CVE-2026-65650

MediumCVSS 4.3/10Last modified Jul 22, 2026

Description

Elgg before 7.0.0 does not check image dimensions to prevent denial of service via a large avatar upload.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-770

Affected software

No affected versions have been published.

Timeline

Published
Jul 22, 2026
Last modified
Jul 22, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-656518.7temporalio/sqlparser accepts SQL containing deeply nested unary expressions and can return a correspondingly deep abstract syntax tree withoCVE-2026-656528.7github.com/temporalio/tchannel-go did not validate the one-byte checksum-type field in inbound TChannel call frames. A network peer that canCVE-2026-656538.7github.com/temporalio/tchannel-go did not reject TChannel call fragments containing checksum metadata but no length-prefixed argument chunksCVE-2026-656548.7github.com/temporalio/ringpop-go enforces configured LabelOptions limits when an application changes the local node's labels, but affected vCVE-2026-656552.3When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server oCVE-2026-656567.8Improper neutralization of special elements used in a command ('command injection') in Microsoft Office allows an unauthorized attacker to eCVE-2026-656577.8Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2026-656588.8Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2026-65664.3The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Insecure Direct Object Reference in CVE-2026-656608.8Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over CVE-2026-656617.8Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2026-656625.5Out-of-bounds read in Windows GDI allows an authorized attacker to disclose information locally.
CVE-2026-65650: Medium severity, CVSS 4.3 | Vulnix