Security update for ImageMagick

This update for ImageMagick fixes the following issues CVE-2026-56375: possible memory leak in ASHLAR coder when action fails bsc1271495. CVE-2026-61464: heap buffer overwrite in X11 import with crafted window title bsc1271496. CVE-2026-61859: policy bypass in script operation due to missing chec...

CVE-2026-44190

A flaw was found in the Ansible Lightspeed Visual Studio Code extension. This Command Injection vulnerability CWE-78 allows a remote attacker to execute unauthorized commands on a user's system. The issue occurs because the ansible.python.activationScript setting, intended for a virtual environme...

EUVD-2026-47651

A flaw was found in the Ansible Lightspeed Visual Studio Code extension. This Command Injection vulnerability CWE-78 allows a remote attacker to execute unauthorized commands on a user's system. The issue occurs because the ansible.python.activationScript setting, intended for a virtual environme...

CVE-2026-44190 Ansible-lightspeed: ansible lightspeed visual studio code extension: arbitrary code execution via command injection in activation script setting

A flaw was found in the Ansible Lightspeed Visual Studio Code extension. This Command Injection vulnerability CWE-78 allows a remote attacker to execute unauthorized commands on a user's system. The issue occurs because the ansible.python.activationScript setting, intended for a virtual environme...

CVE-2026-44190

A flaw was found in the Ansible Lightspeed Visual Studio Code extension. This Command Injection vulnerability CWE-78 allows a remote attacker to execute unauthorized commands on a user's system. The issue occurs because the ansible.python.activationScript setting, intended for a virtual environme...

CVE-2026-12968

The Product Addons and Product Options With Custom Fields WordPress plugin before 1.6.15 does not restrict an unauthenticated file-upload endpoint and accepts SVG files that are stored and served inline, allowing an unauthenticated attacker to upload a malicious SVG whose embedded script executes...

CVE-2026-12968

The Product Addons and Product Options With Custom Fields WordPress plugin before 1.6.15 does not restrict an unauthenticated file-upload endpoint and accepts SVG files that are stored and served inline, allowing an unauthenticated attacker to upload a malicious SVG whose embedded script executes...

Security Bulletin: IBM Db2 Mirror for i is affected by multiple vulnerabilities due to Angular [CVE-2026-50170, CVE-2026-50171, CVE-2026-54266, CVE-2026-54268, CVE-2026-50557, CVE-2026-52725, CVE-2026-54267, CVE-2026-54265]

Summary The IBM Db2 Mirror for i GUI uses the Angular web framework. The version of Angular used by IBM Db2 Mirror for i is vulnerable to leaking information by transferring cache state to the client-side application CVE-2026-50170 and using a weak hash function for the server-side cached respons...

PT-2026-63507

Name of the Vulnerable Software and Affected Versions Sourcerer extension affected versions not specified Description Multiple code injection vectors exist within the extension. The Free version fails to verify that both the article creator and the last modifier possess Super User privileges befo...

The vulnerability in the /web/jquery/uploader/multi Uploadify.php script of the D-Link DNS-320 network storage software allows a attacker to execute arbitrary code and gain full access to the system.

The vulnerability in the /web/jquery/uploader/multiUploadify.php script of the D-Link DNS-320 network storage software relates to the unlimited uploading of dangerous types of files. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code and gain full access to the...

PT-2026-63421

Name of the Vulnerable Software and Affected Versions Analog Way Picturall Quad Compact Mark II version 3.5.8 Description A local privilege escalation flaw exists in the core firmware due to improper privilege delegation and insufficient input validation within a maintenance script. The create...

Plone 2.5.5 < 4.3.16 / 5.0.x < 5.0.10 Multiple Vulnerabilities (HF 20171128)

The version of Plone installed on the remote host is 2.5.5 prior to 4.3.16, 5.0.x prior to 5.0.10. It is, therefore, affected by the following vulnerabilities: - When you visit a page where you need to login, sends you to the login form with a 'camefrom' parameter set to the previous url...

Analog Way Picturall Quad Compact Mark II contains a local privilege escalation vulnerability

Overview Version 3.5.8 of Analog Way's Picturall Quad Compact Mark II server contains a local privilege escalation vulnerability, tracked as CVE-2026-14985, due to improper privilege delegation and insufficient input validation in a maintenance script. Description The Picturall Quad Compact Mark ...

CVE-2026-43946

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. Version 1.3.0 has an authorization bypass in the /api/getTagValue endpoint allows unauthenticated access to tag values when the referenced script does not exist. Version 1.3.1 patches the issue...

CVE-2026-43946 FUXA has an unauthenticated arbitrary tag value disclosure via /api/getTagValue

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. Version 1.3.0 has an authorization bypass in the /api/getTagValue endpoint allows unauthenticated access to tag values when the referenced script does not exist. Version 1.3.1 patches the issue...

GHSA-2P49-HGCM-8545 SVGO removeScripts plugin leaves some executable scripts intact

Summary SVGO's removeScripts plugin disabled by default removes scripts from the SVG, however executable scripts were left intact in some cases. If a consumer relied on this plugin for sanitization and served them to users, these SVGs could open up doors to XSS. Details SVGO has a plugin for...

CVE-2026-65048

Ninja Forms plugin for WordPress versions 3.10.4 through 3.14.9 contains an unauthenticated stored cross-site scripting vulnerability in the Repeatable Fieldset feature where parseSubmissionIndex accepts arbitrary strings as submission indexes without numeric validation, and adminformelement...

CVE-2026-15145

The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Fancy Text Widget in all versions up to, and including, 6.6.11 due to insufficient input sanitization and output escaping. This makes it possible for...

MAL-2026-10977 Malicious code in lebinfmt (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 448ec8ad7c978d60f142f12780be3bb6ae7b90870fa4c2bf2d50ca7d4111cdfd This package is prepared to perform steganography decoding using the same code and was published on the same day as package 'rasterkit,' later used to deliver...

MAL-2026-10974 Malicious code in rasterkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a6eea31746baa37e55a76fec564eda1852839be005d53ae1e24bf2b9ea4c7875 This package is a clone of Pillow library with malicious code hidden in an image using steganography. The code is the used in a dependant package to install an...