247022 matches found
CVE-2026-105823 ImageMagick before 7.1.2-31 Policy Bypass in CUT Encoder
ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 lacks a security policy check in the CUT encoder, allowing configured security policies to be bypassed. Attackers can supply crafted input processed by the CUT encoder to crash the application or leak sensitive data...
CVE-2026-105405 ImageMagick before 7.1.2-31 Invalid Memory Free in MVG Decoder
ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 contains an invalid memory free vulnerability in the MVG decoder. Attackers can supply a crafted MVG image for processing to trigger the invalid free and crash the application, causing a denial of service...
CVE-2026-105404 ImageMagick before 7.1.2-31 Code Injection via PostScript Coders
ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 contains a code injection vulnerability in its PostScript coders, because some values are not properly escaped or trimmed when written to output. Attackers can supply crafted values that embed arbitrary PostScript code into files generated by...
CVE-2026-105402 ImageMagick before 7.1.2-31 Denial of Service via XMP Profile Parsing
ImageMagick before 7.1.2-31 contains a denial of service vulnerability that allows attackers to disrupt processing by supplying a crafted XMP profile. Attackers can embed a malicious XMP profile that triggers a failure when determining the numerator and denominator, crashing or hanging image...
CVE-2026-105403 ImageMagick before 7.1.2-31 Security Policy Bypass via Coder Domain
ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 allows a security policy bypass when a policy uses coder, rather than module, as its domain. An attacker can supply a crafted image to evade coder-based policy restrictions, causing ImageMagick to process formats the administrator intended to...
CVE-2026-105400 ImageMagick before 7.1.2-31 Unclosed File Pointer via Magick Script
ImageMagick before 7.1.2-31 contains a resource leak vulnerability that allows attackers to leave file pointers open by supplying a crafted magick script. Attackers can process malicious magick scripts to leak file descriptors, potentially exhausting resources and causing denial of service...
CVE-2026-105401 ImageMagick before 7.1.2-31 Heap Buffer Overflow in Distributed Pixel Cache Server
ImageMagick before 7.1.2-31 contains a heap buffer overflow vulnerability in the distributed pixel cache server that allows connecting clients to overwrite heap memory by sending crafted data. Attackers can connect to the distributed pixel cache server and transmit malicious data to trigger a hea...
CVE-2026-105399 ImageMagick before 7.1.2-31 Denial of Service via MVG Decoder
ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 contains a denial of service vulnerability in the MVG decoder caused by a missing limit check. Attackers can supply a crafted MVG image that triggers a long-running decoding operation, consuming excessive CPU resources and stalling image...
CVE-2026-105398 ImageMagick before 7.1.2-31 Heap Buffer Overflow via GetVirtualPixels API
ImageMagick before 7.1.2-31 contains a heap buffer overflow vulnerability that allows attackers to overwrite heap memory by making a crafted call to the GetVirtualPixels API. Attackers can trigger the out-of-bounds heap write through crafted input to crash the server, causing a denial of service...
CVE-2026-104634 beam_mcp: JSON boolean and null tool arguments reach dispatch as strings
Incorrect Type Conversion or Cast vulnerability in BeamMCP.Server in ScriptKittyOS beammcp allows an MCP client's JSON true, false and null tool arguments to reach the host's dispatch function as the strings "true", "false" and "nil". After BeamMCP.Schema.validate/2 accepted a value as a boolean,...
CVE-2026-88257 beam_mcp: nested tool argument constraints advertised but not enforced
Improper Input Validation vulnerability in BeamMCP.Schema in ScriptKittyOS beammcp allows an MCP client to reach a tool's dispatch function with arguments that violate the input schema the server advertised. BeamMCP.Schema.validate/2 checked type, required, additionalProperties, enum and numeric...
