Security Vulnerabilities
A flaw was found in GIMP. A signed integer overflow vulnerability exists in the `file-fli` plugin when processing FLI image files. This occurs due to an incorrect calculation during memory allocation for image buffers, where the multiplication of image width and height can exceed the maximum integer value. A remote attacker could exploit this by tricking a user into opening a specially crafted FLI file, leading to the application crashing and resulting in a denial of service.
CVSS Score
5.5
EPSS Score
0.003
Published
2026-08-10
Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs.
Users are recommended to upgrade to version 5.9.1, which fixes this issue.
CVSS Score
7.5
EPSS Score
0.005
Published
2026-08-10
TLS hostname verification issue in Apache Ranger Client Code in versions <= 2.8.0.
Users are recommended to upgrade to version 2.9.0, which fixes this issue.
CVSS Score
7.5
EPSS Score
0.003
Published
2026-08-10
Logs contain replayable JWT tokens in Apache Ranger versions <= 2.8.0
Users are recommended to upgrade to version 2.9.0, which fixes this issue.
CVSS Score
6.5
EPSS Score
0.004
Published
2026-08-10
UnixAuth lacks brute-force protection in Apache Ranger versions <= 2.8.0.
Note: UnixAuth is NOT a recommended option for production deployments.
Users are recommended to upgrade to version 2.9.0, which fixes this issue.
CVSS Score
7.3
EPSS Score
0.003
Published
2026-08-10
SQL Injection vulnerability vulnerability in Apache Ranger.
This issue affects .
Users are recommended to upgrade to version 2.9.0, which fixes the issue.
CVSS Score
9.8
EPSS Score
0.004
Published
2026-08-10
Privilege Escalation via URL Parameter is reported in Apache Ranger versions <= 2.8.0.
Users are recommended to upgrade to version 2.9.0, which fixes this issue.
CVSS Score
9.8
EPSS Score
0.004
Published
2026-08-10
Remote Code Execution via JDBC URL Injection in Apache Ranger <= 2.8.0
Users are recommended to upgrade to version 2.9.0, which fixes this issue.
CVSS Score
9.8
EPSS Score
0.007
Published
2026-08-10
Remote Code Execution via Arbitrary Class Instantiation in plugin-schema-registry component in Apache Ranger <= 2.8.0.
Users are recommended to upgrade to version 2.9.0, which fixes this issue.
CVSS Score
9.8
EPSS Score
0.007
Published
2026-08-10
Remote Code Execution Vulnerability in GraalScriptEngineCreator in Apache Ranger <= 2.8.0
Users are recommended to upgrade to version 2.9.0, which fixes this issue.
CVSS Score
9.8
EPSS Score
0.006
Published
2026-08-10