{"kind": "product", "path": "vulns/debian-14/gimp", "name": "gimp", "product": "gimp", "ecosystem": "Debian:14", "items": [{"id": "CVE-2026-92183", "noindex": false, "published": "2026-10-21T17:18:13.162Z", "modified": "2026-10-23T11:06:22.762Z", "cvss": 7.8, "cvss_vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00363, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-92183", "title": "GIMP APNG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability", "description": "GIMP APNG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of APNG files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29400.", "references": ["https://www.zerodayinitiative.com/advisories/ZDI-26-713/", "https://gitlab.gnome.org/GNOME/gimp/-/commit/175e28961a4679be8762a2d4d5a297faa82aebd9", "https://nvd.nist.gov/vuln/detail/CVE-2026-92183"], "fixes": ["3.2.6-1"], "products": [{"name": "gimp", "path": "vulns/debian-14/gimp", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-112261", "noindex": false, "published": "2026-10-19T21:37:25.644Z", "modified": "2026-10-22T10:19:08.691Z", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00136, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-112261", "title": "Gimp: gimp: use-after-free in xcf loader via prop_selected_path", "description": "A flaw was found in GIMP. Opening a crafted XCF that selects a path and then fails to load that path can cause a use-after-free in the main process, leading to a crash and potentially arbitrary code execution.", "references": ["https://access.redhat.com/security/cve/CVE-2026-112261", "https://bugzilla.redhat.com/show_bug.cgi?id=2555748", "https://nvd.nist.gov/vuln/detail/CVE-2026-112261"], "fixes": [], "products": [{"name": "gimp", "path": "vulns/debian-14/gimp", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-112258", "noindex": false, "published": "2026-10-19T21:37:20.179Z", "modified": "2026-10-21T20:45:39.972Z", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00136, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-112258", "title": "Gimp: gimp: use-after-free in xcf loader via prop_linked and prop_selection on channels", "description": "A flaw was found in GIMP. The XCF loader can leave a dangling pointer in the linked-channels list when a linked channel is later destroyed via a selection property. Opening a crafted XCF file can cause a use-after-free in the main GIMP process, leading to a crash and potentially arbitrary code execution.", "references": ["https://access.redhat.com/security/cve/CVE-2026-112258", "https://bugzilla.redhat.com/show_bug.cgi?id=2555588", "https://nvd.nist.gov/vuln/detail/CVE-2026-112258"], "fixes": [], "products": [{"name": "gimp", "path": "vulns/debian-14/gimp", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-112257", "noindex": false, "published": "2026-10-19T21:37:19.467Z", "modified": "2026-10-21T20:09:47.104Z", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00136, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-112257", "title": "Gimp: gimp: heap out-of-bounds read/write in psd thumbnail loader (load_resource_1033)", "description": "A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail can cause a heap out-of-bounds read and write in the plug-in process, leading to a crash and potentially arbitrary code execution when the victim browses or opens the file.", "references": ["https://access.redhat.com/security/cve/CVE-2026-112257", "https://bugzilla.redhat.com/show_bug.cgi?id=2555574", "https://nvd.nist.gov/vuln/detail/CVE-2026-112257"], "fixes": [], "products": [{"name": "gimp", "path": "vulns/debian-14/gimp", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-112260", "noindex": false, "published": "2026-10-19T19:24:49.017Z", "modified": "2026-10-21T20:09:57.355Z", "cvss": 7.1, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H", "severity": "high", "epss": 0.00157, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-112260", "title": "Gimp: gimp: heap out-of-bounds read in xcf text-layer parasite parsing", "description": "A flaw was found in GIMP. Opening a crafted XCF with a malformed text-layer parasite can cause a heap out-of-bounds read, disclosing adjacent heap data into layer text and causing denial of service.", "references": ["https://access.redhat.com/security/cve/CVE-2026-112260", "https://bugzilla.redhat.com/show_bug.cgi?id=2555730", "https://nvd.nist.gov/vuln/detail/CVE-2026-112260"], "fixes": [], "products": [{"name": "gimp", "path": "vulns/debian-14/gimp", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-112259", "noindex": false, "published": "2026-10-19T18:42:52.539Z", "modified": "2026-10-22T20:58:08.166Z", "cvss": 5.5, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00108, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-112259", "title": "Gimp: gimp: null pointer dereference in swatchbooker (sbz) palette import", "description": "A flaw was found in GIMP. Importing a crafted SBZ palette without a color-model attribute can cause a NULL pointer dereference during string comparison, resulting in denial of service of the GIMP