CVE-2026-111392

SGLang versions through 0.5.21 are vulnerable to KV Cache Poisoning due to insufficient verification of mm_hashes values used as multimodal prefix-cache keys. A remote attacker can exploit this by sending a different image with a known or predicted hash via the /generate endpoint. This allows the...

CVE-2026-81872 affecting package azurelinux-image-tools for versions less than 1.7.0-2

CVE-2026-81872 affecting package azurelinux-image-tools for versions less than 1.7.0-2. An upgraded version of the package is available that resolves this issue...

CVE-2026-81871 affecting package azurelinux-image-tools for versions less than 1.7.0-2

CVE-2026-81871 affecting package azurelinux-image-tools for versions less than 1.7.0-2. An upgraded version of the package is available that resolves this issue...

CVE-2026-78659 affecting package azurelinux-image-tools for versions less than 1.7.0-2

CVE-2026-78659 affecting package azurelinux-image-tools for versions less than 1.7.0-2. A patched version of the package is available...

CVE-2026-78660 affecting package azurelinux-image-tools for versions less than 1.7.0-2

CVE-2026-78660 affecting package azurelinux-image-tools for versions less than 1.7.0-2. A patched version of the package is available...

CVE-2026-81870 affecting package azurelinux-image-tools for versions less than 1.7.0-2

CVE-2026-81870 affecting package azurelinux-image-tools for versions less than 1.7.0-2. An upgraded version of the package is available that resolves this issue...

CVE-2026-97032 affecting package azurelinux-image-tools for versions less than 1.7.0-2

CVE-2026-97032 affecting package azurelinux-image-tools for versions less than 1.7.0-2. A patched version of the package is available...

CVE-2026-78669 affecting package azurelinux-image-tools for versions less than 1.7.0-2

CVE-2026-78669 affecting package azurelinux-image-tools for versions less than 1.7.0-2. A patched version of the package is available...

CVE-2026-111138

A flaw was found in libnsbmp. An attacker can exploit this vulnerability by providing a specially crafted bitmap BMP image file to an application utilizing the library. Due to improper bounds checking during the decoding of compressed image data, processing the malformed image triggers an...

CVE-2026-46675

A flaw was found in libpng. A remote attacker could exploit this vulnerability to cause a Denial of Service DoS by supplying a specially crafted PNG image. Incomplete decompression of certain metadata chunks can leave a dangling pointer in the library's internal decompression state. When an...

Windows Raw Image Extension Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Raw Image Extension allows an unauthorized attacker to execute code over a network...

CVE-2026-16251

Mattermost versions 11.10.x = 11.10.0, 11.7.x = 11.7.9, 11.9.x = 11.9.1, 11.8.x = 11.8.5 fail to limit the size of remote image responses buffered in memory during local image proxy direct fetches, which allows a remote attacker to cause memory exhaustion on the server via a crafted oversized ima...

CVE-2026-16251 Mattermost local image proxy allows server memory exhaustion via unbounded image response buffering

Mattermost versions 11.10.x = 11.10.0, 11.7.x = 11.7.9, 11.9.x = 11.9.1, 11.8.x = 11.8.5 fail to limit the size of remote image responses buffered in memory during local image proxy direct fetches, which allows a remote attacker to cause memory exhaustion on the server via a crafted oversized ima...

CVE-2026-16251

Mattermost versions 11.10.x <= 11.10.0 , 11.7.x <= 11.7.9 , 11.9.x <= 11.9.1 , and 11.8.x

EUVD-2026-102750

Mattermost versions 11.10.x = 11.10.0, 11.7.x = 11.7.9, 11.9.x = 11.9.1, 11.8.x = 11.8.5 fail to limit the size of remote image responses buffered in memory during local image proxy direct fetches, which allows a remote attacker to cause memory exhaustion on the server via a crafted oversized ima...

CVE-2026-109191

The Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.0 via the 'imagehubapikeys 6 options' parameter. This makes it possible for authenticated attackers, with...

CVE-2026-107659

The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.11 via the 'id post ID in /wp-json/wp/v2/modula-gallery/id or none for collection route' parameter. This makes it possible for...

CVE-2026-107659 Modula Image Gallery <= 3.0.11 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Exposed 'modulaSettings' REST field on the modula-gallery CPT

The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.11 via the 'id post ID in /wp-json/wp/v2/modula-gallery/id or none for collection route' parameter. This makes it possible for...

EUVD-2026-102654

The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.11 via the 'id post ID in /wp-json/wp/v2/modula-gallery/id or none for collection route' parameter. This makes it possible for...

CVE-2026-107659

The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 3.0.11 . The root cause is a missing authorization check on the core /wp-json/wp/v2/modula-gallery/{id} path, which is exposed via show_in...