KindaRails2Shell: CVE-2026-66066, Critical Arbitrary File Read and Possible Remote Code Execution in Ruby on Rails

Overview On July 29, 2026, the Ruby on Rails project published a security advisory for CVE-2026-66066, a critical vulnerability affecting Active Storage image processing when used in conjunction with the libvips image processing library. The vulnerability has a CVSSv4 score of 9.5 and is classifi...

JLSEC-2026-1041 ImageMagick: Policy Bypass in concatenate operation due to missing checks

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-26he, the -concatenate operation is missing policy checks, potentially resulting in both reading and writing to paths disallowed by the security policy. This issue has been...

JLSEC-2026-962 ImageMagick has heap buffer overflow in YUV 4:2:2 decoder

A heap buffer overflow write vulnerability exists in ReadYUVImage coders/yuv.c when processing malicious YUV 4:2:2 NoInterlace images. The pixel-pair loop writes one pixel beyond the allocated row buffer. ================================================================= ==204642==ERROR:...

JLSEC-2026-945 ImageMagick has NULL pointer dereference in ReadSFWImage after DestroyImageInfo (sfw.c)

In ReadSFWImage coders/sfw.c, when temporary file creation fails, readinfo is destroyed before its filename member is accessed, causing a NULL pointer dereference and crash. AddressSanitizer:DEADLYSIGNAL ================================================================= ==1414421==ERROR:...

JLSEC-2026-1053 ImageMagick before 7.1.2-19 contains a heap buffer overflow vulnerability in the magnify...

ImageMagick before 7.1.2-19 contains a heap buffer overflow vulnerability in the magnify operation that allows attackers to read out of bounds memory. An unrecognized magnify:method value triggers an out of bounds read, potentially exposing sensitive information or causing denial of service...

JLSEC-2026-1034

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, an integer overflow in the XCF decoder can result in an out of bounds read when a crafted image is read, potentially resulting in a crash. This issue has been...

JLSEC-2026-921 imagemagick: integer overflows in MNG magnification

Vulnerability Details The magnified size calculations in ReadOneMNGIMage in coders/png.c are unsafe and can overflow, leading to memory corruption. The source snippet below is heavily abbreviated due to the size of the function, but hopefully the important points are captured. c static Image...

JLSEC-2026-946 ImageMagick has memory leak of watermark Image object in ReadSTEGANOImage on multiple error/early-return paths

Summary In ReadSTEGANOImage coders/stegano.c, the watermark Image object is not freed on three early-return paths, resulting in a definite memory leak 13.5KB+ per invocation that can be exploited for denial of service. Direct leak of 13512 bytes in 1 objects allocated from: 0 0x7f5c11e27887 in...

CVE-2026-58216 Samba: kpasswd service: kpasswd packet that contains malformed asn.1 might cause the server to access 6 bytes of unallocated memory leading server to crash

An out-of-bounds read flaw was found in Samba's Kerberos Key Distribution Center's KDC password change kpasswd service. When processing malformed ASN.1-encoded Kerberos password change request, Samba server miscalculates the structure size and attempts to read up to six bytes beyond the end of th...

CVE-2026-58216

An out-of-bounds read flaw was found in Samba's Kerberos Key Distribution Center's KDC password change kpasswd service. When processing malformed ASN.1-encoded Kerberos password change request, Samba server miscalculates the structure size and attempts to read up to six bytes beyond the end of th...

CVE-2026-58216 Samba: kpasswd service: kpasswd packet that contains malformed asn.1 might cause the server to access 6 bytes of unallocated memory leading server to crash

An out-of-bounds read flaw was found in Samba's Kerberos Key Distribution Center's KDC password change kpasswd service. When processing malformed ASN.1-encoded Kerberos password change request, Samba server miscalculates the structure size and attempts to read up to six bytes beyond the end of th...

CVE-2026-14519

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to read arbitrary files due to a path traversal vulnerability...

CVE-2026-54249

A flaw was found in pydantic-ai. A remote attacker could exploit this vulnerability by submitting crafted message history containing unvalidated file references. This could trick the server into reading arbitrary files from its own cloud storage accounts, such as Amazon S3 or Google Cloud Storage...

CVE-2026-14522 IBM App Connect Enterprise is vulnerable to an arbitrary file read and arbitrary changes to configuration settings

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to execute arbitrary commands due to improper neutralization of CRLF characters...

CVE-2026-14522

CVE-2026-14522 affects IBM App Connect Enterprise versions 13.0.1.0–13.0.7.2 and 12.0.1.0–12.0.12.27. The issue stems from improper neutralization of CRLF characters, enabling a remote attacker to execute arbitrary commands. Impact is high: remote code execution with CPU/network access and no use...

EUVD-2026-51136

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to read arbitrary files due to a path traversal vulnerability...

CVE-2026-14519

IBM App Connect Enterprise (versions 13.0.1.0–13.0.7.2 and 12.0.1.0–12.0.12.27) is affected by CVE-2026-14519, a path traversal flaw that could allow a remote attacker to read arbitrary files. The issue is described as a path traversal vulnerability in the product’s file handling, with a base CVS...

CVE-2026-14519 IBM App Connect Enterprise is vulnerable to an arbitrary file read and arbitrary changes to configuration settings

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to read arbitrary files due to a path traversal vulnerability...

CVE-2026-14519 IBM App Connect Enterprise is vulnerable to an arbitrary file read and arbitrary changes to configuration settings

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to read arbitrary files due to a path traversal vulnerability...

CVE-2026-41703

VMware ESX, Workstation, and Fusion contain an out-of-bounds read vulnerability. A malicious actor with VM deployment privileges could trigger an out-of-bounds read, potentially leading to information disclosure or more likely a Denial-of-Service DoS condition of the host process. On Workstation...