CVE-2026-103663 Path Traversal leading to Remote Code Execution in Ollama
Ollama is vulnerable to path traversal in the /api/pull endpoint due to insufficient validation of layer digests by the digestToPath function. An unauthenticated remote attacker can specify a path traversal sequence as a layer digest, causing a malicious binary to be written outside the model...
CVE-2026-44034
A heap-based out-of-bounds read in DcmRLECodecDecoder::decodeFrame in dcmdata/libsrc/dcrleccd.cc of OFFIS DCMTK 3.7.0 allows an attacker to read up to 63 bytes of adjacent heap memory, or cause a crash, via a crafted RLE Lossless DICOM file whose pixel data fragment is shorter than the 64-byte RL...
CVE-2026-44035
Uncontrolled recursion in DcmDicomDir::moveRecordToTree in dcmdata/libsrc/dcdicdir.cc of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service stack exhaustion and process crash via a crafted DICOMDIR file with a deeply chained sequence of directory records linked through the Offset o...
CVE-2026-44036
Uncontrolled mutual recursion between DcmXMLParseHelper::parseDataSet and DcmXMLParseHelper::parseSequence in the XML-to-DICOM converter dcmdata/libdcxml/xml2dcm.cc of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service stack exhaustion and process crash via a crafted XML file with...
CVE-2026-44031
Uncontrolled recursion in DcmSequenceOfItems::read and DcmItem::read in the dcmdata library of OFFIS DCMTK 3.7.0 allows a remote, unauthenticated attacker to cause a denial of service stack exhaustion and process crash via a DICOM dataset containing deeply nested sequences SQ elements. The datase...
CVE-2026-44037
Uncontrolled mutual recursion between DcmJSONReader::parseDataSet, DcmJSONReader::parseElement and DcmJSONReader::parseSequence in dcmdata/libsrc/dcjsonrd.cc of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service stack exhaustion and process crash via a crafted DICOM JSON document...
CVE-2026-44038
A global out-of-bounds read in the Huffman decoder of the bundled IJG JPEG libraries dcmjpeg/libijg8, libijg12 and libijg16 of OFFIS DCMTK 3.7.0 allows an attacker to read memory beyond the extendtest and extendoffset tables, causing incorrectly decoded pixel data or a crash, via a DICOM file wit...
CVE-2026-44033
Uncontrolled recursion in XMLNode::ParseXMLElement and XMLNode::emptyTheNode in the bundled XML parser ofstd/libsrc/ofxml.cc of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service stack exhaustion and process crash via a crafted XML document with deeply nested elements. The parser i...
CVE-2026-107584 Not Failing Securely ('Failing Open') in hMailServer
Progressive Robot hMailServer 6.0.0 through 6.3.5 fails open when applying DANE RFC 7672 to outbound SMTP delivery. The server's validating DNSSEC resolver treated a TLSA or MX lookup that did not complete no answer, SERVFAIL, a malformed reply, an answer without the requested records and without...
CVE-2026-107583 Inefficient Algorithmic Complexity in hMailServer
Inefficient algorithmic complexity in the webmail's message view of the REST API in Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote unauthenticated attacker to make the webmail, the administration console and the REST API unavailable by sending a message. The route that renders ...
CVE-2026-107587 Improper Certificate Validation in hMailServer
Improper certificate validation in the webmail of Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote unauthenticated attacker to have S/MIME-encrypted mail that the account later sends to another correspondent also encrypted to the attacker's key. When its recipient opened a signed...
CVE-2026-107582 Inefficient Algorithmic Complexity in hMailServer
Inefficient algorithmic complexity in the REST API 6.3.3 through 6.3.5 and the IMAP PREVIEW response 6.2.22 through 6.3.5 of Progressive Robot hMailServer allows a remote unauthenticated attacker to make the webmail, the administration console and the REST API unavailable by sending a message. To...
