JLSEC-2026-1035 ImageMagick: Information Disclosure in MNG decoder because allocated memory is left unchanged

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, the MNG decoder contains a possible heap information disclosure vulnerability because part of the pixels are left unchanged. This issue has been fixed in versio...

JLSEC-2026-1019 ImageMagick: Race Condition in distributed pixel cache server can result in file descriptor hijacking

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, an attacker who can connect to a magick -distribute-cache service can hijack a file descriptor in the server process when a race condition is met. This issue ha...

ROOT-APP-NPM-CVE-2026-50015 CVE-2026-50015 in @rootio/pnpm - Patched by Root

Root has patched CVE-2026-50015 in the @rootio/pnpm package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-50014 CVE-2026-50014 in @rootio/pnpm - Patched by Root

Root has patched CVE-2026-50014 in the @rootio/pnpm package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-55487 CVE-2026-55487 in @rootio/pnpm - Patched by Root

Root has patched CVE-2026-55487 in the @rootio/pnpm package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-50573 CVE-2026-50573 in @rootio/pnpm - Patched by Root

Root has patched CVE-2026-50573 in the @rootio/pnpm package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-FR4H-3CPH-29XV GHSA-fr4h-3cph-29xv in @rootio/pnpm - Patched by Root

Root has patched GHSA-fr4h-3cph-29xv in the @rootio/pnpm package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-48995 CVE-2026-48995 in @rootio/pnpm - Patched by Root

Root has patched CVE-2026-48995 in the @rootio/pnpm package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-55180 CVE-2026-55180 in @rootio/pnpm - Patched by Root

Root has patched CVE-2026-55180 in the @rootio/pnpm package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-50017 CVE-2026-50017 in @rootio/pnpm - Patched by Root

Root has patched CVE-2026-50017 in the @rootio/pnpm package for Root:npm. Multiple fixed versions available...

Security Bulletin: IBM Enterprise Build of Quarkus is affected by a DoS vulnerability

Summary IBM Enterprise Build of Quarkus is affected by a DoS vulnerability in Quarkus REST Vulnerability Details CVEID:CVE-2026-16308 DESCRIPTION: Quarkus REST could allow a remote attacker to cause a denial of service due to unbounded accumulation of multipart MIME part-header bytes. CWE:CWE-770...

CVE-2026-62343

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 6.9.13-51 and 7.0.1-0 and above prior to 7.1.2-26, an invalid kernel can cause a heap buffer over-write when performing a morphology operation with a user supplied kernel. This issu...

CVE-2026-62946 ImageMagick: Integer Overflow in JNX decoder causes heap buffer over-write when processing extremly large files on 32-bit builds

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to both 6.9.13-52 and 7.1.2-27, processing an extremely large JNX file on 32-bit platforms can cause an integer overflow, leading to a heap buffer over-write. This issue has been fixed...

CVE-2026-62343 ImageMagick: Heap Buffer Over-Write in morphology operation when an invalid kernel is provided

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 6.9.13-51 and 7.0.1-0 and above prior to 7.1.2-26, an invalid kernel can cause a heap buffer over-write when performing a morphology operation with a user supplied kernel. This issu...

CVE-2026-59899

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, HttpContentEncoder the superclass of the production handler HttpContentCompressor maintains a per-channel ArrayDeque named acceptEncodingQueue that accumulates attacker-controll...

CVE-2026-59899

CVE-2026-59899 in Netty affects the HttpContentEncoder (superclass of HttpContentCompressor) before 4.1.136.Final and 4.2.16.Final. A per-channel ArrayDeque named acceptEncodingQueue accumulates attacker-controlled data with no size limit, filled on the I/O thread for every inbound HTTP request a...

CVE-2026-59900 Netty codec-http2: Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing Bypass

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, Netty's HTTP/2-to-HTTP/1.x translation layer Http2StreamFrameToHttpObjectCodec and InboundHttp2ToHttpAdapter fails to deduplicate or validate Host headers when an HTTP/2 client...

EUVD-2026-50440

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the Bzip2Decoder handler in Netty's compression codec pipeline is vulnerable to a denial-of-service attack through a malformed bzip2 stream that permanently captures the...

CVE-2026-59901 Netty Bzip2Decoder: Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the Bzip2Decoder handler in Netty's compression codec pipeline is vulnerable to a denial-of-service attack through a malformed bzip2 stream that permanently captures the...

CVE-2026-59901

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the Bzip2Decoder handler in Netty's compression codec pipeline is vulnerable to a denial-of-service attack through a malformed bzip2 stream that permanently captures the...