CVE-2026-106580 ImageMagick: Policy Bypass in CUT encoder

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing security-policy check in the CUT encoder allows a crafted local encoding operation to read data that policy should deny and can also cause a crash. This issue ...

CVE-2026-106580 ImageMagick: Policy Bypass in CUT encoder

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing security-policy check in the CUT encoder allows a crafted local encoding operation to read data that policy should deny and can also cause a crash. This issue ...

CVE-2026-106580

ImageMagick is affected by a vulnerability where a missing security-policy check in the CUT encoder allows a local attacker to perform a crafted encoding operation. This flaw enables the bypass of established security restrictions, potentially leading to unauthorized data reading (information dis...

EUVD-2026-94405

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can bypass an ImageMagick security policy that uses coder as its domain, potentially allowing data prohibited by the policy to be read. This issue is fix...

CVE-2026-106579 ImageMagick: Policy Bypass when using coder as the domain.

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can bypass an ImageMagick security policy that uses coder as its domain, potentially allowing data prohibited by the policy to be read. This issue is fix...

CVE-2026-106579

The ImageMagick software is vulnerable to a security policy bypass before versions 7.1.2-31 and 6.9.13-56 . A crafted image can bypass security policies that utilize coder as its domain, potentially allowing an attacker to read data prohibited by the policy. This occurs because the software may p...

CVE-2026-106579 ImageMagick: Policy Bypass when using coder as the domain.

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can bypass an ImageMagick security policy that uses coder as its domain, potentially allowing data prohibited by the policy to be read. This issue is fix...

CVE-2026-106579 ImageMagick: Policy Bypass when using coder as the domain.

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can bypass an ImageMagick security policy that uses coder as its domain, potentially allowing data prohibited by the policy to be read. This issue is fix...

CVE-2026-107278 MISP Object Sync Drops Objects and Attributes When Description Is Empty

MISP contains a validation flaw in its object synchronization logic. When a MISP Object is created without a description, it is stored correctly on the originating instance. However, when that object is replicated to another MISP instance via the sync mechanism, the receiving instance's validatio...

CVE-2026-107278 MISP Object Sync Drops Objects and Attributes When Description Is Empty

MISP contains a validation flaw in its object synchronization logic. When a MISP Object is created without a description, it is stored correctly on the originating instance. However, when that object is replicated to another MISP instance via the sync mechanism, the receiving instance's validatio...

CVE-2026-107278

The MISP platform contains a validation flaw in its object synchronization logic affecting versions

EUVD-2026-94400

MISP contains a validation flaw in its object synchronization logic. When a MISP Object is created without a description, it is stored correctly on the originating instance. However, when that object is replicated to another MISP instance via the sync mechanism, the receiving instance's validatio...

CVE-2026-107278 MISP Object Sync Drops Objects and Attributes When Description Is Empty

MISP contains a validation flaw in its object synchronization logic. When a MISP Object is created without a description, it is stored correctly on the originating instance. However, when that object is replicated to another MISP instance via the sync mechanism, the receiving instance's validatio...

CVE-2026-80902

A flaw was found in the Linux kernel's sun6i-dma component. When Direct Memory Access DMA transfers are terminated, active descriptors are not correctly reclaimed. This issue leads to a permanent memory leak and can also cause corruption of internal data structures within the kernel...

EUVD-2026-94381

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, delegate symlink cleanup does not check the MAGICKSHREDPASSES environment variable, allowing a local privileged workflow to overwrite a file with random data. This issue is fixed in...

CVE-2026-106563

Backstage is an open framework for building developer portals. Prior to 0.21.8, the @backstage/plugin-kubernetes-backend package is affected by improper entity validation in deprecated kubernetes services endpoint. An authenticated user with Kubernetes read permissions could access Kubernetes...

How the Wiz Red Agent caught a Fortune 500 firm’s data exposure (that other tools missed)

Traditional DSPM and classification tools scan from the inside out. Thinking like an attacker, the Red Agent found a public page exposing sensitive data in minutes...

CVE-2026-46438

wger is a free, open-source workout and fitness manager. Prior to version 2.6, an authenticated attacker can inject arbitrary workout log entries into any other user's SlotEntry by supplying the victim's slotentry ID in a POST /api/v2/workoutlog/ request. The slotentry foreign key is not included...

GO-2026-6662 SiYuan: /history/*path and /repo/diff/*path potentially exposing historical snapshots of data/.siyuan/publishAccess.json and data/templates/* in github.com/siyuan-note/siyuan/kernel

SiYuan: /history/path and /repo/diff/path potentially exposing historical snapshots of data/.siyuan/publishAccess.json and data/templates/ in github.com/siyuan-note/siyuan/kernel...

CVE-2026-46438 wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entry

wger is a free, open-source workout and fitness manager. Prior to version 2.6, an authenticated attacker can inject arbitrary workout log entries into any other user's SlotEntry by supplying the victim's slotentry ID in a POST /api/v2/workoutlog/ request. The slotentry foreign key is not included...