UBUNTU-CVE-2026-82324

A flaw was found in the file-iff IFF/ILBM plugin in GIMP. When processing a specially crafted IFF/ILBM image file, the plugin does not properly validate the HAM row size and improperly handles cases where the number of color planes nPlanes is zero. This causes a row size mismatch that bypasses...

CVE-2026-82324

A flaw was found in the file-iff IFF/ILBM plugin in GIMP. When processing a specially crafted IFF/ILBM image file, the plugin does not properly validate the HAM row size and improperly handles cases where the number of color planes nPlanes is zero. This causes a row size mismatch that bypasses...

CVE-2026-82328

A flaw was found in the file-ico plugin in GIMP. When processing a specially crafted ICO image file, the plugin does not properly validate the usedclrs palette count parameter. This incorrect validation leads to improper memory bounds checking, resulting in a heap out-of-bounds read. This issue c...

CVE-2026-3423

The Envira Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the gallery 'description' configuration field in all versions up to, and including, 1.12.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

WordPress WP Data Access plugin <= 5.5.81 - SQL Injection vulnerability

SQL Injection vulnerability discovered by sequenceX0 in WordPress Plugin WP Data Access versions = 5.5.81...

WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.12 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Fluent Forms Pro Add On Pack versions = 6.2.12...

WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.12 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Fluent Forms Pro Add On Pack versions = 6.2.12...

WordPress LeadConnector plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin LeadConnector versions = 4.0.5...

WordPress SliceWP plugin <= 1.2.10 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin SliceWP versions = 1.2.10...

WordPress RegistrationMagic plugin <= 6.0.9.8 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by Emiliano Carrizo in WordPress Plugin RegistrationMagic versions = 6.0.9.8...

WordPress Smart Marketing SMS and Newsletters Forms plugin <= 5.1.24 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Supakiad S. m3ez in WordPress Plugin Smart Marketing SMS and Newsletters Forms versions = 5.1.24...

CVE-2026-82330 Gimp: heap out-of-bounds read in pvr vq (compressed) decoder due to missing bounds check

A flaw was found in the file-pvr plugin in GIMP. When processing a specially crafted PVR image file, the VQ compressed decoder does not properly perform memory bounds checking. This missing validation results in a heap out-of-bounds read. This issue can result in an application crash, leading to ...

CVE-2026-82330

A flaw was found in the file-pvr plugin in GIMP. When processing a specially crafted PVR image file, the VQ compressed decoder does not properly perform memory bounds checking. This missing validation results in a heap out-of-bounds read. This issue can result in an application crash, leading to ...

EUVD-2026-67739

A flaw was found in the file-pvr plugin in GIMP. When processing a specially crafted PVR image file, the VQ compressed decoder does not properly perform memory bounds checking. This missing validation results in a heap out-of-bounds read. This issue can result in an application crash, leading to ...

CVE-2026-82330

GIMP's file-pvr plugin contains a heap out-of-bounds read in the VQ (compressed) decoder due to a missing memory bounds check. When a specially crafted PVR image file is processed, the decoder reads beyond allocated heap memory, which can cause an application crash (denial of service) or a limite...

CVE-2026-82330

A flaw was found in the file-pvr plugin in GIMP. When processing a specially crafted PVR image file, the VQ compressed decoder does not properly perform memory bounds checking. This missing validation results in a heap out-of-bounds read. This issue can result in an application crash, leading to ...

CVE-2026-82220 WordPress Forminator plugin <= 1.57.1 - Other vulnerability Type vulnerability

Unauthenticated Other Vulnerability Type in Forminator = 1.57.1 versions...

CVE-2026-82220

CVE-2026-82220 affects the WordPress Forminator plugin in versions ≤ 1.57.1 . The vulnerability is classified as an unauthenticated issue of the generic "Other" type, rated MEDIUM (CVSS 5.3) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, indicating a low integrity impact exploitable over t...

CVE-2026-81767 WordPress Simple Payment plugin <= 2.5.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Simple Payment = 2.5.2 versions...

CVE-2026-81767

CVE-2026-81767 affects the WordPress Simple Payment plugin in versions 2.5.2 and earlier , presenting an unauthenticated Broken Access Control flaw. The CVSS 3.1 base score is 7.5 (HIGH) , with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, indicating an attacker requires no credentials or user...