CVE-2026-74922

The Document Gallery WordPress plugin through 5.1.1 does not verify the signature on one of its unauthenticated webhook endpoints when no shared secret has been configured, which is the default state, allowing unauthenticated users to replace the thumbnail image the site publishes for any documen...

EUVD-2026-104099

The Document Gallery WordPress plugin through 5.1.1 does not verify the signature on one of its unauthenticated webhook endpoints when no shared secret has been configured, which is the default state, allowing unauthenticated users to replace the thumbnail image the site publishes for any documen...

PT-2026-117248

Name of the Vulnerable Software and Affected Versions Document Gallery WordPress plugin versions prior to 5.1.2 Description The plugin fails to verify the signature on an unauthenticated webhook endpoint when no shared secret is configured, which is the default setting. This allows unauthenticate...

CVE-2026-74922: Insufficient Verification of Data Authenticity

The Document Gallery WordPress plugin through 5.1.1 does not verify the signature on one of its unauthenticated webhook endpoints when no shared secret has been configured, which is the default state, allowing unauthenticated users to replace the thumbnail image the site publishes for any documen...

Astra Linux – Vulnerability in imagemagick

A flaw was discovered in ImageMagick version 7.0.11. In this version, an integer overflow in the WriteTHUMBNAILImage function in the coders/thumbnail.c file may lead to undefined behavior when processing a specially crafted image file submitted by an attacker. The greatest threat posed by this...

JLSEC-2026-887

A flaw was found in ImageMagick in versions 7.0.11, where an integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c may trigger undefined behavior via a crafted image file that is submitted by an attacker and processed by an application using ImageMagick. The highest threat from this...

Directory Traversal

Overview microweber/microweber is a new generation CMS with drag and drop. Affected versions of this package are vulnerable to Directory Traversal via the userfilespath function of the API endpoint /apinosession/thumbnailimg when processing the cachepathrelative argument. An attacker can access o...

CVE-2026-12198

CVE-2026-12198 affects Microweber up to 2.0.20. The vulnerability is in the API Endpoint file /api_nosession/thumbnail_img, specifically the function userfiles_path, where manipulating the argument cache_path_relative can cause a path traversal. It is possible to launch the attack remotely, and p...

CVE-2026-12198 Microweber API Endpoint thumbnail_img userfiles_path path traversal

A weakness has been identified in Microweber up to 2.0.20. This affects the function userfilespath of the file /apinosession/thumbnailimg of the component API Endpoint. Executing a manipulation of the argument cachepathrelative can lead to path traversal. It is possible to launch the attack...

CVE-2026-12198 Microweber API Endpoint thumbnail_img userfiles_path path traversal

A weakness has been identified in Microweber up to 2.0.20. This affects the function userfilespath of the file /apinosession/thumbnailimg of the component API Endpoint. Executing a manipulation of the argument cachepathrelative can lead to path traversal. It is possible to launch the attack...

CLSA-2025-1760019285 Fix CVE(s): CVE-2025-55212

SECURITY UPDATE: crash triggered by passing a colon to montage -geometry - debian/patches/CVE-2025-55212.patch: Fix invalid height and width checks in ThumbnailImage using MagickSafeReciprocal - CVE-2025-55212...

EUVD-2024-47560

Malicious code in bioql PyPI...

CLSA-2025-1759420505 Fix CVE(s): CVE-2025-55212

SECURITY UPDATE: denial of Service vulnerability due to zero dimensions crash - debian/patches/CVE-2025-55212.patch: Fix invalid width or height checks in ThumbnailImage method and add safe reciprocal function to avoid division by zero - CVE-2025-55212...

CLSA-2025-1758195721 ImageMagick: Fix of 4 CVEs

CVE-2025-55154: fix integer overflows in MNG magnification - CVE-2025-55212: fix division by zero in ThumbnailImage - CVE-2025-57803: fix 32-bit integer overflow when writing BMP scanline stride - CVE-2025-55298: fix format string bug leading to RCE or heap overflow...

CVE-2025-55212 ImageMagick affected by divide-by-zero in ThumbnailImage via montage -geometry ":" leads to crash

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-28 and 7.1.2-2, passing a geometry string containing only a colon ":" to montage -geometry leads GetGeometry to set width/height to 0. Later, ThumbnailImage divides by these zer...

CVE-2025-55212 ImageMagick affected by divide-by-zero in ThumbnailImage via montage -geometry ":" leads to crash

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-28 and 7.1.2-2, passing a geometry string containing only a colon ":" to montage -geometry leads GetGeometry to set width/height to 0. Later, ThumbnailImage divides by these zer...

Division by zero

Overview Affected versions of this package are vulnerable to Division by zero via the ThumbnailImage function in MagickCore/resize.c. An attacker can cause a crash by submitting specially crafted input that triggers a division by zero. Remediation A fix was pushed into the master branch but not y...

CVE-2025-55212 ImageMagick affected by divide-by-zero in ThumbnailImage via montage -geometry ":" leads to crash

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-28 and 7.1.2-2, passing a geometry string containing only a colon ":" to montage -geometry leads GetGeometry to set width/height to 0. Later, ThumbnailImage divides by these zer...

ImageMagick affected by divide-by-zero in ThumbnailImage via montage -geometry ":" leads to crash

Summary Passing a geometry string containing only a colon ":" to montage -geometry leads GetGeometry to set width/height to 0. Later, ThumbnailImage divides by these zero dimensions, triggering a crash SIGFPE/abort, resulting in a denial of service. Details Root Cause 1. montage -geometry ":"...

CVE-2024-6465

The WP Links Page plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wplfajaxupdatescreenshots' function in all versions up to, and including, 4.9.5. This makes it possible for authenticated attackers, with Subscriber-level access and...