Expired Pointer Dereference

Overview Affected versions of this package are vulnerable to Expired Pointer Dereference in the MSL interpreter. An attacker can cause the application to crash by submitting an image file containing a malicious MSL element. Remediation A fix was pushed into the master branch but not yet published...

Infinite loop

Overview Affected versions of this package are vulnerable to Infinite loop in the formatIPTC function. An attacker can cause the application to enter an infinite loop and exhaust system resources by supplying a malicious image profile containing invalid IPTC data. Remediation A fix was pushed int...

Off-by-one Error

Overview Affected versions of this package are vulnerable to Off-by-one Error in CastDoubleToInt calculations. An attacker can cause the application to crash or become unresponsive by supplying a malicious SVG file. Remediation A fix was pushed into the master branch but not yet published...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read in the MAP image decoding. An attacker can cause application crashes or access unintended memory contents by submitting specially crafted MAP files. Remediation A fix was pushed into the master branch but not yet...

CVE-2025-70043

An issue pertaining to CWE-295: Improper Certificate Validation was discovered in Ayms node-To master. The application disables TLS/SSL certificate validation by setting 'rejectUnauthorized': false in TLS socket options...

CVE-2025-70045

An issue pertaining to CWE-295: Improper Certificate Validation was discovered in jxcore jxm master. The application disables TLS/SSL certificate validation by setting 'rejectUnauthorized': false in HTTPS request options when 'jxobj.IsSecure' is true...

Expired Pointer Dereference

Overview Affected versions of this package are vulnerable to Expired Pointer Dereference in ReadBlobString, when handling MSL scripts. An attacker can cause a denial of service by submitting malicious MSL input that triggers a heap-use-after-free condition. Remediation A fix was pushed into the...

Unchecked Input for Loop Condition

Overview Affected versions of this package are vulnerable to Unchecked Input for Loop Condition when handling MSL files. An attacker can cause a stack overflow and disrupt service availability by submitting malicious MSL files. Remediation A fix was pushed into the master branch but not yet...

Missing Release of Resource after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime in ashlar.c‎. An attacker can cause increased memory consumption and potential service disruption. Remediation A fix was pushed into the master branch but not yet published. Reference...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection in PostScript header processing. An attacker can execute malicious code by submitting a file that is processed by a printer or viewer. Workaround This vulnerability can be mitigated by disabling the PostScript P...

Missing Release of Memory after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime in the ReadSTEGANOImage function. An attacker can cause the application to exhaust system memory and become unavailable. Remediation A fix was pushed into the master branch but not yet...

Missing Release of Memory after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime via the WriteMSLImage function in coders/msl.c. An attacker can cause resource exhaustion and disrupt service availability by submitting malicious MSL files that trigger unreleased memo...

Heap-based Buffer Overflow

Overview Affected versions of this package are vulnerable to Heap-based Buffer Overflow in the -extract process when the specified dimensions exceed those set by -size. An attacker can access sensitive information by submitting specially crafted image files that trigger out-of-bounds memory reads...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure in the NnefPfdManagement process. An attacker can obtain internal parsing error details by sending crafted requests that trigger error conditions, which may allow them to fingerprint server software and logic flows...

Expected Behavior Violation

Overview Affected versions of this package are vulnerable to Expected Behavior Violation via the PFCP Association Setup Request process. An attacker can cause service disruption and trigger reconnection loops by sending a malformed request that is incorrectly accepted, resulting in an inconsisten...

CVE-2025-70043

An issue pertaining to CWE-295: Improper Certificate Validation was discovered in Ayms node-To master. The application disables TLS/SSL certificate validation by setting 'rejectUnauthorized': false in TLS socket options...

Password managers keep your passwords safe, unless…

I’m a big advocate of password managers. Granted, there are better alternatives for passwords like passkeys, but if a provider offers nothing but password options, which many do, you can’t do much about that. So, for the time being we seem to be stuck with passwords. Every reputable password...

CVE-2025-70045

An issue pertaining to CWE-295: Improper Certificate Validation was discovered in jxcore jxm master. The application disables TLS/SSL certificate validation by setting 'rejectUnauthorized': false in HTTPS request options when 'jxobj.IsSecure' is true...

PT-2026-21522

Name of the Vulnerable Software and Affected Versions jxcore jxm master Description The application disables TLS/SSL certificate validation by setting 'rejectUnauthorized': false in HTTPS request options when jx obj.IsSecure is true. This improper certificate validation could allow for...

CVE-2025-70043

An issue pertaining to CWE-295: Improper Certificate Validation was discovered in Ayms node-To master. The application disables TLS/SSL certificate validation by setting 'rejectUnauthorized': false in TLS socket options...