7555 matches found
EUVD-2026-51612
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, fileloader decodes percent-encoded path segments after its root-boundary validation, allowing traversal outside FILELOADERROOTPATH through watermark or frame filter input. This issue is fixed in 7.8.0...
CVE-2026-53502
Thumbor (open-source image thumbnail service by globo.com) is affected by a path traversal in file_loader prior to version 7.8.0. The issue occurs because file_loader decodes percent-encoded path segments after root-boundary validation, allowing traversal outside FILE_LOADER_ROOT_PATH via waterma...
CVE-2026-53502 Thumbor has path traversal via post-validation URL decoding bypass in file_loader
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, fileloader decodes percent-encoded path segments after its root-boundary validation, allowing traversal outside FILELOADERROOTPATH through watermark or frame filter input. This issue is fixed in 7.8.0...
CVE-2026-53502 Thumbor has path traversal via post-validation URL decoding bypass in file_loader
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, fileloader decodes percent-encoded path segments after its root-boundary validation, allowing traversal outside FILELOADERROOTPATH through watermark or frame filter input. This issue is fixed in 7.8.0...
CVE-2026-53502 Thumbor has path traversal via post-validation URL decoding bypass in file_loader
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, fileloader decodes percent-encoded path segments after its root-boundary validation, allowing traversal outside FILELOADERROOTPATH through watermark or frame filter input. This issue is fixed in 7.8.0...
Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot
Summary The ALLOWEDSOURCES configuration is meant to restrict which hosts Thumbor's HTTP loader may fetch images from. Plain-string entries in that list the overwhelming majority of real-world and documented configurations are passed directly to re.match without escaping. Because . is a regex...
HollowFrame Loader Deploys Matryoshka Backdoor in Spear-Phishing Attack on Law Firm
Cybersecurity researchers have shed light on a previously undocumented Go-based loader framework called HollowFrame and a Rust-based malware family tracked as Matryoshka. According to Blackpoint Cyber, the intrusion sequence begins with a spear-phishing message containing a link to an encrypted...
Chromium: CVE-2026-17783 Inappropriate implementation in Loader
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
Chromium: CVE-2026-17661 Use after free in Loader
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
Chromium: CVE-2026-17664 Insufficient validation of untrusted input in Loader
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
SUSE CVE-2026-17661
Use after free in Loader in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...
SUSE CVE-2026-17664
Insufficient validation of untrusted input in Loader in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. Chromium security severity: High...
SUSE CVE-2026-17783
Inappropriate implementation in Loader in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...
KLA91185 Multiple vulnerabilities in Microsoft Browser
Multiple vulnerabilities were found in Microsoft Browser. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, obtain sensitive information, spoof user interface. Below is a complete list of vulnerabilities: 1. A remot...
PT-2026-66839
Name of the Vulnerable Software and Affected Versions Thumbor versions prior to 7.8.0 Description An issue exists in the file loader where percent-encoded path segments are decoded after the root-boundary validation. This occurs because the unquote function is applied to the file path after the...
CVE-2026-17783
An inappropriate implementation flaw was found in the Loader component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=513532735...
CVE-2026-17661
An use after free flaw was found in the Loader component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=497451790...
CVE-2026-17664
An insufficient validation of untrusted input flaw was found in the Loader component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=500554346...
OctLurk and SilkLurk: newly identified tailored backdoors in cyber-espionage campaign in Central Asia
Introduction We have been tracking two new backdoors, OctLurk and SilkLurk , observed in attacks against government organizations primarily in Central Asia since January 2025. Identified victims are located in Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, and the Syrian Arab...