CVE-2026-107581 Inefficient Algorithmic Complexity in hMailServer
Progressive Robot hMailServer 6.0.0 through 6.3.5 processes several IMAP commands from a signed-in account in time quadratic in the command's length or in the number of elements it names, and can be made to hold memory out of proportion to a command. The FETCH data-item parser normalised a BODY...
CVE-2026-107580 Inefficient Algorithmic Complexity in hMailServer
Inefficient algorithmic complexity in the decoding of message header fields in Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a remote unauthenticated attacker to make the IMAP, SMTP and POP3 services, or the webmail, unavailable by sending a message. The server unfolded a decoded heade...
CVE-2026-107579 Inefficient Algorithmic Complexity in hMailServer
Inefficient algorithmic complexity in the bounce and complaint processing of Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated attacker to stop mail delivery by sending messages, when bounce processing or complaint processing is enabled or a mailing list is managed by...
CVE-2026-107578 Improper Link Resolution Before File Access ('Link Following') in hMailServer
Improper link resolution and external control of file paths in the administrative command-line operations of hMailServer.exe in Progressive Robot hMailServer 6.3.4 and 6.3.5 allow a local attacker who already runs code as the low-privilege service account to escalate privilege. On Windows,...
CVE-2026-107576 Inefficient Algorithmic Complexity in hMailServer
Inefficient algorithmic complexity in the inbound DKIM and ARC signature verification of Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a remote unauthenticated attacker to make the mail services unavailable by sending a message. Building the canonical header and choosing the header...
CVE-2026-107577 Loop with Unreachable Exit Condition ('Infinite Loop') in hMailServer
Inefficient algorithmic complexity and a non-terminating loop in the MIME processing of received messages in Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a remote unauthenticated attacker to make the mail services unavailable by sending a message. Removing a MIME header parameter whose...
CVE-2026-107575 Inefficient Algorithmic Complexity in hMailServer
Inefficient algorithmic complexity in the SPF macro expansion of Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated attacker to consume worker-thread time by publishing a crafted SPF record. RFC 7208 section 7.1 requires a name too long to look up to lose whole labels...
CVE-2026-107572 Inefficient Regular Expression Complexity in hMailServer
Inefficient complexity in the Sieve filter evaluation of Progressive Robot hMailServer 6.2.24 through 6.3.5 allows an authenticated account holder to make the mail services unavailable with their own filter. A ':matches' pattern was matched by a backtracking descent whose time grew with the match...
CVE-2026-107573 Incorrect Default Permissions in hMailServer
Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a local authenticated user to read the mail server's data. The installer created the data, log, temp, database and event folders and the hMailServer.INI configuration file with the...
CVE-2026-107574 Inefficient Algorithmic Complexity in hMailServer
Inefficient algorithmic complexity in the JSON reader of Progressive Robot hMailServer allows a remote unauthenticated attacker to make the mail services unavailable. Reading a JSON object kept the first of each duplicated member name by searching the members already read, so an object of N...
CVE-2026-107570 Use of Out-of-range Pointer Offset in mutt
heap OOB write in convertfilefromto via a crafted Content-Type header allows attacker to OOB write when email is used as a template...
CVE-2026-107275 @fastify/jwt vulnerable to missing token expiration when temporal options cannot be parsed
@fastify/jwt is a JSON Web Token plugin for the Fastify web framework. In versions before 10.2.3, a time span passed to expiresIn, notBefore, or maxAge that the plugin's parser cannot read, such as a compound span, a month unit, an ISO 8601 duration, a decimal comma, or a value with surrounding...
CVE-2026-103011 Heap-based Buffer Overflow in hMailServer
Heap-based buffer overflow in the legacy Blowfish encryption routine BlowFishEncryptor::Encode, called by EncryptToString in Progressive Robot hMailServer 6.0.0 through 6.3.5 allows an authenticated mailbox user to cause a denial of service service crash, and possibly other unspecified impact. In...
