Missing Release of Memory after Effective Lifetime

Overview Magick.NET-Q8-OpenMP-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package...

Missing Release of Memory after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime in the hough lines. An attacker can cause increased memory consumption by triggering a failure during this operation. Remediation A fix was pushed into the master branch but not yet...

Out-of-bounds Read

Overview Magick.NET-Q16-OpenMP-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read in the identify when a profile is displayed and the profile value is not printable. An attacker can obtain unintended information by leveraging debug output to read a single byte past the profile boundary. Note: This ...

Missing Release of Memory after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime in the color transformation to the log colorspace when the operation fails. An attacker can cause a small amount of memory to be leaked by triggering a failure during color transformati...

Missing Release of Memory after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime in the ICON decoder when a memory allocation fails. An attacker can cause the application to consume excessive memory resources by submitting a specially crafted ICON file. Remediation ...

Use After Free

Overview Magick.NET-Q16-HDRI-AnyCPU is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package...

Use After Free

Overview Magick.NET-Q8-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

Use After Free

Overview Affected versions of this package are vulnerable to Use After Free in the freetype initialization. An attacker can cause the application to access freed memory by triggering a failure during image processing, potentially resulting in application crash or denial of service. Remediation A...

Use After Free

Overview Magick.NET-Q16-x86 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

Security Bulletin: IBM WebSphere Application Server shipped with IBM Tivoli System Automation Application Manager is vulnerable to a denial of service

Summary A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Tivoli System Automation Application ManagerCVE-2026-9320, CVE-2026-8646,CVE-2026-9071 Vulnerability Details CVEID:CVE-2026-9320 DESCRIPTION: IBM WebSphere Application Server 9.0, and 8.5 and...

Exploit for Code Injection in Vmware Spring_Framework

Spring4Shell Local Exploitation Conditions Verification, Remed...

Security Bulletin: IBM Cloud Pak for Data System (CPDS 1.0) is affected by use of a broken cryptographic algorithm vulnerability due to Paramiko

Summary Paramiko is used by IBM Cloud Pak for Data System 1.0 as a Python implementation of the SSH protocol for secure remote connections and file transfers. CVE-2026-44405 affects Paramiko's RSA key handling in rsakey.py, where the SHA-1 algorithm is permitted for cryptographic operations despi...

Incorrect Authorization

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Incorrect Authorization in the authorization process. An attacker can gain unauthorized read and write access by bypassing security measures remotely without user...

Authorization Bypass Through User-Controlled Key

Overview alextselegidis/easyappointments is a powerful Open Source Appointment Scheduler that can be installed on your server. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key through the appointments/store and appointments/update endpoints. An...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write in the ImageFilter.RankFilter process when a very large odd filter size is provided, leading to unchecked signed integer arithmetic in ImagingExpand. An attacker can cause a heap out-of-bounds write by supplying...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read in the soupmultipartinputstreamreadheaders function when processing multipart payloads with an oversized boundary string. An attacker can cause the application to crash or potentially access unauthorized memory...

Security Bulletin: IBM WebSphere Application Server Liberty is affected by a server-side request forgery vulnerability (CVE-2026-11546)

Summary IBM WebSphere Application Server Liberty is affected by a server-side request forgery vulnerability with the adminCenter-1.0 feature enabled. Vulnerability Details CVEID:CVE-2026-11546 DESCRIPTION: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a...

Missing Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Missing Authorization via the message mutation handling process. An attacker can perform privileged operations by exploiting misconfigured input paths to bypass requester authorization...

Incomplete List of Disallowed Inputs

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs via improper filtering of environment variables in the host exec process. An attacker can gain unauthorized access or perform actions beyond their...