Astra Linux – Vulnerability in exempi

The XMP Toolkit SDK version 2021.07 and earlier is affected by a stack-based buffer overflow vulnerability that may lead to arbitrary code execution within the context of the current user. Exploitation requires user interaction—that is, the victim must open a specially crafted file...

Astra Linux – Vulnerability in imagemagick

ImageMagick is free and open-source software used for editing and manipulating digital images. Versions below 7.1.2-19 and 6.9.13-44 contain a heap use-after-free vulnerability that can cause a crash when reading and printing values from an invalid XMP profile. This issue has been fixed in versio...

Astra Linux – Vulnerability in exempi

The XMP Toolkit SDK version 2020.1 and earlier is affected by a buffer overflow vulnerability that may lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction, as the victim must open a specially crafted file...

Server-side Request Forgery (SSRF)

Overview weasyprint is a The Awesome Document Factory Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the writepdf stylesheet and XMP metadata loading paths in weasyprint/document.py and weasyprint/pdf/init.py. An attacker can make the rendering process...

EUVD-2026-60440

ApostropheCMS: Mutation-XSS / allowedTags bypass via literal solidus close...

CVE-2026-63670

ApostropheCMS is an open-source Node.js content management system. Prior to 2.17.6, sanitizeHtml can pass disallowed executable markup through packages/sanitize-html/index.js when textarea or xmp is included in allowedTags because a literal solidus after the raw-text end-tag name is treated as te...

CVE-2026-63670

ApostropheCMS is an open-source Node.js content management system. Prior to 2.17.6, sanitizeHtml can pass disallowed executable markup through packages/sanitize-html/index.js when textarea or xmp is included in allowedTags because a literal solidus after the raw-text end-tag name is treated as te...

CVE-2026-63670: Improper Neutralization of Input During Web Page Generation

ApostropheCMS is an open-source Node.js content management system. Prior to 2.17.6, sanitizeHtml can pass disallowed executable markup through packages/sanitize-html/index.js when textarea or xmp is included in allowedTags because a literal solidus after the raw-text end-tag name is treated as te...

Unity Linux 20.1070e Security Update: ImageMagick (UTSA-2026-099498)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099498 advisory. ImageMagick before 7.1.2-26 contains a heap use-after-free vulnerability caused by missing null check when parsing XMP profiles. Attackers can craft malicious image...

PT-2026-76043

ImageMagick is free and open-source software used for editing and manipulating digital images. Versions below 7.1.2-19 and 6.9.13-44 contain a heap use-after-free vulnerability that can cause a crash when reading and printing values from an invalid XMP profile. This issue has been fixed in versio...

PT-2026-76103

ImageMagick before 7.1.2-26 contains a heap use-after-free vulnerability caused by missing null check when parsing XMP profiles. Attackers can craft malicious image files with specially crafted XMP data to trigger the vulnerability and cause application crashes...

SUSE-SU-2026:3219-1 Security update for ImageMagick

This update for ImageMagick fixes the following issues: - CVE-2026-55628: policy bypass in concatenate operation due to missing checks bsc1270081. - CVE-2026-56362: heap buffer overflow read in GetPixelIndex due to metadata-cache desynchronization in OpenPixelCache bsc1271100. - CVE-2026-56366:...

CVE-2026-65914: Improper Neutralization of Input During Web Page Generation

DOMPurify before 3.3.2 contains a mutation-XSS vulnerability when sanitized HTML is reinserted into special parsing contexts using innerHTML with wrappers like script, xmp, iframe, noembed, noframes, or noscript. Attackers can craft payloads with closing sequences that break out of the wrapper...

SUSE SLES12: ImageMagick-config-6-SUSE / ImageMagick-config-6-upstream / etc (SUSE-SU-2026:3192-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3192-1 advisory. This update for ImageMagick fixes the following issues - CVE-2026-55628: policy bypass in concatenate operation due to missing checks bsc127008...

SUSE-SU-2026:22829-1 Security update for ImageMagick

This update for ImageMagick fixes the following issues - CVE-2026-55628: Policy Bypass in concatenate operation due to missing checks bsc1270081. - CVE-2026-56362: Heap-buffer-overflow read in GetPixelIndex due to metadata-cache desynchronization in OpenPixelCache bsc1271100. - CVE-2026-56366: ME...

OESA-2026-3059 ImageMagick security update

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats over 200 including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images,...

OESA-2026-3058 ImageMagick security update

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats over 200 including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images,...

OESA-2026-3057 ImageMagick security update

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats over 200 including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images,...

SUSE CVE-2026-61857

ImageMagick before 7.1.2-26 contains a heap use-after-free vulnerability caused by missing null check when parsing XMP profiles. Attackers can craft malicious image files with specially crafted XMP data to trigger the vulnerability and cause application crashes...

pypdf: Manipulated XMP metadata streams can exhaust RAM

ImpactAn attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing large XMP metadata, possibly with lots of unnecessary elements. PatchesThis has been fixed in pypdf==6.12.1. WorkaroundsIf you cannot upgrade yet, consider applying the changes...