CVE-2026-64685

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-27, the BGR decoder does not check for an end-of-file in every location so a crafted image could result in an heap buffer over-read. This issue has been fixed in version...

CVE-2026-64685 ImageMagick: Heap Buffer Over-Read in BGR decoder due to mising end-of-file check

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-27, the BGR decoder does not check for an end-of-file in every location so a crafted image could result in an heap buffer over-read. This issue has been fixed in version...

CVE-2026-64685 ImageMagick: Heap Buffer Over-Read in BGR decoder due to mising end-of-file check

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-27, the BGR decoder does not check for an end-of-file in every location so a crafted image could result in an heap buffer over-read. This issue has been fixed in version...

CVE-2026-64685 ImageMagick: Heap Buffer Over-Read in BGR decoder due to mising end-of-file check

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-27, the BGR decoder does not check for an end-of-file in every location so a crafted image could result in an heap buffer over-read. This issue has been fixed in version...

CVE-2026-64685

ImageMagick vulnerability CVE-2026-64685 affects the BGR decoder. In versions prior to 7.1.2-27, the BGR decoder does not check for an end-of-file in every location, which could lead to a heap buffer over-read when processing a crafted image. The issue has been fixed in version 7.1.2-27. The CVSS...

CVE-2026-64685

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-27, the BGR decoder does not check for an end-of-file in every location so a crafted image could result in an heap buffer over-read. This issue has been fixed in version...

CVE-2026-41939

Care Everywhere Gateway 14.3.10 contains a hard-coded credentials vulnerability in the bundled WildFly 8.2.0.Final management interface that allows unauthenticated remote attackers to gain administrative access by using default credentials identical across all installations. Attackers can...

CVE-2026-41939 Care Everywhere Gateway 14.3.10 Hard-coded Credentials RCE via WildFly

Care Everywhere Gateway 14.3.10 contains a hard-coded credentials vulnerability in the bundled WildFly 8.2.0.Final management interface that allows unauthenticated remote attackers to gain administrative access by using default credentials identical across all installations. Attackers can...

CVE-2026-41939

Summary: CVE-2026-41939 affects Care Everywhere Gateway 14.3.10, where a hard-coded credential flaw in the bundled WildFly 8.2.0.Final management interface enables unauthenticated remote access to the WildFly admin console (port 20990) with default credentials. This allows deployment of a malicio...

CVE-2026-33385

Quick.CMS 6.8 is affected by a Blind SQL injection in the administration panel, resulting from improper neutralization of input fields accessed by a high-privileged user. The vulnerability can bypass front-end validation controls and potentially lead to database destruction. The CVSS-derived metr...

EUVD-2026-50273

The Booking System Trafft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bookingWebsiteUrl setting in all versions up to, and including, 1.0.17 due to a missing capability check on the setoptions AJAX action when the plugin is operating in agency mode. The...

K000162640: BIND vulnerability CVE-2026-3592

Security Advisory Description BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack. If a victim resolver makes a query to a specially crafted zone, the resolver will consume disproportionate resources. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18...

PT-2026-65968

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7.1.2-27 Description The BGR decoder fails to verify the end-of-file at every location, which allows a specially crafted image to trigger a heap buffer over-read. A heap buffer over-read occurs when a program read...

Wednesday, July 29, 2026 Security Releases

Wednesday, July 29, 2026 Security Releases Security releases available Updates are now available for the 26.x, 24.x, 22.x Node.js release lines for the following issues. This security release includes the following dependency updates to address public vulnerabilities: undici 8.9.0, 7.29.0, 6.28.0...

PT-2026-65863

Care Everywhere Gateway 14.3.10 contains a hard-coded credentials vulnerability in the bundled WildFly 8.2.0.Final management interface that allows unauthenticated remote attackers to gain administrative access by using default credentials identical across all installations. Attackers can...

PT-2026-65522

tiny-http through 0.12.0 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize request framing by sending a Transfer-Encoding header with any value, including non-chunked codings, which causes the library to unconditionally apply chunk-decoding and discard...

Linux Distros Unpatched Vulnerability : CVE-2026-17072

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in GStreamer's gst-plugins-good. A heap-based out-of-bounds read of 4 bytes can occur when parsing FLAC audio stream headers embedded in a...

The vulnerability of the f2fs_write_end_io() function in the fs/f2fs/data.c module of the F2FS file system in the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the f2fswriteendio function in the fs/f2fs/data.c module of the F2FS file system in the Linux operating system is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow a remote attacker to compromise the confidentiality, integrity,...

CVE-2026-12394

The MemberGlut WordPress plugin before 1.1.5 does not validate the role chosen during front-end registration, allowing unauthenticated users to register an account with an arbitrary role, including administrator, leading to full site compromise...

CVE-2026-12394

The MemberGlut WordPress plugin before 1.1.5 does not validate the role chosen during front-end registration, allowing unauthenticated users to register an account with an arbitrary role, including administrator, leading to full site compromise...