460

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware component: Outside In Image Export SDK. The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Outside In...

CVE-2026-87417

Vulnerability in the Oracle Solaris product of Oracle Systems component: Image Packaging System. The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Solaris. Successful attacks of this...

CVE-2026-87421

Vulnerability in the Oracle Solaris product of Oracle Systems component: Image Packaging System. The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Solaris. Successful attacks require...

CVE-2026-87414

Vulnerability in the Oracle Solaris product of Oracle Systems component: Image Packaging System. The supported version that is affected is 11.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Solaris. Successful attacks require...

CVE-2026-60432

Vulnerability in the Oracle Solaris product of Oracle Systems component: Image Packaging System. Supported versions that are affected are 11.3 and 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Solaris. Successful attacks o...

CVE-2026-91460

A vulnerability exists in the Outside In Image Export SDK component of the Oracle Outside In Technology product within Oracle Fusion Middleware (version 8.5.8 ). This easily exploitable flaw allows an unauthenticated attacker with access to the infrastructure to compromise the product, potentiall...

CVE-2026-91457

A vulnerability exists in the Outside In Image Export SDK component of the Oracle Outside In Technology product (part of Oracle Fusion Middleware), specifically affecting version 8.5.8 . An unauthenticated attacker with access to the infrastructure can compromise the product, potentially leading ...

CVE-2026-91459

The Oracle Outside In Technology product, specifically within the Oracle Fusion Middleware (component: Outside In Image Export SDK ), is affected by CVE-2026-91459 in version 8.5.8 . An unauthenticated attacker with logon access to the infrastructure where the software executes can compromise the...

CVE-2026-87421

The Image Packaging System component in Oracle Solaris version 11.4 is vulnerable to an easily exploitable flaw. An unauthenticated attacker with network access via HTTP can compromise the system, though the attack requires human interaction from a user. Successful exploitation can result in unau...

CVE-2026-87417

A vulnerability exists in the Image Packaging System component of Oracle Solaris version 11.4 . An unauthenticated attacker with network access via HTTP can easily exploit this flaw to compromise the system. Successful exploitation may lead to unauthorized access to critical data or complete acce...

CVE-2026-87414

A vulnerability exists in the Image Packaging System component of Oracle Solaris version 11.4 . An unauthenticated attacker with network access via TLS can exploit this high-complexity vulnerability, though it requires human interaction from a third party. Successful exploitation may allow the at...

CVE-2026-60432

A vulnerability exists in the Image Packaging System component of Oracle Solaris versions 11.3 and 11.4 . An unauthenticated attacker with network access via HTTP can easily exploit this flaw to compromise the system. Successful exploitation can lead to a complete takeover of Oracle Solaris . Whi...

EUVD-2026-104640

Pillow: Out-of-bounds access in imagingmorph on a zero-width image...

GO-2026-6686 vulnerabilities

Vulnerabilities for packages: rke2-runtime, scorecard, envoy-gateway-fips, newrelic-infrastructure-agent, rancher, umoci, vcluster, datadog-agent-fips, vcluster-fips, rancher-agent, kubevirt-cdi-importer, eks-distro, runc, packer-fips, xeol-fips, newrelic-infrastructure-agent-fips,...

halogen

Halogen is a tool to automate the creation of yara rules based on the image files embedded within a malicious document. This can assist cyber security professionals in writing detection rules for malicious threats as well as help responders in identifying with particular threat they are dealing...

ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRF

Summary The @apostrophecms/ai-helper package builds the URL for a server-side image fetch by resolving a storage-relative path against req.baseUrl. When the site does not set a global base URL the default, req.baseUrl is derived from the incoming HTTP Host header. An authenticated editor can...

CVE-2026-113671 ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRF

ApostropheCMS is an open-source Node.js content management system. From 1.0.0-beta.10 until 1.0.0-beta.13 of the AI helper, an editor with image-generation capability can create a base64-generated image record without a stored provider URL and invoke image acceptance on a deployment using local...

CVE-2026-113671

In ApostropheCMS , a vulnerability exists in the @apostrophecms/ai-helper component (versions 1.0.0-beta.10 through 1.0.0-beta.13 ). An authenticated editor with image-generation capabilities can create a base64-generated image record without a provider URL. On deployments using local relative st...