application.", "references": ["https://access.redhat.com/security/cve/CVE-2026-112259", "https://bugzilla.redhat.com/show_bug.cgi?id=2555595", "https://nvd.nist.gov/vuln/detail/CVE-2026-112259"], "fixes": [], "products": [{"name": "gimp", "path": "vulns/debian-14/gimp", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-62438", "noindex": false, "published": "2026-10-16T21:56:18.452Z", "modified": "2026-10-19T16:40:42.906Z", "cvss": 6.1, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "severity": "medium", "epss": 0.00119, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-62438", "title": "Gimp: gimp: paa integer overflow out-of-bounds read", "description": "A flaw was found in GIMP. An attacker can cause a Denial of Service (DoS) or potentially disclose sensitive memory contents by convincing a user to open or preview a specially crafted Bohemia Interactive (PAA) texture file. Due to an integer overflow when calculating image dimensions during file decompression, the application allocates an undersized memory buffer. Subsequent processing reads memory past the buffer boundary, terminating the plug-in process unexpectedly.", "references": ["https://access.redhat.com/security/cve/CVE-2026-62438", "https://bugzilla.redhat.com/show_bug.cgi?id=2554456", "https://gitlab.gnome.org/GNOME/gimp/-/issues/16313"], "fixes": ["3.2.6-1"], "products": [{"name": "gimp", "path": "vulns/debian-14/gimp", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-62439", "noindex": false, "published": "2026-10-16T21:54:49.538Z", "modified": "2026-10-20T20:42:41.359Z", "cvss": 7, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00184, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-62439", "title": "Gimp: gimp: file-pvr plug-in pvr file parsing integer overflow heap-based buffer overflow vulnerability", "description": "A flaw was found in GIMP. An integer overflow occurs in the file-pvr plug-in when calculating memory buffer sizes for image dimensions. By tricking a user into opening or previewing a specially crafted PowerVR (.pvr) file, an attacker can trigger a heap-based buffer overflow, potentially leading to arbitrary code execution or a Denial of Service (DoS) via an application crash.", "references": ["https://access.redhat.com/security/cve/CVE-2026-62439", "https://bugzilla.redhat.com/show_bug.cgi?id=2554464", "https://gitlab.gnome.org/GNOME/gimp/-/issues/16314"], "fixes": ["3.2.6-1"], "products": [{"name": "gimp", "path": "vulns/debian-14/gimp", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-108093", "noindex": false, "published": "2026-10-09T16:45:57.667Z", "modified": "2026-10-14T02:01:26.993Z", "cvss": 5.5, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00105, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-108093", "title": "Gimp: gimp: denial of service via null pointer dereference in xcf simulation parasite loading", "description": "A flaw was found in GIMP. The XCF loader processes image-simulation-intent and image-simulation-bpc parasites without ensuring the parasite data is present before dereferencing it. Opening a specially crafted XCF file with a zero-size simulation parasite can cause a NULL pointer dereference and crash the GIMP application.", "references": ["https://access.redhat.com/security/cve/CVE-2026-108093", "https://bugzilla.redhat.com/show_bug.cgi?id=2548607", "https://nvd.nist.gov/vuln/detail/CVE-2026-108093"], "fixes": [], "products": [{"name": "gimp", "path": "vulns/debian-14/gimp", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-106067", "noindex": false, "published": "2026-10-07T17:36:19.551Z", "modified": "2026-10-07T18:04:41.571Z", "cvss": 6.3, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H", "severity": "medium", "epss": 0.00111, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-106067", "title": "Gimp: gimp: heap buffer overflow in hot color filter on oversized image", "description": "A heap-based buffer overflow was found in GIMP’s Hot color filter plug-in. For very large images, a pixel buffer is allocated using overflowing 32-bit width * height (and related) arithmetic while the filter’s pixel access path uses the true image size, after integer overflow in the allocation size", "references": ["https://access.redhat.com/security/cve/CVE-2026-106067", "https://bugzilla.redhat.com/show_bug.cgi?id=2547461", "https://nvd.nist.gov/vuln/detail/CVE-2026-106067"], "fixes": [], "products": [{"name": "gimp", "path": "vulns/debian-14/gimp", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-106066", "noindex": false, "published": "2026-10-07T17:36:16.209Z", "modified": "2026-10-07T19:24:30.471Z", "cvss": 6.3, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H", "severity": "medium", "epss": 0.00111, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-106066", "title": "Gimp: gimp: heap buffer overflow in raw data export on oversized image dimensions", "description": "A heap-based buffer overflow was found in GIMP’s raw data export plug-in. When exporting very large images, g_malloc() sizing based on overflowing width * height * bytes-per-pixel can allocate far less memory than GEGL reads or writes during export, following integer