CVE-2026-108093Medium· 5.5▾ SunlitA flaw was found in GIMP. The XCF loader processes image-simulation-intent and image-simulation-bpc parasites without ensuring the parasite data is present before dereferencing it. Opening a specially crafted XCF file with a zero-size si…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 30.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 11.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.1%
Last analysed / modified upstream
A flaw was found in GIMP. The XCF loader processes image-simulation-intent and image-simulation-bpc parasites without ensuring the parasite data is present before dereferencing it. Opening a specially crafted XCF file with a zero-size simulation parasite can cause a NULL pointer dereference and crash the GIMP application.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-106072Medium· 6.7nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)
CVE-2026-105483High· 7.4nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)
CVE-2026-106073Low· 3.3nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)
CVE-2026-106069High· 7.4nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)
CVE-2026-106074Medium· 4.8nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)
CVE-2026-105481Medium· 6.5nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)