CVE-2026-22770

ImageMagick is free and open-source software used for editing and manipulating digital images. The BilateralBlurImage method will allocate a set of double buffers inside AcquireBilateralTLS. But, in versions prior to 7.1.2-13, the last element in the set is not properly initialized. This will...

CVE-2026-22770 ImageMagick vulnerable to Release of Invalid Pointer in BilateralBlur when memory allocation fails

ImageMagick is free and open-source software used for editing and manipulating digital images. The BilateralBlurImage method will allocate a set of double buffers inside AcquireBilateralTLS. But, in versions prior to 7.1.2-13, the last element in the set is not properly initialized. This will...

CVE-2026-22770

CVE-2026-22770 affects ImageMagick: in BilateralBlurImage, the last element of a double-buffer set isn’t properly initialized inside AcquireBilateralTLS, leading to an invalid pointer being freed in DestroyBilateralTLS when memory allocation fails. The issue is fixed in version 7.1.2-13. Connecte...

CVE-2026-22770

ImageMagick is free and open-source software used for editing and manipulating digital images. The BilateralBlurImage method will allocate a set of double buffers inside AcquireBilateralTLS. But, in versions prior to 7.1.2-13, the last element in the set is not properly initialized. This will...

Turbo security vulnerabilities

Turbo is a code development tool open source by Hotwire. Versions of Turbo prior to 8.0.x contained security vulnerabilities. These vulnerabilities stemmed from race conditions in the turbo-frame element handler, which could lead to failed logouts and the reapplication of session cookies after a...

CVE-2025-66803

Race condition in the turbo-frame element handler in Hotwired Turbo before 8.0.x causes logout operations to fail when delayed frame responses reapply session cookies after logout. This can be exploited by remote attackers via selective network delays e.g. delaying requests based on sequence or...

MiracleLinux 9 : glibc-2.34-100.el9_4.2 (AXSA:2024-8145:06)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-8145:06 advisory. glibc: Out of bounds write in iconv conversion to ISO-2022-CN-EXT CVE-2024-2961 glibc: stack-based buffer overflow in netgroup cache CVE-2024-33599...

The vulnerability of the audin_process_formats() function in the RDP client of FreeRDP, allowing a hacker to execute arbitrary code or cause a service failure.

The vulnerability of the audinprocessformats function in the RDP client FreeRDP is related to writing beyond the buffer boundaries. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code or cause service failures remotely...

The vulnerability of the client for USB devices in the URBDRC RDP-client FreeRDP system allows a perpetrator to execute arbitrary code or cause a service failure.

The vulnerability of the URBDRC RDP-client-freeRDP device lies in unvalidated array indexing. Exploiting this vulnerability could allow an attacker to execute arbitrary code or cause service failures...

MiracleLinux 4 : bind-9.8.2-0.68.8.0.1.rc1.AXS4 (AXSA:2020-735:07)

The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2020-735:07 advisory. bind: truncated TSIG response can lead to an assertion failure CVE-2020-8622 Tenable has extracted the preceding description block directly from the...

MiracleLinux 8 : grub2-2.02-78.0.2.el8 (AXSA:2020-283:03)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2020-283:03 advisory. grub2: grub2-set-bootflag utility causes grubenv corruption rendering the system non-bootable CVE-2019-14865 Tenable has extracted the preceding description...

CVE-2025-66803

Race condition in the turbo-frame element handler in Hotwired Turbo before 8.0.x causes logout operations to fail when delayed frame responses reapply session cookies after logout. This can be exploited by remote attackers via selective network delays e.g. delaying requests based on sequence or...

CVE-2025-66803

Race condition in the turbo-frame element handler in Hotwired Turbo before 8.0.x causes logout operations to fail when delayed frame responses reapply session cookies after logout. This can be exploited by remote attackers via selective network delays e.g. delaying requests based on sequence or...

MiracleLinux 9 : keylime-7.3.0-13.el9_3 (AXSA:2024-7584:01)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2024-7584:01 advisory. keylime: Attestation failure when the quote's signature does not validate CVE-2023-3674 Tenable has extracted the preceding description block directly from t...

MiracleLinux 4 : thunderbird-78.9.1-1.0.1.AXS4 (AXSA:2021-1692:07)

The remote MiracleLinux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2021-1692:07 advisory. Mozilla: An attacker may use Thunderbird's OpenPGP key refresh mechanism to poison an existing key CVE-2021-23991 Mozilla: A crafted OpenPGP key wit...

MiracleLinux 9 : dbus-1.12.20-7.el9.1 (AXSA:2023-6323:07)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2023-6323:07 advisory. dbus: dbus-daemon: assertion failure when a monitor is active and a message from the driver cannot be delivered CVE-2023-34969 Tenable has extracted the...

MiracleLinux 8 : fwupd-1.1.4-7.0.1.el8, grub2-2.02-87.0.1.el8, shim-15-15.0.1, shim-unsigned-x64-15-8.0.1.el8 (AXSA:2020-773:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2020-773:01 advisory. grub2: Crafted grub.cfg file can lead to arbitrary code execution during boot process CVE-2020-10713 grub2: grubmalloc does not validate allocation...

MiracleLinux 8 : bind-9.11.20-5.el8 (AXSA:2021-1277:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2021-1277:01 advisory. bind: asterisk character in an empty non-terminal can cause an assertion failure in rbtdb.c CVE-2020-8619 bind: truncated TSIG response can lead to ...

MiracleLinux 8 : dotnet5.0-5.0.208-1.el8.ML.1 (AXSA:2021-2473:12)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2021-2473:12 advisory. dotnet: System.DirectoryServices.Protocols.LdapConnection sends credentials in plaintext if TLS handshake fails CVE-2021-41355 Tenable has extracted the...

PT-2026-3642

Name of the Vulnerable Software and Affected Versions Hotwired Turbo versions prior to 8.0.0 Description A race condition exists in the turbo-frame element handler. This issue can cause logout operations to fail when delayed frame responses reapply session cookies after a user has logged out...