overflow", "references": ["https://access.redhat.com/security/cve/CVE-2026-106066", "https://bugzilla.redhat.com/show_bug.cgi?id=2547459", "https://nvd.nist.gov/vuln/detail/CVE-2026-106066"], "fixes": [], "products": [{"name": "gimp", "path": "vulns/debian-14/gimp", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-106065", "noindex": false, "published": "2026-10-07T16:55:26.095Z", "modified": "2026-10-07T17:36:00.502Z", "cvss": 6.3, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H", "severity": "medium", "epss": 0.00119, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-106065", "title": "Gimp: gimp: heap buffer overflow in pcx export on oversized image dimensions", "description": "A heap-based buffer overflow was found in GIMP’s PCX export plug-in. For images with extremely large width and height, buffer allocation uses overflowing 32-bit width * height arithmetic while subsequent GEGL operations use the full extent, after integer overflow in size calculation", "references": ["https://access.redhat.com/security/cve/CVE-2026-106065", "https://bugzilla.redhat.com/show_bug.cgi?id=2547456", "https://nvd.nist.gov/vuln/detail/CVE-2026-106065"], "fixes": [], "products": [{"name": "gimp", "path": "vulns/debian-14/gimp", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-106064", "noindex": false, "published": "2026-10-07T14:34:40.565Z", "modified": "2026-10-07T19:25:37.549Z", "cvss": 6.3, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H", "severity": "medium", "epss": 0.00111, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-106064", "title": "Gimp: gimp: heap buffer overflow in gif export on oversized image dimensions", "description": "A heap-based buffer overflow was found in GIMP’s GIF export plug-in. Exporting an image with very large width and height can cause 32-bit overflow when computing the pixel buffer size. The plug-in allocates a buffer based on the wrapped value while GEGL writes using the true image extent, rooted in integer overflow", "references": ["https://access.redhat.com/security/cve/CVE-2026-106064", "https://bugzilla.redhat.com/show_bug.cgi?id=2547446", "https://nvd.nist.gov/vuln/detail/CVE-2026-106064"], "fixes": [], "products": [{"name": "gimp", "path": "vulns/debian-14/gimp", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-106061", "noindex": false, "published": "2026-10-07T02:36:51.091Z", "modified": "2026-10-09T02:04:17.673Z", "cvss": 5.5, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00105, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-106061", "title": "Gimp: gimp: heap buffer over-read in x cursor (xmc) thumbnail loader on crafted file", "description": "A flaw was found in GIMP’s X cursor (XMC) thumbnail loader. When GIMP generates a thumbnail for a crafted XMC file, it allocates a pixel buffer using a width * height size computed in 32-bit signed arithmetic. If that product overflows, the allocation is smaller than the true image extent. A subsequent GEGL buffer read uses the unwrapped dimensions and performs an out-of-bounds read on the heap, after integer overflow in the size calculation. This can crash GIMP or corrupt process memory.", "references": ["https://access.redhat.com/security/cve/CVE-2026-106061", "https://bugzilla.redhat.com/show_bug.cgi?id=2546640", "https://nvd.nist.gov/vuln/detail/CVE-2026-106061"], "fixes": [], "products": [{"name": "gimp", "path": "vulns/debian-14/gimp", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-106062", "noindex": false, "published": "2026-10-06T20:02:52.466Z", "modified": "2026-10-16T18:55:10.354Z", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.0015, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-106062", "title": "Gimp: gimp: heap buffer overflow in dds loader on crafted directdraw surface file", "description": "A heap-based buffer overflow was found in GIMP’s DirectDraw Surface (DDS) loader. When loading a crafted DDS image, buffer sizes derived from width, height, and pitch can be computed using 32-bit arithmetic that overflows. The allocated buffer is too small for the amount of pixel data written through GEGL, following integer overflow in size calculations. This may allow heap corruption and, in the worst case, arbitrary code execution in the context of the GIMP process.", "references": ["https://access.redhat.com/security/cve/CVE-2026-106062", "https://bugzilla.redhat.com/show_bug.cgi?id=2546654", "https://nvd.nist.gov/vuln/detail/CVE-2026-106062"], "fixes": [], "products": [{"name": "gimp", "path": "vulns/debian-14/gimp", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-106063", "noindex": false, "published": "2026-10-06T19:34:29.710Z", "modified": "2026-10-08T07:53:55.145Z", "cvss": 6.3, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H", "severity": "medium", "epss": 0.00119, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-106063", "title": "Gimp: gimp: heap buffer overflow in dicom export on oversized image dimensions", "description": "A heap-based buffer overflow was found in GIMP’s DICOM export plug-in. When exporting an image with extremely large width and height, the export path allocates a buffer using a 32-bit width * height (and bytes-per-pixel) product that can overflow. GEGL then writes the full uncompressed extent into the undersized buffer, after integer overflow in the