MAL-2026-18273 Malicious code in @ppa-web-components/ppa-builder (npm)

@ppa-web-components/ppa-builder is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version 0.0.1, 1.0.0, 1.0.1, 99.0.1, 2.0.1, 3.0.0 has a postinstall script th...

Malicious code in @ppa-web-components/ppa-builder (npm)

@ppa-web-components/ppa-builder is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version 0.0.1, 1.0.0, 1.0.1, 99.0.1, 2.0.1, 3.0.0 has a postinstall script th...

MAL-2026-18286 Malicious code in @ppa-web-components/ppa-navigation (npm)

@ppa-web-components/ppa-navigation is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version 1.0.1, 1.0.0, 2.0.0, 99.0.1, 3.0.0, 2.0.1 has a postinstall script...

DEBIAN-CVE-2026-116153

ImageMagick before 7.1.2-33 contains a heap buffer overflow vulnerability on 32-bit systems that allows attackers to overwrite heap memory when convex-hull information is requested. Attackers can supply crafted images processed with convex-hull calculations to corrupt heap memory, causing crashes...

CVE-2026-116153

ImageMagick before 7.1.2-33 contains a heap buffer overflow vulnerability on 32-bit systems that allows attackers to overwrite heap memory when convex-hull information is requested. Attackers can supply crafted images processed with convex-hull calculations to corrupt heap memory, causing crashes...

DEBIAN-CVE-2026-116140

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 incorrectly parses delegate invocations, which can allow an executable blocked in policy.xml to still run. An attacker who gets ImageMagick to process input that triggers a delegate invocation can bypass the administrator-defined policy and...

CVE-2026-116140

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 incorrectly parses delegate invocations, which can allow an executable blocked in policy.xml to still run. An attacker who gets ImageMagick to process input that triggers a delegate invocation can bypass the administrator-defined policy and...

CVE-2026-116153

ImageMagick before 7.1.2-33 contains a heap buffer overflow vulnerability on 32-bit systems that allows attackers to overwrite heap memory when convex-hull information is requested. Attackers can supply crafted images processed with convex-hull calculations to corrupt heap memory, causing crashes...

CVE-2026-116153

A flaw was found in ImageMagick. An attacker could exploit this vulnerability to cause a Denial of Service DoS or potentially execute arbitrary code on 32-bit systems. By convincing a user or automated service to process a specially crafted image requiring convex-hull calculations, an attacker ca...

.NET 10.0 Update - October 25, 2026

.NET 10.0 Update - October 25, 2026 .NET 10.0 has been refreshed with an out-of-band security update as of October 25, 2026. This update is separate from the regular monthly servicing release. See the release notes for details about updated packages. Important: This out-of-band security update...

CVE-2026-116153

ImageMagick before 7.1.2-33 contains a heap buffer overflow vulnerability on 32-bit systems that allows attackers to overwrite heap memory when convex-hull information is requested. Attackers can supply crafted images processed with convex-hull calculations to corrupt heap memory, causing crashes...

EUVD-2026-109414

ImageMagick before 7.1.2-33 contains a heap buffer overflow vulnerability on 32-bit systems that allows attackers to overwrite heap memory when convex-hull information is requested. Attackers can supply crafted images processed with convex-hull calculations to corrupt heap memory, causing crashes...

CVE-2026-116153 ImageMagick before 7.1.2-33 Heap Buffer Overflow via Convex-Hull on 32-bit

ImageMagick before 7.1.2-33 contains a heap buffer overflow vulnerability on 32-bit systems that allows attackers to overwrite heap memory when convex-hull information is requested. Attackers can supply crafted images processed with convex-hull calculations to corrupt heap memory, causing crashes...

CVE-2026-116153 ImageMagick before 7.1.2-33 Heap Buffer Overflow via Convex-Hull on 32-bit

ImageMagick before 7.1.2-33 contains a heap buffer overflow vulnerability on 32-bit systems that allows attackers to overwrite heap memory when convex-hull information is requested. Attackers can supply crafted images processed with convex-hull calculations to corrupt heap memory, causing crashes...

CVE-2026-116148

ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33 are vulnerable to a code injection flaw in the MVG encoder . The root cause is the failure to properly neutralize user-specified drawing options before they are written into the generated MVG output. This allows an attacker capable of ...

CVE-2026-116148 ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Code Injection via MVG Encoder Drawing Options

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains an injection vulnerability in the MVG encoder, which does not properly neutralize user-specified drawing options before writing them into generated MVG output. Attackers who can supply drawing options can inject arbitrary MVG drawing...

CVE-2026-116148 ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Code Injection via MVG Encoder Drawing Options

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains an injection vulnerability in the MVG encoder, which does not properly neutralize user-specified drawing options before writing them into generated MVG output. Attackers who can supply drawing options can inject arbitrary MVG drawing...

CVE-2026-116148

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains an injection vulnerability in the MVG encoder, which does not properly neutralize user-specified drawing options before writing them into generated MVG output. Attackers who can supply drawing options can inject arbitrary MVG drawing...

CVE-2026-116144

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains uncontrolled recursion in the MVG decoder that can lead to a stack overflow. Attackers can supply a crafted MVG file that, when read with specific arguments, exhausts the stack and crashes the process, causing a denial of service...

CVE-2026-116140

The ImageMagick software versions prior to 6.9.13-58 and 7.x before 7.1.2-33 are vulnerable to a policy bypass. The root cause is the incorrect parsing of delegate invocations , which allows an attacker to bypass administrator-defined restrictions in the policy.xml file. By processing specific in...