thumbor has 6 CVEs on record. Disclosure cadence is accelerating: 6 in the last 90 days against 0 in the 90 before. The busiest recent month was July 2026 with 6. The median CVSS is 7.5 (high). None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.5
- Publish → KEV
- —
- Last 90 days
- 6 prev 0
Weakness classes
Products
- thumbor 6
Worst active — by depth score
CVE-2026-53501High· 8.2Thumbor is an open-source photo thumbnail service by globo.com45CVE-2026-53500High· 8.2Thumbor is an open-source photo thumbnail service by globo.com45CVE-2026-53505High· 7.5Thumbor is an open-source photo thumbnail service by globo.com41CVE-2026-53504High· 7.5Thumbor is an open-source photo thumbnail service by globo.com41CVE-2026-53503High· 7.5Thumbor is an open-source photo thumbnail service by globo.com41
thumbor vulnerabilities
CVEs affecting thumbor, newest first. Open any entry for full detail, references, and exploit status.
6 CVEsRSS
CVE-2026-53505High· 7.5Thumbor is an open-source photo thumbnail service by globo.com
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:proportion(<value>) filter does not enforce an upper bound on <value> and runs in the post-transform phase. An attacker can trigger extreme…
CVE-2026-53502HighThumbor is an open-source photo thumbnail service by globo.com
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, file_loader decodes percent-encoded path segments after its root-boundary validation, allowing traversal outside FILE_LOADER_ROOT_PATH through watermark or f…
CVE-2026-53500High· 8.2Thumbor is an open-source photo thumbnail service by globo.com
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the ALLOWED_SOURCES configuration passes plain strings to re.match() without escaping dots, so a hostname differing at dot positions can match the allowlist.…
CVE-2026-53501High· 8.2Thumbor is an open-source photo thumbnail service by globo.com
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor’s HMAC validation can be bypassed due to the use of Python’s .replace() when removing the signature from the URL before validation. Since .replace() …
CVE-2026-53503High· 7.5Thumbor is an open-source photo thumbnail service by globo.com
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:convolution(<matrix>, <columns>, <should_normalize>) filter passes the user-controlled <columns> value to a C extension (thumbor/ext/filter…
CVE-2026-53504High· 7.5Thumbor is an open-source photo thumbnail service by globo.com
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the convolution filter regular expression performs exponential backtracking on crafted repeated numeric input, allowing a URL request to exhaust processing t…