Thumbor has Regex Denial of Service (ReDoS) in `convolution` filter
CVE-2026-53504
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the convolution filter regular expressio
#advisory
共收录 23634 条相关情报。
← 返回所有主题Thumbor convolution filter allows divide-by-zero in C extension leading to remote DoS
CVE-2026-53503
### Summary Thumbor's `filters:convolution(, , )` filter passes the user-controlled `` value to a C extension (`thumbor/
Thumbor convolution filter allows divide-by-zero in C extension leading to remote DoS
CVE-2026-53503
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:convolution(, , ) filt
Thumbor has HMAC validation bypass via multiple .replace() calls when removing URL signature
CVE-2026-53501
# HMAC validation bypass via multiple `.replace()` calls when removing URL signature ## Summary Thumbor’s HMAC validat
Thumbor has HMAC validation bypass via multiple .replace() calls when removing URL signature
CVE-2026-53501
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor’s HMAC validation can be bypasse
Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot
CVE-2026-53500
## Summary The `ALLOWED_SOURCES` configuration is meant to restrict which hosts Thumbor's HTTP loader may fetch images
Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot
CVE-2026-53500
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the ALLOWED_SOURCES configuration passes
Cleartext storage of sensitive information vulnerability in Johnson Controls XAAP Application on...
CVE-2026-34490
Cleartext storage of sensitive information vulnerability in Johnson Controls XAAP Application on Android allows an attac
Server-Side Request Forgery in the PDF export component in maalfer Pentestify before 1.1.0 allows...
CVE-2026-59231
Server-Side Request Forgery in the PDF export component in maalfer Pentestify before 1.1.0 allows authenticated users to
HCL iControl was affected by Auto complete Enabled vulnerabilities. It involves expose sensitive...
CVE-2026-56570
HCL iControl was affected by Auto complete Enabled vulnerabilities. It involves expose sensitive information such as: Va
Tenda W6-S 1.0.0.4(510) contains a stack-based buffer overflow vulnerability in the /goform...
CVE-2026-67822
Tenda W6-S 1.0.0.4(510) contains a stack-based buffer overflow vulnerability in the /goform/wifiSSIDset endpoint. The fu
Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in...
CVE-2026-58048
Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in root context.
HCL iControl was affected by Information Exposure Through Verbose Client-Side API Error Messages...
CVE-2026-56568
HCL iControl was affected by Information Exposure Through Verbose Client-Side API Error Messages vulnerabilities. It inv
Cross-site Scripting in the lead index view in Roskus Prospero Flow CRM before 5.3.7 allows...
CVE-2026-59232
Cross-site Scripting in the lead index view in Roskus Prospero Flow CRM before 5.3.7 allows authenticated users holding
HTTP Smuggling in cPanel allows potential leak of credentials.
CVE-2026-58047
HTTP Smuggling in cPanel allows potential leak of credentials.
HCL iControl was affected by Sensitive Data Exposure vulnerabilities. It involves the public...
CVE-2026-56569
HCL iControl was affected by Sensitive Data Exposure vulnerabilities. It involves the public exposure of internal config
Unrestricted upload of file with dangerous type vulnerability in Johnson Controls FM Systems...
CVE-2026-21662
Unrestricted upload of file with dangerous type vulnerability in Johnson Controls FM Systems Employee allows Using Malic
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in...
CVE-2026-34497
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Johnson Controls FM Syste
HCL iControl was affected by Improper Error Handling vulnerabilities. It involves Out of memory,...
CVE-2026-56571
HCL iControl was affected by Improper Error Handling vulnerabilities. It involves Out of memory, null pointer exceptions
LightFTP 2.3.1 contains a race condition vulnerability that allows remote attackers to crash the...
CVE-2026-67607
LightFTP 2.3.1 contains a race condition vulnerability that allows remote attackers to crash the server by racing a fres