allocation size", "references": ["https://access.redhat.com/security/cve/CVE-2026-106063", "https://bugzilla.redhat.com/show_bug.cgi?id=2546668", "https://nvd.nist.gov/vuln/detail/CVE-2026-106063"], "fixes": [], "products": [{"name": "gimp", "path": "vulns/debian-14/gimp", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-96544", "noindex": false, "published": "2026-09-29T00:00:00Z", "modified": "2026-10-17T13:01:19.937378177Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-96544", "title": "UBUNTU-CVE-2026-96544", "description": "[Unknown description]", "references": ["https://ubuntu.com/security/CVE-2026-96544", "https://www.cve.org/CVERecord?id=CVE-2026-96544", "https://bugzilla.redhat.com/show_bug.cgi?id=2539572"], "fixes": [], "products": [{"name": "gimp", "path": "vulns/debian-14/gimp", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-96543", "noindex": false, "published": "2026-09-29T00:00:00Z", "modified": "2026-10-17T13:01:19.709743292Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-96543", "title": "UBUNTU-CVE-2026-96543", "description": "[Unknown description]", "references": ["https://ubuntu.com/security/CVE-2026-96543", "https://www.cve.org/CVERecord?id=CVE-2026-96543", "https://bugzilla.redhat.com/show_bug.cgi?id=2539392"], "fixes": ["3.2.6-1"], "products": [{"name": "gimp", "path": "vulns/debian-14/gimp", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-97185", "noindex": false, "published": "2026-09-24T08:30:29.489Z", "modified": "2026-10-19T12:20:03.875Z", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00135, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-97185", "title": "Gimp: gimp: out-of-bounds write in gimpressionist plugin via crafted preset file", "description": "A flaw was found in GIMP. When processing a specially crafted GIMPressionist preset file, the plug-in does not properly validate vector indices before writing into fixed-size arrays. This can lead to an out-of-bounds write, corrupting memory. An attacker could exploit this by convincing a user to load a malicious preset file, potentially causing a crash or enabling arbitrary code execution.", "references": ["https://access.redhat.com/errata/RHSA-2026:75575", "https://access.redhat.com/errata/RHSA-2026:84744", "https://access.redhat.com/security/cve/CVE-2026-97185"], "fixes": [], "products": [{"name": "gimp", "path": "vulns/debian-14/gimp", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-96546", "noindex": false, "published": "2026-09-23T18:29:08.538Z", "modified": "2026-09-25T17:56:03.542Z", "cvss": 2.5, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L", "severity": "low", "epss": 0.00115, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-96546", "title": "Gimp: gimp: one-byte out-of-bounds heap read in the uncompressed dds loader", "description": "A one-byte out-of-bounds heap read flaw was found in GIMP's uncompressed DDS image loader. When a user opens an uncompressed DDS image, the file-dds plug-in performs an unconditional one-byte look-ahead after processing the final pixel. This may cause the plug-in to crash if the byte immediately following the pixel buffer is inaccessible; no information disclosure or code execution has been demonstrated.", "references": ["https://access.redhat.com/security/cve/CVE-2026-96546", "https://bugzilla.redhat.com/show_bug.cgi?id=2539601", "https://gitlab.gnome.org/GNOME/gimp/-/work_items/16802"], "fixes": [], "products": [{"name": "gimp", "path": "vulns/debian-14/gimp", "ecosystem": "Debian:14"}]}], "total": 141, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 8, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "gimp", "path": "vulns/debian-14/gimp", "ecosystem": "Debian:14"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 18, "kev": 0}, "lastmod": "2026-10-23T11:06:22.762Z", "early_advisories": [], "license": "Puedes utilizar libremente la selección de PatchFirst y nuestras aportaciones (prioridades, alertas tempranas, textos, resúmenes y agregados) para tus propios fines, incluido el uso interno de tu empresa. La reventa, la distribución comercial y la creación masiva de réplicas de esta selección o de estas aportaciones requieren un acuerdo escrito con el operador. Siempre que uses o publiques la selección o nuestras aportaciones, cita a PatchFirst (https://patchfirst.dev/vulns/) con este enlace a la página del flujo de tu región. Los registros originales de fuentes abiertas siguen sujetos a sus respectivas licencias y condiciones. Estas condiciones no limitan tus derechos sobre los datos originales, que puedes obtener directamente de esas fuentes.", "terms_url": "https://patchfirst.dev/es/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst selecciona, normaliza y combina los registros; se pueden añadir resúmenes y traducciones. Las noticias incluyen un enlace a la fuente original en cada entrada.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Las licencias de las bases originales varían; consulta el catálogo de fuentes."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Puntuaciones públicas gratuitas; se solicita atribución (FIRST EPSS, puntuaciones generadas por Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}