CVE-2026-103010 Heap-based Buffer Overflow in hMailServer
Heap-based buffer overflow in the legacy Blowfish decryption routine BlowFishEncryptor::DecryptFromString in Progressive Robot hMailServer 6.0.0 through 6.3.3 on Windows allows a local interactive user with no hMailServer credentials to write bytes of their choosing past the end of a 255-byte hea...
CVE-2026-103647 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in hMailServer
Cross-site scripting in the webmail of Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote attacker who can send a user an encrypted message to run script in the webmail's origin with that user's session. When the webmail decrypted an S/MIME message from 6.3.2 or an OpenPGP message...
CVE-2026-103649 Synchronous Access of Remote Resource without Timeout in hMailServer
Missing network timeouts in the Linux builds of Progressive Robot hMailServer 6.3.0 through 6.3.5 allow a remote attacker to hold server threads indefinitely and so stop outbound mail delivery denial of service. The server set its socket timeouts in the form Windows takes, which Linux refuses, an...
CVE-2026-104659 Origin Validation Error in hMailServer
Missing Host header validation and missing throttling of failed administrator sign-ins in the REST API listener of Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a remote attacker to brute-force the server administrator's password through the administrator's own browser by DNS rebinding...
CVE-2026-104660 Missing Authorization in hMailServer
Missing authorization on COM objects in Progressive Robot hMailServer 6.0.0 through 6.3.5 Windows only lets a local interactive user with no hMailServer credential read and write arbitrary files as the service account and queue mail as any sender. The service registers its COM classes with no DCO...
CVE-2026-104658 Reliance on Untrusted Inputs in a Security Decision in hMailServer
The Linux live-update apply helper hmailserver-update of Progressive Robot hMailServer 6.3.4 and 6.3.5 runs as root on a request file written by the unprivileged hmailserver service account, and took from that request the program used to verify an AppImage update's signature and the systemd unit ...
CVE-2026-104704 Cleartext Transmission of Sensitive Information in hMailServer
Progressive Robot hMailServer 6.0.0 through 6.3.5 does not enforce TLS for outbound SMTP delivery to a mail exchanger whose DNSSEC-validated TLSA records contain no DANE-EE usage 3 record, contrary to RFC 7672 section 2.2. The server used only DANE-EE records and treated a validated TLSA record s...
CVE-2026-107503
In Eclipse Ditto versions 3.6.0 to 3.8.13 and 3.9.0 to 3.9.7, the Ditto Explorer UI loads its complete environment configuration, including the Ditto API URI and the OpenID Connect OIDC provider settings, from an arbitrary cross-origin URL supplied in the environmentsURL query parameter. It adopt...
CVE-2026-107450
In Stump through 0.1.10, the updateSmartList and deleteSmartList GraphQL mutations crates/graphql/src/mutation/smartlists.rs depend only on the shared AccessSmartList permission and resolve the target list at Reader access lacking a creator check. Any authenticated user with that permission can...
CVE-2026-17609 Super Forms <= 6.3.316 - Unauthenticated Arbitrary Directory Deletion via 'data[...][files][][subdir]' Parameter
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 6.3.316 via the submitform function. This is due to insufficient validation of attacker-controlled JSON field declarations against the actual form...
CVE-2026-17196 Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File Upload via 'extensions' Form Element Attribute
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 6.3.316 via the uploadfiles function. This is due to missing file type validation in the uploadfiles function, which reads and applies an...
CVE-2026-107449
linuxserver Heimdall through 2.8.3 applies its SafeUrlFetcher SSRF protection mechanism only to ItemController; the enhanced-application test and live-stats requests occur via SupportedApps::execute, a GuzzleHttp client that lacks IP address restrictions. In some realistic installations, the POST...
CVE-2026-107446
containerd overlaybd through 1.0.18 has a doloadindex LSMT index loading integer overflow and resultant out-of-bounds heap access for indexbytes, if an untrusted overlaybd blob from a registry is used in a scenario with multiple overlaybd-backed containers...