CVE-2026-12491 Vllm: vllm: image exif rotation & png trns transparency not normalized, causing mismatch between model input and expectations

A flaw was found in vLLM, an open-source library for large language model inference. This vulnerability arises from improper handling of image metadata, specifically EXIF orientation and PNG transparency tRNS data, during image processing. When images are converted to RGB, transparency informatio...

CVE-2026-12491 Vllm: vllm: image exif rotation & png trns transparency not normalized, causing mismatch between model input and expectations

A flaw was found in vLLM, an open-source library for large language model inference. This vulnerability arises from improper handling of image metadata, specifically EXIF orientation and PNG transparency tRNS data, during image processing. When images are converted to RGB, transparency informatio...

CVE-2026-12491

CVE-2026-12491 affects the vLLM library used for LLM inference. The issue stems from improper handling of image metadata during image processing, specifically EXIF orientation and PNG transparency (tRNS). When converting images to RGB, transparency information may be discarded or remapped, causin...

CVE-2026-12491

A flaw was found in vLLM, an open-source library for large language model inference. This vulnerability arises from improper handling of image metadata, specifically EXIF orientation and PNG transparency tRNS data, during image processing. When images are converted to RGB, transparency informatio...

CVE-2026-12491

A flaw was found in vLLM, an open-source library for large language model inference. This vulnerability arises from improper handling of image metadata, specifically EXIF orientation and PNG transparency tRNS data, during image processing. When images are converted to RGB, transparency informatio...

PT-2026-50278

Name of the Vulnerable Software and Affected Versions vLLM affected versions not specified Description An issue exists in the image processing logic where image metadata is improperly handled. Specifically, the software fails to call ImageOps.exif transpose to normalize EXIF orientation, causing...

Updated libpng packages fix security vulnerabilities

LIBPNG has a use-after-free in pngsetPLTE, pngsettRNS and pngsethIST leading to corrupted chunk data and potential heap information disclosure. CVE-2026-34757 Chunk smuggling in push-mode APNG parser via unconsumed chunk body. CVE-2026-40930...

CLEANSTART-2026-GZ11549 Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations

Multiple security vulnerabilities affect the certificate-transparency-trillian-ctserver package. Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations. See references for individual vulnerability details...

Important: Red Hat Security Advisory: RHTAS 1.4 - GA Release of Model Transparency 1.0.1

The GA release of the RHTAS Model Transparency CLI image. For more details please visit the product documentation at https://access.redhat.com/documentation/en-us/redhattrustedartifactsigner/1.4 The RHTAS Model Transparency CLI image can be used to sign and verify AI/ML workloads...

SUSE-SU-2026:2057-1 Security update for libpng16

This update for libpng16 fixes the following issue: - CVE-2026-34757: information disclosure and data corruption due to use-after-free in pngsetPLTE, pngsettRNS and pngsethIST bsc1261957...

CVE-2026-44903 vulnerabilities

Vulnerabilities for packages: mc, jaeger, tempo, minio-object-browser, k8sgpt, telegraf, opentelemetry-collector-contrib, karma, datadog-agent, aws-otel-collector, opentelemetry-operator, node-problem-detector, certificate-transparency, metrics-server, splunk-otel-collector, trillian,...

CVE-2026-44903 vulnerabilities

Vulnerabilities for packages: trillian, amazon-cloudwatch-agent-operator-fips, node-problem-detector, google-cloud-otel-ops-collector, minio-object-browser-fips, mc-fips, minio, node-problem-detector-fips, istio, jaeger-fips, keda, opentelemetry-operator-fips, agentbeat, telegraf, mc, loki-fips,...

JLSEC-2026-498

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG Portable Network Graphics raster image files. From 1.0.9 to before 1.6.57, passing a pointer obtained from pnggetPLTE, pnggettRNS, or pnggethIST back into the corresponding setter on the same...

CVE-2026-41889 vulnerabilities

Vulnerabilities for packages: seaweedfs-rocksdb-fips, trillian, authentik, pgwatch, rke2-runtime-fips, spicedb, vault, step-ca, falcosidekick-fips, kubeflow-pipelines, ory-kratos, splunk-otel-collector, kube-bench, seaweedfs, sftpgo, kine, azure-service-operator-fips, gitlab-kas-fips,...

Google's Android Apps Get Public Verification to Stop Supply Chain Attacks

Google has announced expanded Binary Transparency for Android as a way to safeguard the ecosystem from supply chain attacks. "This new public ledger ensures the Google apps on your device are exactly what we intended to build and distribute," Google's product and security teams said. The initiati...

CLSA-2026-1778054892 libpng: Fix of 2 CVEs

CVE-2026-33416: fix use-after-free via pointer aliasing in pngsettRNS and pngsetPLTE - CVE-2026-33636: fix out-of-bounds read/write in ARM NEON palette expansion...

CLSA-2026-1777984435 libpng: Fix of 2 CVEs

CVE-2026-33416: fix use-after-free via pointer aliasing in pngsettRNS and pngsetPLTE - CVE-2026-33636: fix out-of-bounds read/write in ARM NEON palette expansion...

[SECURITY] Fedora 44 Update: libcgif-0.5.3-1.fc44

A fast and lightweight GIF encoder that can create GIF animations and images. Summary of the main features: - user-defined global or local color-palette with up to 256 colors limit of the GIF format - size-optimizations for GIF animations: - option to set a pixel to transparent if it has identica...

Metasploit Wrap-Up 04/25/2026

Check Method Visibility Metasploit has supported check methods for many years now. It’s not always desirable to jump straight into exploiting a vulnerability but instead to determine if the target is vulnerable. Metasploit tries to be very conservative with classifying a target as “vulnerable”...

SUSE-SU-2026:1602-1 Security update for libpng16

This update for libpng16 fixes the following issue: - CVE-2026-34757: information disclosure and data corruption due to use-after-free in pngsetPLTE, pngsettRNS and pngsethIST bsc1261957...