Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Vendor: lovell Clear all filters
TI-2026-78726 CVE-2026-114113

Bundled libvips flaws in Sharp expose apps to crafted images

Priority MEDIUM 43

Sharp before 0.35.0 bundles a version of libvips affected by multiple vulnerabilities (CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 and CVE-2026-69242) in its GIF, TIFF and VIPS image decoders.

CVSS 4.0HIGH 8.4 Local Low privileges No interaction EPSS 0.00107 Published 2026-10-21 Partial fix · 0.35.0 CWE-1395
TI-2026-78725 CVE-2026-114112

Sharp image library's bundled libheif allows remote code execution

Priority MEDIUM 40

Sharp before 0.35.4 bundles a vulnerable libheif dependency that allows attackers to achieve possible remote code execution on glibc-based Linux by supplying crafted images.

CVSS 4.0HIGH 8.9 Local No auth No interaction EPSS 0.00241 Published 2026-10-21 Partial fix · 0.35.4 CWE-122
TI-2026-78724 CVE-2026-114111

Use after free in sharp's bundled librsvg allows code execution

Priority LOW 39

sharp before 0.35.5 bundles a librsvg dependency affected by a memory-related vulnerability (CVE-2026-96889) that, under certain runtime-specific conditions, can lead to code execution on glibc-based Linux.

CVSS 4.0HIGH 8.9 Local No auth No interaction EPSS 0.00129 Published 2026-10-21 Fixed in 0.35.5 CWE-416