Thumbor

6 CVEs in 1 Thumbor product, including Thumbor. Newest: CVE-2026-53505 (2026-07-31). Severity, EPSS and public exploits for each.

Thumbor products with known CVEs

ProductCVEs
Thumbor6
Thumbor CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-53505High7.52026-07-31Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:proportion(<value>) filter does not enforce an upper bound on…
CVE-2026-53504High7.52026-07-31Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the convolution filter regular expression performs exponential backtracking on…
CVE-2026-53503High7.52026-07-31Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:convolution(<matrix>, <columns>, <should_normalize>) filter p…
CVE-2026-535022026-07-31Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, file_loader decodes percent-encoded path segments after its root-boundary valid…
CVE-2026-53501High8.22026-07-31Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor’s HMAC validation can be bypassed due to the use of Python’s .replace()…
CVE-2026-53500High8.22026-07-31Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the ALLOWED_SOURCES configuration passes plain strings to re.match() without es…