Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
16 results
Oct 14, 2026webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via execFile with shell enaCVE-2026-110635 · Other software · scionoftech · reported by VulnCheckCritical 9.3
webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via execFile with shell enabled. Attackers controlling file names or option strings passed to cwebp, dwebp, gwebp, or webpmux functions can inject shell metacharacters to execute OS commands as the Node.js process.
- Product
- webp-converter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 24, 2026Image::WebP versions before 0.3.0 for Perl bundle a vulnerable version of libwebp.CVE-2026-58586 · Other software · ZAPAD · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eCritical 9.8
Image::WebP versions before 0.3.0 for Perl bundle a vulnerable version of libwebp. Image::WebP does not link to the system libwebp. Instead, it uses a bundled copy of libwebp 0.3.0 (released 2013-03-20). That version has multiple known vulnerabilities, including CVE-2023-4863. Any caller that decodes an untrusted WebP image reaches the bundled decoder. Because the library is compiled into the module, upgrading the system libwebp does not remediate this.
- Product
- Image::WebP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmetacpan.orgmetacpan.org
Jun 20, 2023There exists a use after free/double free in libwebp.CVE-2023-1999 · Computers, phones & browsers · Chromium · reported by cve-coordination@google.comMedium 5.3
There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encoder, the pointer is still assigned to trial and the AddressSanitizer will attempt a double free.
- Product
- libwebp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromium.googlesource.comsecurity.gentoo.org
May 21, 2021A flaw was found in libwebp in versions before 1.0.1.CVE-2020-36332 · Other software · Webmproject · reported by Red HatHigh 7.5
A flaw was found in libwebp in versions before 1.0.1. When reading a file libwebp allocates an excessive amount of memory. The highest threat from this vulnerability is to the service availability.
- Product
- Libwebp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comsecurity.netapp.com
May 21, 2021A flaw was found in libwebp in versions before 1.0.1.CVE-2020-36331 · Other software · Webmproject · reported by Red HatCritical 9.1
A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function ChunkAssignData. The highest threat from this vulnerability is to data confidentiality and to the service availability.
- Product
- Libwebp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgbugzilla.redhat.com
May 21, 2021A flaw was found in libwebp in versions before 1.0.1.CVE-2020-36330 · Other software · Webmproject · reported by Red HatCritical 9.1
A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function ChunkVerifyAndAssign. The highest threat from this vulnerability is to data confidentiality and to the service availability.
- Product
- Libwebp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgbugzilla.redhat.com
May 21, 2021A flaw was found in libwebp in versions before 1.0.1.CVE-2020-36329 · Other software · Webmproject · reported by Red HatCritical 9.8
A flaw was found in libwebp in versions before 1.0.1. A use-after-free was found due to a thread being killed too early. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
- Product
- Libwebp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgbugzilla.redhat.com
May 21, 2021A flaw was found in libwebp in versions before 1.0.1.CVE-2020-36328 · Other software · Webmproject · reported by Red HatCritical 9.8
A flaw was found in libwebp in versions before 1.0.1. A heap-based buffer overflow in function WebPDecodeRGBInto is possible due to an invalid check for buffer size. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
- Product
- Libwebp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgbugzilla.redhat.com
May 21, 2021A use of uninitialized value was found in libwebp in versions before 1.0.1 in ReadSymbol().CVE-2018-25014 · Other software · Webmproject · reported by Red HatCritical 9.8
A use of uninitialized value was found in libwebp in versions before 1.0.1 in ReadSymbol().
- Product
- Libwebp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.chromium.orgbugzilla.redhat.com
May 21, 2021A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in ShiftBytes().CVE-2018-25013 · Other software · Webmproject · reported by Red HatCritical 9.1
A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in ShiftBytes().
- Product
- Libwebp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.chromium.orgbugzilla.redhat.com
May 21, 2021A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in GetLE24().CVE-2018-25012 · Other software · Webmproject · reported by Red HatCritical 9.1
A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in GetLE24().
- Product
- Libwebp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.chromium.orgbugzilla.redhat.com
May 21, 2021A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in PutLE16().CVE-2018-25011 · Other software · Webmproject · reported by Red HatCritical 9.8
A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in PutLE16().
- Product
- Libwebp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.chromium.orgbugzilla.redhat.com
May 21, 2021A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in ApplyFilter().CVE-2018-25010 · Other software · Webmproject · reported by Red HatCritical 9.1
A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in ApplyFilter().
- Product
- Libwebp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.chromium.orgbugzilla.redhat.com
May 21, 2021A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in GetLE16().CVE-2018-25009 · Other software · Webmproject · reported by Red HatCritical 9.1
A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in GetLE16().
- Product
- Libwebp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.chromium.orgbugzilla.redhat.com
May 23, 2019In libwebp 0.5.1, there is a double free bug in libwebpmux.CVE-2016-9969 · Other software · Webmproject · reported by MITREHigh 7.5
In libwebp 0.5.1, there is a double free bug in libwebpmux.
- Product
- Libwebp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.chromium.orgbugs.chromium.org
Feb 3, 2017Multiple integer overflows in libwebp allows attackers to have unspecified impact via unknown vectors.CVE-2016-9085 · Other software · Webmproject · reported by MITRELow 3.3
Multiple integer overflows in libwebp allows attackers to have unspecified impact via unknown vectors.
- Product
- Libwebp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comsecurityfocus.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.