CVE-2026-112264 BentoML through 1.4.39 Dockerfile Instruction Injection via docker.env Keys

BentoML through 1.4.39 contains a Dockerfile instruction injection vulnerability that allows attackers to add arbitrary build instructions by embedding newlines in docker.env mapping keys rendered by the legacy base.j2 template. Attackers can supply a crafted bentofile.yaml or imported bento...

CVE-2026-112264 BentoML through 1.4.39 Dockerfile Instruction Injection via docker.env Keys

BentoML through 1.4.39 contains a Dockerfile instruction injection vulnerability that allows attackers to add arbitrary build instructions by embedding newlines in docker.env mapping keys rendered by the legacy base.j2 template. Attackers can supply a crafted bentofile.yaml or imported bento...

CVE-2026-111935

The software NoteGen through version 0.38.3 is vulnerable to an external control of file path (CWE-73) during chat image analysis. The root cause is the use of unvalidated synced sourceUrl paths , which allows an attacker with write access to the victim's sync target to plant absolute paths or fi...

CVE-2026-111935 NoteGen through 0.38.3 Local File Disclosure via Chat Image Analysis

NoteGen through 0.38.3 contains an external control of file path vulnerability in chat image analysis that allows attackers to read local image files via unvalidated synced sourceUrl paths. Attackers with write access to the victim's sync target can plant absolute paths or file:// URLs, causing...

CVE-2026-111935 NoteGen through 0.38.3 Local File Disclosure via Chat Image Analysis

NoteGen through 0.38.3 contains an external control of file path vulnerability in chat image analysis that allows attackers to read local image files via unvalidated synced sourceUrl paths. Attackers with write access to the victim's sync target can plant absolute paths or file:// URLs, causing...

EUVD-2026-104316

NoteGen through 0.38.3 contains an external control of file path vulnerability in chat image analysis that allows attackers to read local image files via unvalidated synced sourceUrl paths. Attackers with write access to the victim's sync target can plant absolute paths or file:// URLs, causing...

Critical: Red Hat Security Advisory: RHTAS 1.4.4 - Release of Model Transparency 1.0.5

Release of the RHTAS Model Transparency CLI image 1.0.5. For more details please visit the product documentation at https://access.redhat.com/documentation/en-us/redhattrustedartifactsigner/1.4 The RHTAS Model Transparency CLI image can be used to sign and verify AI/ML workloads...

CVE-2026-74922

The Document Gallery WordPress plugin through 5.1.1 does not verify the signature on one of its unauthenticated webhook endpoints when no shared secret has been configured, which is the default state, allowing unauthenticated users to replace the thumbnail image the site publishes for any documen...

EUVD-2026-104099

The Document Gallery WordPress plugin through 5.1.1 does not verify the signature on one of its unauthenticated webhook endpoints when no shared secret has been configured, which is the default state, allowing unauthenticated users to replace the thumbnail image the site publishes for any documen...

CVE-2026-111881

A flaw was found in FreeRDP. An integer underflow vulnerability exists in its bitmap image processing component due to an incorrect calculation when handling sub-byte images. A remote attacker acting as a malicious peer in a Remote Desktop Protocol RDP session can exploit this by supplying a...

emacs: GNU Emacs: Heap over-read leading to information disclosure via crafted image

A flaw was found in GNU Emacs. An integer overflow in the PBM/PPM/PGM image loader allows a remote attacker to leak heap memory contents. By supplying a specially crafted image with large dimensions and an elevated maximum color index, the image loader's internal calculations can wrap to a negati...

PT-2026-117248

Name of the Vulnerable Software and Affected Versions Document Gallery WordPress plugin versions prior to 5.1.2 Description The plugin fails to verify the signature on an unauthenticated webhook endpoint when no shared secret is configured, which is the default setting. This allows unauthenticate...

CVE-2026-74922: Insufficient Verification of Data Authenticity

The Document Gallery WordPress plugin through 5.1.1 does not verify the signature on one of its unauthenticated webhook endpoints when no shared secret has been configured, which is the default state, allowing unauthenticated users to replace the thumbnail image the site publishes for any documen...

emacs security update

1:29.4-16 - Generalize trusted-content-p check to all Flymake backends CVE-2026-96442 1:29.4-15 - tramp: restrict user name to prevent shell injection CVE-2026-79992 1:29.4-14 - image: fix integer overflow in pbmload CVE-2026-77219...

PT-2026-117653

Name of the Vulnerable Software and Affected Versions Pillow versions prior to 13.0.0 Description Rank-based filters in the Pillow Python imaging library can dereference invalid image storage when processing a zero-size image. The ImagingExpand function allocates a non-empty output but faults...

PT-2026-117671

Name of the Vulnerable Software and Affected Versions Pillow versions 12.0.0 through 12.x Description The Image.merge function can dereference a null image8 plane because validation skips the first input band. This allows a 32-bit integer or floating-point image backed by image32 storage to be...

CVE-2026-112390: Loop with Unreachable Exit Condition

Pillow is a Python imaging library. From 7.2.0 until 13.0.0, Pillow can enter an infinite loop while determining the frame count of a MIC image. MicImageFile inherits TIFF frame traversal, but MicImageFile.tell reports the OLE stream index and its seek resets TIFF frame state, so an embedded TIFF...

Red Hat: CVE-2026-112400: pillow: pillow: Denial of Service via memory exhaustion from crafted GIF image

Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow can retain a rejected GIF frame size after a decompression-bomb exception. In GifImageFile.seek, a crafted GIF can leave rejected dimensions stored after Image.DecompressionBombError; if an application catches that exception and...

CVE-2026-16460: Insufficient Verification of Data Authenticity

A flaw was found in bootc and ostree. Already-staged deployments are finalized without revalidating the deployment's container image against the current containers signature policy. Unsigned OS content staged under a prior permissive policy can remain bootable after policy is hardened to reject...

PT-2026-117655

Name of the Vulnerable Software and Affected Versions Pillow versions prior to 13.0.0 Description A flaw exists in the Python imaging library where the ImageMorph.MorphOp.apply function can access memory before a row buffer when processing images with a width of zero. This occurs because the PPM...