Vulnerabilities
Discourse CVE-2026-55420 Allows Low-Privilege Users to Read Server Files
A race condition in Discourse’s image upload pipeline enables arbitrary file access for Trust Level 0 users via crafted uploads.
ImageMagick
Everything Threat Times has reported about ImageMagick: 3 stories, newest first. Part of our Vulnerabilities coverage.
Vulnerabilities
Discourse Image Pipeline Flaws Allow File Read and Cache Poisoning
Researchers disclosed two vulnerabilities in Discourse’s image handling that enable local file access and script execution, with patches released before publication.
Vulnerabilities
Critical OS Command Injection Flaw Found in Node.js Image Conversion Library
The @enmaso/node-convert package contains a severe vulnerability allowing remote attackers to execute arbitrary system commands via crafted inputs.