EUVD-2026-72380

ImageMagick before 7.1.2-30 contains a time-of-check-time-of-use vulnerability in path policy enforcement on Windows that allows attackers to bypass read or write restrictions by exploiting symlink race conditions. Attackers can swap symlinks between policy validation and file access to read or...

CVE-2026-86422 ImageMagick before 7.1.2-30 Path Policy TOCTOU Symlink Race

ImageMagick before 7.1.2-30 contains a time-of-check-time-of-use vulnerability in path policy enforcement on Windows that allows attackers to bypass read or write restrictions by exploiting symlink race conditions. Attackers can swap symlinks between policy validation and file access to read or...

CVE-2026-86422 ImageMagick before 7.1.2-30 Path Policy TOCTOU Symlink Race

ImageMagick before 7.1.2-30 contains a time-of-check-time-of-use vulnerability in path policy enforcement on Windows that allows attackers to bypass read or write restrictions by exploiting symlink race conditions. Attackers can swap symlinks between policy validation and file access to read or...

CVE-2026-86422

ImageMagick before 7.1.2-30 contains a time-of-check-time-of-use vulnerability in path policy enforcement on Windows that allows attackers to bypass read or write restrictions by exploiting symlink race conditions. Attackers can swap symlinks between policy validation and file access to read or...

CVE-2026-18174

A flaw was found in @fastify/forwarded. This component, responsible for resolving client addresses from the X-Forwarded-For header, fails to strip horizontal tab characters when processing multiple comma-separated entries. A remote attacker could exploit this by injecting tab characters into the...

Security Bulletin: IBM ApplinX is vulnerable to multiple issues like double decoding, interpretation conflict and more due to the use of fast-uri (CVE-2026-75899, CVE-2026-75931, CVE-2026-75975, CVE-2026-76172)

Summary IBM ApplinX is vulnerable to multiple issues like double decoding, interpretation conflict and more due to the use of fast-uri CVE-2026-75899, CVE-2026-75931, CVE-2026-75975, CVE-2026-76172. The fast-uri version has been updated within IBM ApplinX in order to address the mentioned...

CVE-2026-74248

A flaw was found in OpenStack Octavia. An authenticated user can exploit this vulnerability by associating a Quality of Service QoS policy from another project with an amphora. This mishandling of QoS policy authorization may prevent the deletion of the policy, leading to a denial of service DoS...

CVE-2026-86422: Improper Link Resolution Before File Access

ImageMagick before 7.1.2-30 contains a time-of-check-time-of-use vulnerability in path policy enforcement on Windows that allows attackers to bypass read or write restrictions by exploiting symlink race conditions. Attackers can swap symlinks between policy validation and file access to read or...

Linux Distros Unpatched Vulnerability : CVE-2026-53769

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Avo is a framework to create admin panels for Ruby on Rails apps. From version 2.28.0 to before version 3.32.0, Avo's direct attachment upload endpoint lacks...

CVE-2026-86424: Improper Link Resolution Before File Access

ImageMagick before 7.1.2-30 and 6.9.13-55 contains a time-of-check-time-of-use TOCTOU vulnerability in the video decoder that allows attackers to bypass path policy write restrictions via symlink swaps. An attacker can replace a symlink between policy validation check-time and the file write...

Linux Distros Unpatched Vulnerability : CVE-2026-86424

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick before 7.1.2-30 and 6.9.13-55 contains a time-of-check-time-of-use TOCTOU vulnerability in the video decoder that allows attackers to bypass path...

PT-2026-86790

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7.1.2-30 ImageMagick versions prior to 6.9.13-55 Description A time-of-check-time-of-use TOCTOU issue exists in the video decoder. This allows attackers to bypass path policy write restrictions by swapping symlink...

PT-2026-86788

ImageMagick before 7.1.2-30 contains a time-of-check-time-of-use vulnerability in path policy enforcement on Windows that allows attackers to bypass read or write restrictions by exploiting symlink race conditions. Attackers can swap symlinks between policy validation and file access to read or...

RouterOS SSH Privilege Escalation

The vulnerability of the SSH protocol implementation in the RouterOS operating system of MikroTik is related to changes in the user trust policy mask due to the introduction or modification of arguments. Exploiting this vulnerability can allow a malicious actor to increase their privileges remote...

MAL-2026-16005 Malicious code in agentrc-security-poc-policy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e0bbc2bd28895453e58312011f52db595086e60412006e8732bf2ffb60284c9c The OpenSSF Package Analysis project identified 'agentrc-security-poc-policy' @ 1.0.0 npm as malicious. It is considered malicious because: - Th...

Malicious code in agentrc-security-poc-policy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e0bbc2bd28895453e58312011f52db595086e60412006e8732bf2ffb60284c9c The OpenSSF Package Analysis project identified 'agentrc-security-poc-policy' @ 1.0.0 npm as malicious. It is considered malicious because: - Th...

PT-2026-86539

Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to inflate the fee-payer's gas cost per sponsored payment by a large multiplier and to have the sponsor pay for provisioning an access key on the client's own account. When the server sponsor...

CVE-2026-86060

RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation. Exploitation requires an unauthenticated SSH session to reach the RouterOS...

CVE-2026-86060

MikroTik RouterOS contains an argument-handling flaw in the SSH login path. An unauthenticated attacker can supply a username beginning with a prohibited character to reach the RouterOS login helper and modify the trusted policy mask , achieving privilege escalation . The vulnerability is rated C...

CVE-2026-86060 SSH session privilege manipulation via a crafted username in Mikrotik RouterOS

RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation. Exploitation requires an unauthenticated SSH session to reach the RouterOS...