SUSE CVE-2026-4887

A flaw was found in GIMP. This issue is a heap buffer over-read in GIMP PCX file loader due to an off-by-one error. A remote attacker could exploit this by convincing a user to open a specially crafted PCX image. Successful exploitation could lead to out-of-bounds memory disclosure and a possible...

Calibre 安全漏洞

Calibre is an open-source, free tool developed by Kovid Goyal, a personal developer from India. It serves as a comprehensive e-book reading management and format conversion tool. Versions of Calibre prior to 9.6.0 contained security vulnerabilities. These vulnerabilities stemmed from a path...

Bludit 跨站脚本漏洞

Bludit is an open-source, lightweight blog content management system developed by Bludit. Versions of Bludit 3.18.2 and earlier had a cross-site scripting vulnerability. This vulnerability stemmed from a storage-based cross-site scripting flaw in the image upload function, which could allow...

PT-2026-28690

A security vulnerability has been detected in letta-ai letta 0.16.4. This vulnerability affects the function convert message create to message of the file letta/helpers/message helper.py of the component File URL Handler. Such manipulation of the argument ImageContent leads to server-side request...

Linux Distros Unpatched Vulnerability : CVE-2026-33542

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incus is a system container and virtual machine manager. Prior to version 6.23.0, a lack of validation of the image fingerprint when downloading from...

GIMP < 3.2.0 Multiple Vulnerabilities (macOS)

The version of GIMP installed on the remote macOS host is prior to 3.2.0. It is, therefore, affected by multiple vulnerabilities: - An integer overflow condition exists in PSD file parsing due to improper validation of user-supplied data. An unauthenticated, local attacker can exploit this, via a...

PT-2026-34050

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Parsing a WEBP image with an invalid, large size causes a panic on 32-bit platforms. Recommendations At the moment, there is no information about a newer version...

Calibre 代码问题漏洞

Calibre is an open-source, free tool developed by Kovid Goyal, a personal developer in India. It serves as a comprehensive e-book reading management and format conversion tool. Prior to Calibre 9.6.0, there were code-related vulnerabilities. These vulnerabilities stemmed from a server-side reques...

PT-2026-28340

Name of the Vulnerable Software and Affected Versions Bludit versions prior to 3.18.3 Description Bludit is susceptible to Stored Cross-Site Scripting XSS through its image upload feature. An authenticated attacker possessing content upload permissions—like Author, Editor, or Administrator—can...

Langflow 安全漏洞

Langflow is an open-source visualization framework developed by Langflow for building multi-agent and RAG applications. Langflow has a security vulnerability where authentication and authorization checks are missing for endpoints/api/v1/files/images/flowid/filename. This vulnerability allows...

Linux Distros Unpatched Vulnerability : CVE-2026-33536

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-18 and 6.9.13-43, due to an incorrect return value...

PT-2026-28736

The '/api/v1/files/images/flow id/file name' endpoint does not enforce any authentication or authorization checks, allowing any unauthenticated user to download images belonging to any flow by knowing or guessing the flow ID and file name...

Letta-ai letta 安全漏洞

Letta-ai letta is an open-source stateful proxy framework developed by Letta-ai, featuring memory management, reasoning capabilities, and context handling. Version 0.16.4 of Letta-ai letta contains a security vulnerability caused by incorrect handling of the parameter ImageContent in the file...

PT-2026-28474

Name of the Vulnerable Software and Affected Versions calibre versions prior to 9.6.0 Description A path traversal issue exists in the handling of images within Markdown and similar text-based files, which allows an attacker to include arbitrary files from the file system into a converted book...

Vulnerability of the freerdp_image_copy_from_icon_data() function in the RDP client FreeRDP, which allows a hacker to trigger a service failure

The vulnerability of the freerdpimagecopyfromicondata function libfreerdp/codec/color.c in the RDP client FreeRDP arises due to an operation being executed outside the buffer boundaries. Exploiting this vulnerability could allow a malicious actor to cause service failure...

CVE-2026-33542

A flaw was found in Incus, a system container and virtual machine manager. A remote attacker could exploit a lack of validation of image fingerprints when downloading from simplestreams image servers. This vulnerability, under specific conditions, could lead to image cache poisoning, allowing an...

DEBIAN-CVE-2026-33542

Incus is a system container and virtual machine manager. Prior to version 6.23.0, a lack of validation of the image fingerprint when downloading from simplestreams image servers opens the door to image cache poisoning and under very narrow circumstances exposes other tenants to running attacker...

CVE-2026-33542

Incus is a system container and virtual machine manager. Prior to version 6.23.0, a lack of validation of the image fingerprint when downloading from simplestreams image servers opens the door to image cache poisoning and under very narrow circumstances exposes other tenants to running attacker...

CVE-2026-34352

In TigerVNC before 1.16.2, Image.cxx in x0vncserver allows other users to observe or manipulate the screen contents, or cause an application crash, because of incorrect permissions...

CVE-2026-33542

Incus is a system container and virtual machine manager. Prior to version 6.23.0, a lack of validation of the image fingerprint when downloading from simplestreams image servers opens the door to image cache poisoning and under very narrow circumstances exposes other tenants to running attacker...