Security releases
Researcher credits in vendor advisories
Vendors name researchers in their own advisories. Find your line and claim it. It counts on your profile right away and gets a BugRater ID you can quote.
Vendor
-
Imgproxy CVE-2026-123616
imgproxy from 3.3.0 before 4.0.16 contains an unbounded memory allocation vulnerability in the ICO loader that fails to validate the data_size field. Attackers
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Imgproxy CVE-2026-123615
imgproxy 3.3.0 before 4.0.17 contains an out-of-bounds heap read and write in the ICO loader's BMP header reconstruction (vips_foreign_load_ico_header in vips/i
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Imgproxy CVE-2026-123614
imgproxy from 4.0.0 before 4.0.16 contains an integer overflow in the ICO loader that allows remote attackers to trigger a heap buffer overflow via a crafted da
3 CVEs and 3 credit lines. None claimed yet.
0 of 3 credit lines claimed Claim credit