CVE-2026-105401 ImageMagick before 7.1.2-31 Heap Buffer Overflow in Distributed Pixel Cache Server

ImageMagick before 7.1.2-31 contains a heap buffer overflow vulnerability in the distributed pixel cache server that allows connecting clients to overwrite heap memory by sending crafted data. Attackers can connect to the distributed pixel cache server and transmit malicious data to trigger a hea...

CVE-2026-105401

A heap buffer overflow vulnerability exists in ImageMagick versions prior to 7.1.2-31 within the distributed pixel cache server . A connecting client can transmit crafted data to trigger an integer-size calculation error , leading to a heap memory overwrite. This flaw can crash the server, result...

CVE-2026-105401

Removed by vendor...

EUVD-2026-94979

An uncontrolled search path element vulnerability in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to execute arbitrary code with SYSTEM privileges. DynamicLibrary::init and ThemeLib load screenhooks32.dll / screenhooks64.dll with LoadLibrary using a bare fi...

CVE-2026-107615

GlavSoft TightVNC Server for Windows versions prior to 2.8.88 is vulnerable to a DLL search order hijacking vulnerability. The DynamicLibrary::init() and ThemeLib components use LoadLibrary() to load screenhooks32.dll or screenhooks64.dll using a bare file name without specifying LOAD_LIBRARY_SEA...

EUVD-2026-94978

An integer underflow in WinCursorShapeUtils::trimTransparent in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to crash the server, and potentially read out-of-bounds memory, by causing a cursor shape with a width or height of zero to be processed on the DXGI...

CVE-2026-107614

GlavSoft TightVNC Server for Windows versions before 2.8.88 are vulnerable to an integer underflow in the WinCursorShapeUtils::trimTransparent() function. When a cursor shape with a width or height of zero is processed on the DXGI capture path , the loop bound width - 1 wraps to 0xFFFFFFFF. This ...

CVE-2026-107613

GlavSoft TightVNC Server for Windows versions before 2.8.88 contains a NULL pointer dereference vulnerability in the Win8ScreenDriver component. The issue occurs when the DXGI Desktop Duplication driver fails to re-initialize during the applyNewScreenProperties() function (e.g., following a GPU r...

EUVD-2026-94977

A NULL pointer dereference vulnerability in the Win8ScreenDriver component of GlavSoft TightVNC Server for Windows before 2.8.88 allows an attacker to crash the server, causing a denial of service. When re-initialization of the DXGI Desktop Duplication driver fails in applyNewScreenProperties for...

EUVD-2026-94976

Incorrect permission assignment in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to read or overwrite the inter-process communication handles used between the TightVNC service and its desktop server process. The named shared memory segment in the Global...

CVE-2026-107612

GlavSoft TightVNC Server for Windows versions prior to 2.8.88 contains an incorrect permission assignment in its inter-process communication (IPC) mechanism. The software creates a shared memory segment in the *Global* namespace with a NULL DACL , allowing local authenticated users to read or ove...

USN-8901-1 erlang vulnerabilities

Wander Nauta discovered that Erlang incorrectly handled absolute paths when extracting zip archives. An attacker could possibly use this issue to write arbitrary files outside of the intended directory. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. CVE-2025-47...

CVE-2024-32651-changedetection-RCE

CVE-2024-32651 changedetection 0.45.20 - Remote Code Execution RCE Server-Side Template Injection Exploit!! 1. Title Remote Code Execution via Server-Side Template Injection SSTI in Vulnerable Web Application 2. Description This exploit targets a web application vulnerable to Server-Side Template...

CVE-2026-93523

A flaw was found in xorg-x11-server. A local authenticated client can exploit this flaw by sending a crafted input device ungrab request with an unvalidated modifier value. This lack of validation causes the server to perform an out-of-bounds write on the heap, resulting in memory corruption that...

CVE-2026-93521

A flaw was found in xorg-x11-server. The X server incorrectly calculates buffer sizes and memory offsets when prepending or appending data to RandR Resize and Rotate extension provider properties. A local attacker can exploit this vulnerability by sending specially crafted property update request...

CVE-2026-88812

A flaw was found in the X.Org X Server and XWayland. An error handling issue in the X Keyboard Extension XKB geometry processing fails to clear a memory pointer after an allocation failure, leading to a double-free condition during cleanup. A local user can exploit this vulnerability by sending a...

React2Shell-CVE-2025-55182

🔥React2Shell - CVE-2025-55182 / CVE-2025-66478 Proof of Concept Critical Security Vulnerability Demo - CVSS 10.0 - Remote Code Execution in React Server Components ⚠️DISCLAIMER FOR EDUCATIONAL PURPOSES ONLY! This repository demonstrates a critical security vulnerability. Never use on production...

thunderbird: Information disclosure due to malicious IMAP server response

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap contents can ultimately be persisted to prefs.js...

SUSE-SU-2026:4571-1 Security update 5.2.1 for Multi-Linux Manager Server

This update fixes the following issues: Release Notes Highlights: - Added a note about the SUSE Registry IP address change. - Update to SUSE Multi-Linux Manager 5.2.1 Security fixes Ubuntu 26.04 LTS Support Confidential Computing Attestation for IBM Z Series New uyuni-tftpd Container Monitoring:...

Security update 5.2.1 for Multi-Linux Manager Server, Proxy and Retail Branch Server

Description: This update fixes the following issues: proxy-httpd-image: Version 5.2.10 Image rebuilt to the newest version with updated dependencies for SUSE Multi-Linux Manager 5.2.1 proxy-salt-broker-image: Version 5.2.9 Image rebuilt to the newest version with updated dependencies for SUSE...