CVE-2026-66066

CVE-2026-66066 — KindaRails2Shell Ruby on Rails Active Storage + libvips arbitrary file read → conditional remote code execution RCE PoC tool. Single-file, Python 3.11+ pure standard library with zero dependencies , includes MAT/HDF5 hybrid payloads, a pure-Python PNG pixel decoder, offset reads,...

CLEANSTART-2025-EA29796 coders/mat

Security vulnerability affects the imagemagick package. coders/mat...

SUSE CVE-2026-116152

ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the MAT decoder that fails to release allocated memory in a specific error path. Attackers can supply crafted MAT files that trigger this error path repeatedly, causing small memory leaks that gradually consume process memory...

Mat Trudel Bandit resource management error vulnerability

Versions 0.3.1 through 1.14.1 of Mat Trudel Bandit contain a resource management error vulnerability. This flaw arises because the HTTP/2 request body reader fails to impose restrictions on resource allocation. The :length option in readbody/2 counts bytes rather than frames. Unauthenticated remo...

UBUNTU-CVE-2026-116152

ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the MAT decoder that fails to release allocated memory in a specific error path. Attackers can supply crafted MAT files that trigger this error path repeatedly, causing small memory leaks that gradually consume process memory...

Mat Trudel Bandit processing logic error vulnerability

Versions 0.5.1 through 1.14.0 of Mat Trudel Bandit contain a logic error vulnerability. This vulnerability arises because after a server closes a WebSocket connection, the connection process remains in a “closing” state; however, relevant processing functions fail to check for this status. As a...

Mat Trudel Bandit resource management error vulnerability

Versions 0.3.4 through 1.14.0 of Mat Trudel Bandit contain a resource management error vulnerability. This flaw arises because in the HTTP/2 implementation, List.delete/2 is used to remove entries from the queue prior to retrying queued sends in dopendingsends/2 within...

Mat Trudel Bandit resource management error vulnerability

Versions Mat Trudel Bandit from 1.0.0-pre.7 up to and including 1.14.0 contain a resource management error vulnerability. This vulnerability arises because the HTTP header integer parser fails to limit the number of digits; it constructs numbers bit by bit and allocates new large numbers at each...

Mat Trudel Bandit improper exception handling vulnerability

Versions 1.9.0 through 1.14.0 of Mat Trudel Bandit contain an improper exception handling vulnerability. This flaw arises from inadequate cleanup by the HTTP/2 handler when throwing exceptions. When a single TCP write contains multiple frames, one of which triggers a stream error, the connection...

Mat Trudel Bandit resource management error vulnerability

In Mat Trudel Bandit versions 1.11.0 through 1.14.0, there is a resource management error vulnerability. This vulnerability arises because WebSocket chunk reassembly fails to limit resource allocation and the number of chunks; it only checks the maximum size of incoming payload bytes and allocate...

Mat Trudel Bandit input validation error vulnerability

Versions 1.12.4 through 1.14.0 of Mat Trudel Bandit contain an input validation error vulnerability. This vulnerability arises because the HTTP/1.1 chunk body reader fails to validate chunk extensions according to the chunk extension syntax defined in RFC 9112. It truncates the chunk size line to...

Mat Trudel Bandit resource management error vulnerability

Versions of Mat Trudel Bandit from 0.3.6 up to but not including 1.14.0 contain a resource management error vulnerability. This flaw arises from unrestricted or throttling-free resource allocation within the HTTP/2 implementation. Bandit.HTTP2.Connection passes remotesettings.headertablesize to...

Mat Trudel Bandit resource management error vulnerability

Versions of Mat Trudel Bandit from 0.3.1 up to but not including 1.14.0 contain a resource management vulnerability. This vulnerability arises because the HTTP/2 implementation lacks restrictions or throttling on resource allocation. In Bandit.HTTP2.Connection.handleframe/3, the receive window is...

Mat Trudel Bandit resource management error vulnerability

Versions 1.4.0 through 1.14.0 of Mat Trudel Bandit contain a resource management error vulnerability. This flaw arises because the HTTP/2 request body reader fails to impose restrictions or throttling on resource allocation. Unauthenticated remote attackers can send WINDOWUPDATE or empty SETTINGS...

Mat Trudel Bandit resource management error vulnerability

Versions 0.1.0 through 1.14.0 of Mat Trudel Bandit contain a resource management error vulnerability. This vulnerability arises because the HTTP/1.1 chunk body reader fails to limit or throttle resource allocation; it does not restrict the number of chunks and only counts the length of bytes in...

Mat Trudel Bandit resource management error vulnerability

Mat Trudel Bandit versions 0.3.3 through 1.14.0 contain a resource management error vulnerability. This vulnerability stems from improper handling of highly compressed data data amplification in the HTTP/2 implementation; only the size limit of compression blocks is enforced while decoding list...

Linux Distros Unpatched Vulnerability : CVE-2026-116152

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the MAT decoder that fails to release allocated memory in a specific error path. Attackers c...

Missing Release of Memory after Effective Lifetime

Overview Magick.NET-Q16-HDRI-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package a...

Missing Release of Memory after Effective Lifetime

Overview Magick.NET-Q16-HDRI-OpenMP-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this...

Missing Release of Memory after Effective Lifetime

Overview Magick.NET-Q8-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...