JLSEC-2026-1078 ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the TIFF encoder when an...

ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the TIFF encoder when an invalid tiff:tile-geometry is specified. Supplying malformed tile geometry parameters causes allocated memory not to be released, which can lead to increased memory consumption...

JLSEC-2026-1032 ImageMagick: Memory Leak in wand option parser when providing invalid arguments

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-25, when providing invalid options to the wand option parser a small memory leak will occur. This issue has been patched in version 7.1.2-25...

JLSEC-2026-1051

ImageMagick before 7.1.2-19 contains an out-of-bounds access vulnerability in ConnectedComponentsImage when processing connected-components artifacts with invalid indices. Attackers can trigger access violations by specifying malformed connected-components definitions via CLI, causing denial of...

JLSEC-2026-1039 ImageMagick: Infinite Loop in connected-components when providing invalid arguments

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, when providing invalid arguments to the connected-components option an infinite loop will occur. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26...

CVE-2026-62343

A flaw was found in ImageMagick, a widely used software for editing and manipulating digital images. A local user could provide a specially crafted, invalid kernel during a morphology operation. This action could trigger a heap buffer over-write, leading to a denial of service DoS for the...

CVE-2026-44102

An unauthenticated remote attacker can trigger a firmware update download via the OCPP backend by supplying an invalid firmware file. This will cause the file to remain accessible for a short period before it is deleted due to improper locking during the cleanup process...

CVE-2026-44102 OCPP Firmware download is not properly locked

An unauthenticated remote attacker can trigger a firmware update download via the OCPP backend by supplying an invalid firmware file. This will cause the file to remain accessible for a short period before it is deleted due to improper locking during the cleanup process...

EUVD-2026-51037

An unauthenticated remote attacker can trigger a firmware update download via the OCPP backend by supplying an invalid firmware file. This will cause the file to remain accessible for a short period before it is deleted due to improper locking during the cleanup process...

CVE-2026-44102

CVE-2026-44102 affects an OCPP backend firmware download workflow. An unauthenticated remote attacker can supply an invalid firmware file to trigger a download, leaving the file accessible for a short period before cleanup deletes it due to improper locking. This can result in brief exposure of t...

SUSE-SU-2026:22996-1 Security update for ignition

This update for ignition fixes the following issues: - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266606. - CVE-2026-56852: golang.org/x/text/unicode/norm: handling of input containing inval...

CVE-2026-64488

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture ALSA 'aoa' component. This vulnerability arises when a specific function, sndctlnew1, fails to allocate memory and returns an invalid pointer. The kernel then attempts to use this invalid pointer, which can cause the system ...

RockyLinux 10 : firefox (RLSA-2026:47101)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:47101 advisory. firefox: thunderbird: Site isolation issue in the DOM: Navigation component CVE-2026-15719 firefox: thunderbird: Invalid pointer in the JavaScript:...

CVE-2026-62343 ImageMagick: Heap Buffer Over-Write in morphology operation when an invalid kernel is provided

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 6.9.13-51 and 7.0.1-0 and above prior to 7.1.2-26, an invalid kernel can cause a heap buffer over-write when performing a morphology operation with a user supplied kernel. This issu...

CVE-2026-62343 ImageMagick: Heap Buffer Over-Write in morphology operation when an invalid kernel is provided

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 6.9.13-51 and 7.0.1-0 and above prior to 7.1.2-26, an invalid kernel can cause a heap buffer over-write when performing a morphology operation with a user supplied kernel. This issu...

CVE-2026-62343

CVE-2026-62343 – ImageMagick heap buffer over-write during morphology with a user-supplied invalid kernel. Affected products/versions: ImageMagick before 6.9.13-51 and 7.0.1-0, and before 7.1.2-26. The flaw is triggered during morphology operations using a crafted kernel, leading to a heap buffer...

net/url: Incorrect parsing of IPv6 host literals in net/url

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...

golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input

A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 Unicode Transformation Format - 8-bit bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of...

CVE-2026-16728

undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a malicious or faulty...

kernel: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available

A flaw was found in KVM in the Linux kernel. This vulnerability occurs due to improper validation of memory management unit MMU page roots after these pages are made available. An attacker could exploit this by triggering a scenario where KVM attempts to map memory into an invalid root, causing...

CVE-2026-64275

A flaw was found in the Linux kernel's Elan I2C touchpad driver. This vulnerability occurs when the driver receives invalid zero values for touchpad dimensions from device firmware or the device tree, or when a calculated width is too small. A local attacker with control over device input or a...