SUSE-SU-2026:4265-1 Security update for ImageMagick

This update for ImageMagick fixes the following issues: - CVE-2026-86420: denial of Service due to memory budget exhaustion bsc1279696. - CVE-2026-86421: denial of Service via memory leak in MSL decoder bsc1279711. - CVE-2026-86423: denial of service via heap-use-after-free in PerlMagick's GetLis...

Security update for ImageMagick

This update for ImageMagick fixes the following issues: CVE-2026-86420: denial of Service due to memory budget exhaustion bsc1279696. CVE-2026-86421: denial of Service via memory leak in MSL decoder bsc1279711. CVE-2026-86423: denial of service via heap-use-after-free in PerlMagick's GetList meth...

CVE-2026-35031

CVE-2026-35031: Jellyfin Subtitle Upload Path Traversal to RCE -darkred?style=flat-square -orange?style=flat-square TL;DR A critical path traversal vulnerability in Jellyfin Media Server allows authenticated users with "Upload Subtitles" permission to upload files to arbitrary locations on disk. ...

artemis

Let AI assistants and test suites use real phones like a human. English • 中文文档 • Workflow Showcase • Quick Start • MCP for IDEs • Benchmarks • Discord Community Live Demo: Setup driving routes and calculate total durations in Google Maps, then open YouTube to play a Coldplay song. Key Highlights...

CVE-2025-47812-Wing-FTP-Server-7.4.3-Unauthenticated-RCE-PoC

CVE-2025-47812 — Wing FTP Server Vulnerabilidad de ejecución remota de código no autenticada en Wing FTP Server = 7.4.3. Un byte NULL inyectado en el parámetro username durante el inicio de sesión provoca que se escriba código Lua en el archivo de sesión. Cuando se accede a /dir.html con la cooki...

EUVD-2026-82898

vm2 through 3.12.0 fixed in 3.12.1 does not correctly handle a nullish this receiver in the apply trap of its bridge lib/bridge.js: when sandboxed code calls a host-provided non-strict sloppy-mode function without a receiver — e.g. fn, a detached method, fn.call, fn.applyundefined, Reflect.applyf...

CVE-2026-93603 vm2 before 3.12.1 Sandbox Escape RCE via Non-Strict Host Function

vm2 through 3.12.0 fixed in 3.12.1 does not correctly handle a nullish this receiver in the apply trap of its bridge lib/bridge.js: when sandboxed code calls a host-provided non-strict sloppy-mode function without a receiver — e.g. fn, a detached method, fn.call, fn.applyundefined, Reflect.applyf...

CVE-2026-93603 vm2 before 3.12.1 Sandbox Escape RCE via Non-Strict Host Function

vm2 through 3.12.0 fixed in 3.12.1 does not correctly handle a nullish this receiver in the apply trap of its bridge lib/bridge.js: when sandboxed code calls a host-provided non-strict sloppy-mode function without a receiver — e.g. fn, a detached method, fn.call, fn.applyundefined, Reflect.applyf...

CVE-2026-93603

vm2 (Node.js sandbox library) through 3.12.0 is vulnerable to a complete sandbox escape due to incorrect handling of a nullish this receiver in the apply trap of its bridge (lib/bridge.js). When sandboxed code invokes a host-provided non-strict (sloppy-mode) function without a receiver (e.g., fn(...

CVE-2026-93603 vm2 before 3.12.1 Sandbox Escape RCE via Non-Strict Host Function

vm2 through 3.12.0 fixed in 3.12.1 does not correctly handle a nullish this receiver in the apply trap of its bridge lib/bridge.js: when sandboxed code calls a host-provided non-strict sloppy-mode function without a receiver — e.g. fn, a detached method, fn.call, fn.applyundefined, Reflect.applyf...

CVE-2026-93586

ImageMagick versions prior to 7.1.2-31 and 6.9.13-56 contain a use-after-free vulnerability in the ImagesToBlob method, caused by a pointer that is not updated correctly. The impact is limited to availability—exploit may cause a crash of the affected process , with no stated confidentiality or in...

CVE-2026-93586

ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a use-after-free vulnerability in the ImagesToBlob method, caused by a pointer that is not updated correctly. Exploitation may result in a limited availability impact e.g., a crash of the affected process. The issue is fixed in versions...

CVE-2026-93586 ImageMagick before 7.1.2-31 Use After Free via ImagesToBlob

ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a use-after-free vulnerability in the ImagesToBlob method, caused by a pointer that is not updated correctly. Exploitation may result in a limited availability impact e.g., a crash of the affected process. The issue is fixed in versions...

CVE-2026-93586 ImageMagick before 7.1.2-31 Use After Free via ImagesToBlob

ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a use-after-free vulnerability in the ImagesToBlob method, caused by a pointer that is not updated correctly. Exploitation may result in a limited availability impact e.g., a crash of the affected process. The issue is fixed in versions...

CVE-2026-93586 ImageMagick before 7.1.2-31 Use After Free via ImagesToBlob

ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a use-after-free vulnerability in the ImagesToBlob method, caused by a pointer that is not updated correctly. Exploitation may result in a limited availability impact e.g., a crash of the affected process. The issue is fixed in versions...

EUVD-2026-82905

ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a use-after-free vulnerability in the ImagesToBlob method, caused by a pointer that is not updated correctly. Exploitation may result in a limited availability impact e.g., a crash of the affected process. The issue is fixed in versions...

CVE-2026-66754-Remote-Denial-of-Service-via-Reachable-Assertion-in-URL-Prefix-Handling-rouille-

Security Advisory: Remote Denial of Service via Reachable Assertion in URL Prefix Handling rouille Assigned CVE ID: CVE-2026-66754 Summary Request::removeprefix tests the percent-decoded URL but asserts on the raw one. A request whose decoded path starts with the prefix while its raw path does no...

CVE-2018-15961

CVE-2018-15961 - Adobe ColdFusion 2018 RCE Este repositorio contiene mi código de exploit para la vulnerabilidad RCE en Adobe ColdFusion 2018. Descripción del Exploit El exploit envía una solicitud POST que contiene una reverse shell JSP a...

Opencast: Stored XSS in Paella player via WebVTT/DFXP caption cue text

Summary The Opencast Paella player renders caption cue text into innerHTML without escaping. The captions canvas clears captionsContainer.innerHTML and then appends each active cue with captionsContainer.innerHTML += cue, so HTML inside a WebVTT or DFXP cue becomes live DOM and executes in the...

GHSA-M6C8-JCW2-5R25 Opencast: Stored XSS in Paella player via WebVTT/DFXP caption cue text

Summary The Opencast Paella player renders caption cue text into innerHTML without escaping. The captions canvas clears captionsContainer.innerHTML and then appends each active cue with captionsContainer.innerHTML += cue, so HTML inside a WebVTT or DFXP cue becomes live DOM and executes in the...