Server-side Request Forgery (SSRF)

Overview phanan/koel is a personal audio streaming service. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the isSafeUrl process. An attacker can access internal network resources and sensitive cloud metadata endpoints by supplying a crafted URL that...

Server-side Request Forgery (SSRF)

Overview phanan/koel is a personal audio streaming service. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the createPodcastChannel.view process. An attacker can cause the server to initiate HTTP requests to internal or private network resources by...

CVE-2026-61464

ImageMagick before 7.1.2-26 and 6.9.13-51 contains a heap-based buffer over-write vulnerability that occurs when running an X11 import with a crafted window title, which can result in heap memory corruption and denial of service...

UBUNTU-CVE-2026-61869

ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the MIFF encoder that occurs when a memory allocation fails during MIFF image processing, which can lead to denial of service...

UBUNTU-CVE-2026-56375

ImageMagick through 7.1.2-18 contains a memory leak vulnerability in the ASHLAR coder when an action fails. Attackers can trigger failed actions to exhaust memory resources and cause denial of service...

CVE-2026-56375

ImageMagick through 7.1.2-18 contains a memory leak vulnerability in the ASHLAR coder when an action fails. Attackers can trigger failed actions to exhaust memory resources and cause denial of service...

EUVD-2026-44613

ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in color transformation to the log colorspace: when the operation fails, a small amount of memory is not released...

CVE-2026-61863

ImageMagick before 7.1.2-26 (and 6.x before 6.9.13-51) has a memory leak in the TIFF encoder that occurs when a temporary file cannot be created, potentially affecting availability by gradual memory growth. Red Hat’s advisory confirms the issue and recommends upgrading to ImageMagick 7.1.2-26 or ...

CVE-2026-61863 ImageMagick before 7.1.2-26 Memory Leak in TIFF Encoder

ImageMagick before 7.1.2-26 and 6.x before 6.9.13-51 contains a memory leak in the TIFF encoder that occurs when a temporary file cannot be created, resulting in a small memory leak...

CVE-2026-61863 ImageMagick before 7.1.2-26 Memory Leak in TIFF Encoder

ImageMagick before 7.1.2-26 and 6.x before 6.9.13-51 contains a memory leak in the TIFF encoder that occurs when a temporary file cannot be created, resulting in a small memory leak...

[SECURITY] [DLA 4683-1] wolfssl security update

----------------------------------------------------------------------- Debian LTS Advisory DLA-4683-1 [email protected] https://www.debian.org/lts/security/ Utkarsh Gupta July 15, 2026 https://wiki.debian.org/LTS - -----------------------------------------------------------------------...

PT-2026-60317

Name of the Vulnerable Software and Affected Versions Wekan versions prior to 9.07 Description The avatar upload functionality allows the embedding of user-supplied filenames into paths that are subsequently passed to the child process.exec function for MIME-type detection. Specifically, the...

PT-2026-60324

Name of the Vulnerable Software and Affected Versions Wekan versions prior to 9.37 Description Authenticated users with write access to their own board can move cards, lists, or swimlanes into a private board they are not members of. This occurs because DDP update allow rules in...

KLA91162 ACE vulnerability in 7-Zip

A remote code execution vulnerability was found in 7-Zip. Malicious users can exploit this vulnerability to execute arbitrary code, cause denial of service, bypass security restrictions. Original advisories ZDI-26-444 Exploitation Public exploits exist for this vulnerability. Related products 7-Z...

Oracle Linux 7 : 389-ds-base (ELSA-2026-26453)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-26453 advisory. - Security fix for CVE-2026-9064 Orabug: 39570202 - Security fix for CVE-2025-14905 Orabug: 39146844 Tenable has extracted the preceding description block...

Oracle Linux 7 : host-metering (ELSA-2026-16101)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-16101 advisory. 1.2.0-4.0.1 - Rebuild with new go-toolset-1.19-golang to fix CVE-2026-32283 Orabug: 39352233 Tenable has extracted the preceding description block directly fro...

JLSEC-2026-754 The PKCS#7 decode path ignores the caller-supplied output buffer size (outputSz), allowing decoded...

The PKCS7 decode path ignores the caller-supplied output buffer size outputSz, allowing decoded content to be written past the bounds of the provided buffer. This affects wolfSSL 5.9.0 and earlier and was fixed in the 5.9.1 release...

JLSEC-2026-719

A stack buffer overflow exists in wolfSSL's PKCS7 implementation in the wcPKCS7DecryptOri function in wolfcrypt/src/pkcs7.c. When processing a CMS EnvelopedData message containing an OtherRecipientInfo ORI recipient, the function copies an ASN.1-parsed OID into a fixed 32-byte stack buffer...

JLSEC-2026-736 `wolfSSL_PKCS7_verify()` returning success for a degenerate (certs-only) PKCS#7 object that contains...

wolfSSLPKCS7verify returning success for a degenerate certs-only PKCS7 object that contains no signer. Such an object has empty signerInfos, so the underlying signed-data verification succeeds without authenticating any content. The compatibility-layer verify path now rejects the object when no...

CVE-2026-48806

Twig is a template language for PHP. Prior to 3.27.0, ArrayExpression does not guard dynamic mapping keys that are coerced to strings, allowing PHP to invoke toString on a Stringable object used as a mapping key without calling SandboxExtension::ensureToStringAllowed. This issue is fixed in versi...