{"schema_version":1,"title":"thumbor (PyPI) vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 6 vulnerabilities in thumbor (PyPI): 0 in the last 7 days and 6 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-53505, was published on 31 July 2026.","url":"https://junglewise.ai/threats/technologies/thumbor","json_url":"https://junglewise.ai/threats/technologies/thumbor.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/thumbor","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":5,"all_time":6,"critical":0,"exploited":0,"last_7_days":0,"last_30_days":0,"last_90_days":6,"last_365_days":6},"latest":[{"cve":"CVE-2026-53505","cvss":7.5,"epss":0.0061,"slug":"cve-2026-53505-thumbor-uncontrolled-resource-consumption-in-proportion-filter","title":"Thumbor uncontrolled resource consumption in proportion filter","severity":"high","exploited":false,"published_at":"2026-07-31T19:17:10.123+00:00","url":"https://junglewise.ai/threats/cve-2026-53505-thumbor-uncontrolled-resource-consumption-in-proportion-filter"},{"cve":"CVE-2026-53504","cvss":7.5,"epss":0.0061,"slug":"cve-2026-53504-thumbor-redos-in-convolution-filter","title":"Thumbor ReDoS in convolution filter","severity":"high","exploited":false,"published_at":"2026-07-31T19:17:09.92+00:00","url":"https://junglewise.ai/threats/cve-2026-53504-thumbor-redos-in-convolution-filter"},{"cve":"CVE-2026-53503","cvss":7.5,"epss":0.0075,"slug":"cve-2026-53503-thumbor-divide-by-zero-in-convolution-filter-c-extension","title":"Thumbor divide by zero in convolution filter C extension","severity":"high","exploited":false,"published_at":"2026-07-31T19:17:09.737+00:00","url":"https://junglewise.ai/threats/cve-2026-53503-thumbor-divide-by-zero-in-convolution-filter-c-extension"},{"cve":"CVE-2026-53502","cvss":4,"epss":0.0052,"slug":"cve-2026-53502-thumbor-path-traversal-in-file-loader-via-encoded-path-segments","title":"Thumbor path traversal in file_loader via encoded path segments","severity":"medium","exploited":false,"published_at":"2026-07-31T19:17:09.577+00:00","url":"https://junglewise.ai/threats/cve-2026-53502-thumbor-path-traversal-in-file-loader-via-encoded-path-segments"},{"cve":"CVE-2026-53501","cvss":8.2,"epss":0.0035,"slug":"cve-2026-53501-thumbor-hmac-validation-bypass-via-multiple-signature-injection","title":"Thumbor HMAC validation bypass via multiple signature injection","severity":"high","exploited":false,"published_at":"2026-07-31T19:17:09.413+00:00","url":"https://junglewise.ai/threats/cve-2026-53501-thumbor-hmac-validation-bypass-via-multiple-signature-injection"},{"cve":"CVE-2026-53500","cvss":8.2,"epss":0.005,"slug":"cve-2026-53500-thumbor-ssrf-via-unescaped-dots-in-allowed-sources","title":"Thumbor SSRF via unescaped dots in ALLOWED_SOURCES","severity":"high","exploited":false,"published_at":"2026-07-31T19:17:09.247+00:00","url":"https://junglewise.ai/threats/cve-2026-53500-thumbor-ssrf-via-unescaped-dots-in-allowed-sources"}],"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":6},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"open-webui (PyPI)","slug":"open-webui","vulnerabilities":156,"url":"https://junglewise.ai/threats/technologies/open-webui"},{"name":"nltk (PyPI)","slug":"nltk","vulnerabilities":74,"url":"https://junglewise.ai/threats/technologies/nltk"},{"name":"picklescan (PyPI)","slug":"picklescan","vulnerabilities":74,"url":"https://junglewise.ai/threats/technologies/picklescan"},{"name":"openbabel (PyPI)","slug":"openbabel","vulnerabilities":48,"url":"https://junglewise.ai/threats/technologies/openbabel"},{"name":"apache-superset (PyPI)","slug":"apache-superset","vulnerabilities":44,"url":"https://junglewise.ai/threats/technologies/apache-superset"},{"name":"apache-airflow (PyPI)","slug":"apache-airflow","vulnerabilities":40,"url":"https://junglewise.ai/threats/technologies/apache-airflow"},{"name":"tensorflow-gpu (PyPI)","slug":"tensorflow-gpu","vulnerabilities":37,"url":"https://junglewise.ai/threats/technologies/tensorflow-gpu"},{"name":"tensorflow-cpu (PyPI)","slug":"tensorflow-cpu","vulnerabilities":34,"url":"https://junglewise.ai/threats/technologies/tensorflow-cpu"},{"name":"weblate (PyPI)","slug":"weblate","vulnerabilities":33,"url":"https://junglewise.ai/threats/technologies/weblate"},{"name":"mcp-atlassian (PyPI)","slug":"mcp-atlassian","vulnerabilities":30,"url":"https://junglewise.ai/threats/technologies/mcp-atlassian"},{"name":"crawl4ai (PyPI)","slug":"crawl4ai","vulnerabilities":28,"url":"https://junglewise.ai/threats/technologies/crawl4ai"},{"name":"moin (PyPI)","slug":"moin","vulnerabilities":28,"url":"https://junglewise.ai/threats/technologies/moin"}],"technology":{"hub":true,"name":"thumbor (PyPI)","slug":"thumbor","vendor":{"name":"PyPI","slug":"pypi","url":"https://junglewise.ai/threats/vendors/pypi"},"aliases":[],"homepage":"https://thumbor.org/","repo_url":"https://github.com/thumbor/thumbor","description":"An open-source photo analysis and manipulation service written in Python.","url":"https://junglewise.ai/threats/technologies/thumbor"},"most_severe":[{"cve":"CVE-2026-53500","cvss":8.2,"epss":0.005,"slug":"cve-2026-53500-thumbor-ssrf-via-unescaped-dots-in-allowed-sources","title":"Thumbor SSRF via unescaped dots in ALLOWED_SOURCES","severity":"high","exploited":false,"published_at":"2026-07-31T19:17:09.247+00:00","url":"https://junglewise.ai/threats/cve-2026-53500-thumbor-ssrf-via-unescaped-dots-in-allowed-sources"},{"cve":"CVE-2026-53501","cvss":8.2,"epss":0.0035,"slug":"cve-2026-53501-thumbor-hmac-validation-bypass-via-multiple-signature-injection","title":"Thumbor HMAC validation bypass via multiple signature injection","severity":"high","exploited":false,"published_at":"2026-07-31T19:17:09.413+00:00","url":"https://junglewise.ai/threats/cve-2026-53501-thumbor-hmac-validation-bypass-via-multiple-signature-injection"},{"cve":"CVE-2026-53503","cvss":7.5,"epss":0.0075,"slug":"cve-2026-53503-thumbor-divide-by-zero-in-convolution-filter-c-extension","title":"Thumbor divide by zero in convolution filter C extension","severity":"high","exploited":false,"published_at":"2026-07-31T19:17:09.737+00:00","url":"https://junglewise.ai/threats/cve-2026-53503-thumbor-divide-by-zero-in-convolution-filter-c-extension"},{"cve":"CVE-2026-53505","cvss":7.5,"epss":0.0061,"slug":"cve-2026-53505-thumbor-uncontrolled-resource-consumption-in-proportion-filter","title":"Thumbor uncontrolled resource consumption in proportion filter","severity":"high","exploited":false,"published_at":"2026-07-31T19:17:10.123+00:00","url":"https://junglewise.ai/threats/cve-2026-53505-thumbor-uncontrolled-resource-consumption-in-proportion-filter"},{"cve":"CVE-2026-53504","cvss":7.5,"epss":0.0061,"slug":"cve-2026-53504-thumbor-redos-in-convolution-filter","title":"Thumbor ReDoS in convolution filter","severity":"high","exploited":false,"published_at":"2026-07-31T19:17:09.92+00:00","url":"https://junglewise.ai/threats/cve-2026-53504-thumbor-redos-in-convolution-filter"},{"cve":"CVE-2026-53502","cvss":4,"epss":0.0052,"slug":"cve-2026-53502-thumbor-path-traversal-in-file-loader-via-encoded-path-segments","title":"Thumbor path traversal in file_loader via encoded path segments","severity":"medium","exploited":false,"published_at":"2026-07-31T19:17:09.577+00:00","url":"https://junglewise.ai/threats/cve-2026-53502-thumbor-path-traversal-in-file-loader-via-encoded-path-segments"}],"generated_at":"2026-09-26T10:22:00.132594+00:00"}