A vulnerability in the file-ico plugin of GIMP allows improper validation of the palette count parameter when processing specially crafted ICO image files. This leads to a heap out-of-bounds read, which can cause the application to crash, resulting in denial of service or limited disclosure of heap memory contents. The issue affects multiple specific versions of GIMP. The CVSS score is 6.1, indicating a medium severity level.
A heap out-of-bounds read vulnerability exists in the file-pvr plugin of GIMP when processing specially crafted PVR image files. This flaw can cause the application to crash, resulting in denial of service or limited disclosure of heap memory contents. The issue affects multiple specific versions of GIMP. The CVSS score is 6.1, indicating medium severity.
Ceph versions prior to 20.2.4 and 19.2.6 contain a vulnerability in the Monitor subscription handler that allows improper authorization to the configuration-key store. This flaw permits any CephX user with only 'mon allow r' capabilities to read sensitive secrets, including disk-encryption passphrases and SSH private keys used by cephadm. Exploiting this vulnerability can lead to full cluster and host compromise. The issue is fixed in versions 20.2.4 and 19.2.6.
An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The vulnerability arises because the exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec(), allowing any authenticated user with View Events permission to execute arbitrary OS commands on the server. This affects multiple specific versions of ZoneMinder. The CVSS score is 8.8, indicating a high severity impact on confidentiality, integrity, and availability.
NLTK versions through 3.10.3 contain a path traversal vulnerability in certain model-artifact APIs. This flaw allows bypassing path security enforcement by using raw file operations on user-controlled paths. Specifically, the vulnerability affects TransitionParser, AveragedPerceptron, PerceptronTagger, and maxent parameter APIs when pathsec is enabled, enabling attackers to read or write files outside the intended sandbox.
CVE-2026-77682 is a medium severity vulnerability in the Epiphany browser that involves triggering form autofill using a user message. It affects multiple specific versions of the Epiphany browser. No CVSS score is provided, and no known exploits are reported in the wild.
A vulnerability in the Seattle FilmWorks plugin of GIMP allows an attacker to cause a denial of service by triggering an unbounded stack allocation when processing a specially crafted SFW image file. This occurs due to the plugin allocating a Variable-Length Array (VLA) on the stack without proper integer overflow checks, leading to an application crash.
A stack-based buffer overflow vulnerability exists in the Dia diagram editor when processing Network Bus objects from Dia XML project files. The vulnerability arises because the number of bus handles is read from the file without validating an upper bound, leading to excessive stack allocation and potential stack overflow when moving a bus handle. This can cause a crash (SIGSEGV) and possible corruption of stack frames or return addresses. The issue affects Dia version 0.98.0 and earlier versions containing the vulnerable code. Exploitation requires opening a crafted .dia file and manipulating bus handles.
A vulnerability in the file-xwd plugin of GIMP allows a heap out-of-bounds read when processing specially crafted XWD image files. The flaw arises because the plugin validates image width and bytes-per-line parameters independently, failing to ensure their combined values match the allocated buffer size. This can cause application crashes resulting in denial of service or limited disclosure of heap memory contents in the output image. The issue affects multiple specific versions of GIMP. The CVSS score is 4.4, indicating medium severity.
GitHub CLI (gh) versions 2.28.0 through 2.97.0 have a security issue where the local listener created by the codespace ports forward feature binds to all network interfaces by default. This allows services running in a Codespace to be reachable via the user's non-loopback local IP addresses by other hosts on the same network, even if the Codespaces port itself remains private. The issue requires a network-adjacent attacker to access the victim's machine while port forwarding is active. The vulnerability is fixed in version 2.98.0.
OpenEXR versions through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 contain a vulnerability in the OpenEXRUtil library where the SampleCountChannel::row() API returns an out-of-bounds pointer if a deep image has a non-zero dataWindow origin. This can cause out-of-bounds reads leading to process crashes or potential exposure of adjacent heap memory. The issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.
rclone versions from 1.72.0 through 1.74.4 contain multiple denial-of-service vulnerabilities in the archive backend's SquashFS parser. These vulnerabilities arise from improper validation of attacker-controlled superblock and metadata values, leading to crashes or sustained CPU consumption when processing malicious SquashFS images. The issues are fixed in version 1.75.0.
rclone versions before 1.75.0 have a vulnerability where the pprof debug handler is mounted as its own router route, bypassing the main handler's fail-closed authentication. This allows unauthenticated attackers to access the /debug/pprof/cmdline endpoint and retrieve the full process command line arguments, which may include backend credentials.
rclone versions before v1.75.0 expose full Go stack traces in RC API error responses when panics occur. This can leak sensitive internal information such as file paths, module versions, goroutine states, and memory addresses. The vulnerability has a medium severity with a CVSS score of 2.7.
rclone versions before v1.75.0 contain a denial of service vulnerability in the WebDAV TUS creation handler. This flaw occurs because the handler dereferences a nil response before checking for transport errors. A malicious or compromised configured endpoint can exploit this by resetting connections during TUS uploads, causing a panic that terminates unrecovered goroutines and halts unrelated work in long-lived processes. The vulnerability has a medium severity with a CVSS score of 5.3.
rclone versions before v1.75.0 have a vulnerability where they fail to reject transport downgrades during redirect handling. This flaw allows Basic authorization and Cookie headers to be replayed over plaintext HTTP after HTTPS-to-HTTP redirects on the same host. An attacker positioned on the network path can capture and reuse these credentials to perform WebDAV operations with the compromised account's permissions.
rclone versions before v1.75.0 do not properly sanitize IBM IAM bearer tokens and SSE-C encryption keys during S3 redirect callbacks. This flaw allows credentials to be preserved across scheme or host changes, enabling attackers who can observe network traffic from a trusted endpoint to capture reusable IBM IAM tokens or SSE-C keys. The vulnerability has a medium severity with a CVSS score of 5.3.
rclone serve s3 versions before 1.74.4 contain a path traversal vulnerability that allows attackers to read and overwrite files outside the intended bucket namespace by using dot-dot segments in S3 object keys. This enables access to root-level files in the serve root directory.
rclone versions before 1.74.4 have a vulnerability where the X-Amz-Security-Token header is not removed when an S3 redirect changes the scheme from HTTPS to HTTP on the same host. This can allow attackers who intercept the downgraded HTTP traffic to capture AWS STS session tokens. The vulnerability has a medium severity with a CVSS score of 3.1.
rclone versions before 1.74.4 have a vulnerability in the local backend where special permission bits (setuid/setgid) are not properly masked when applying source-supplied mode metadata. This allows attackers copying files with metadata preservation from untrusted remotes to plant setuid binaries that could escalate privileges if rclone runs with elevated rights.