Fortinet FortiOS: CVE-2026-106174: GUI Denial of Service

A improper locking vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.4 through 7.6.6 may allow an unauthenticated attacker with network access to the device to cause a denial of service of the HTTPS management interface via crafted HTTP requests...

Microsoft Edge (Chromium-based): CVE-2026-83831: Remote Code Execution Vulnerability

Double free in Microsoft Edge Chromium-based allows an unauthorized attacker to execute code over a network...

Microsoft Edge (Chromium-based): CVE-2026-85898: Remote Code Execution Vulnerability

Access of resource using incompatible type 'type confusion' in Microsoft Edge Chromium-based allows an unauthorized attacker to execute code over a network...

Alma Linux: CVE-2026-88812: Important: xorg-x11-server security update (Multiple Advisories)

A double free in XKB SetGeometryin X.Org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by attached clients to cause a crash or potentially code in the x server context...

Fortinet FortiSandbox: CVE-2026-107656: Improper access control and session management in the web management interface

An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2 all versions, FortiSandbox PaaS 5.0.0 through 5.0.6, FortiSandbox PaaS 4.4 all versions, FortiSandbox PaaS 4.2 all versions ma...

Red Hat: CVE-2026-116124: libgsf: libgsf: Arbitrary code execution via heap-based buffer overflow in OLE2 parser

A security vulnerability has been detected in GNOME libgsf up to 1.14.60. The impacted element is the function oleinforeadmetabat of the file gsf/gsf-infile-msole.c of the component OLE2 Parser. The manipulation leads to heap-based buffer overflow. The attack can be initiated remotely. The...

CVE-2025-15705: Undefined Security Weakness

The Contact Form by Supsystic WordPress plugin before 1.8.0 does not sanitise and escape a form name, allowing users with access to the form editor to inject arbitrary web scripts that execute when another user views the form. On multisite installations, where administrators do not hold the...

Red Hat: CVE-2026-116155: ImageMagick: ImageMagick: Denial of Service via crafted XMP profile memory leak

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the handling of XMP profiles by various decoders. Attackers can supply images with a crafted XMP profile that leak memory each time they are processed, leading to resource exhaustion and denial of service...

Red Hat: CVE-2026-116156: ImageMagick: ImageMagick: Denial of Service via memory leak in -set profile option

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak caused by a missing cleanup when the -set profile option is used. An attacker who induces a user to process images with the -set profile option can leak memory, potentially exhausting resources and causing a denial of...

Red Hat: CVE-2026-116153: ImageMagick: ImageMagick: Denial of Service via heap-based buffer overflow in convex-hull calculations

ImageMagick before 7.1.2-33 contains a heap buffer overflow vulnerability on 32-bit systems that allows attackers to overwrite heap memory when convex-hull information is requested. Attackers can supply crafted images processed with convex-hull calculations to corrupt heap memory, causing crashes...

Red Hat: CVE-2026-116154: ImageMagick: ImageMagick: Denial of Service via XML parsing memory leak

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in its XML parsing code, where allocated memory is not released when parsing reaches the nesting depth limit. Attackers can supply crafted, deeply nested XML data to trigger the leak, causing memory exhaustion and denial ...

Red Hat: CVE-2026-116157: ImageMagick: ImageMagick: Denial of Service via memory leak in PerlMagick

ImageMagick before 7.1.2-33 contains a memory leak vulnerability in PerlMagick that fails to free values returned when reading image properties. Attackers can repeatedly trigger property reads through five affected PerlMagick code locations to exhaust memory and cause denial of service...

Red Hat: CVE-2026-116158: ImageMagick: ImageMagick: Denial of Service via memory leak in compare command

ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the magick compare command caused by missing cleanup when an operation fails. Attackers can supply inputs that trigger repeated failed compare operations to exhaust memory and cause denial of service...

Red Hat: CVE-2026-116159: ImageMagick: ImageMagick: Denial of Service via memory leak in the -cdl option

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the handling of the -cdl color decision list option, where allocated memory is not cleaned up after use. Attackers can supply input that causes the -cdl option to be processed, repeatedly leaking memory and degrading...

Red Hat: CVE-2026-116160: ImageMagick: ImageMagick: Denial of Service via crafted image in X11 animate operation

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a heap-based buffer overflow in the X11 animate operation when processing crafted images. Attackers can supply a malicious image that, when a user runs an X11 animate operation on it, overwrites heap memory and can crash the applicatio...

Red Hat: CVE-2026-116137: adm-zip: adm-zip: File integrity check bypass via duplicate archive entries

adm-zip through 0.6.1 contains a duplicate-entry validation bypass that allows attackers to evade the readEntries check by using canonically equivalent entry names like './hello.txt' and 'hello.txt'. Attackers can craft ZIP archives where getEntry or readAsText validates benign content while...

Red Hat: CVE-2026-116140: ImageMagick: ImageMagick: Security policy bypass via flawed delegate invocation parsing

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 incorrectly parses delegate invocations, which can allow an executable blocked in policy.xml to still run. An attacker who gets ImageMagick to process input that triggers a delegate invocation can bypass the administrator-defined policy and...

Red Hat: CVE-2026-116141: ImageMagick: ImageMagick: Denial of Service via policy bypass in UHDR decoder

ImageMagick before 7.1.2-33 contains a policy bypass vulnerability in the UHDR decoder that allows attackers to evade image width and height limits because extent checks occur after decoding. Attackers can supply crafted UHDR images with oversized dimensions that are fully decoded before policy...

Red Hat: CVE-2026-116143: ImageMagick: ImageMagick: Denial of Service via scene selection policy bypass

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a policy bypass in the PS, PDF and XPS decoders that allows the security policy's list length limit on scene selection to be circumvented. Attackers supplying a specific argument can cause ImageMagick to process more scenes than...

Red Hat: CVE-2026-116144: ImageMagick: ImageMagick: Denial of Service via uncontrolled recursion in MVG decoder

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains uncontrolled recursion in the MVG decoder that can lead to a stack overflow. Attackers can supply a crafted MVG file that, when read with specific arguments, exhausts the stack and crashes the process, causing a denial of service...

Red Hat: CVE-2026-116146: ImageMagick: ImageMagick: Denial of Service via MSL decoder memory leak

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the MSL decoder that fails to release allocated memory when processing a crafted MSL image. Attackers can supply crafted MSL files for processing to repeatedly leak memory, causing resource exhaustion and denial of...

Red Hat: CVE-2026-116147: ImageMagick: ImageMagick: Denial of service via unchecked memory allocation in DJVU decoder

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a null pointer dereference in the DJVU decoder because the result of a memory allocation is not checked before use. Attackers can supply a DJVU image that, when processed under conditions where the allocation fails, crashes the process...

Red Hat: CVE-2026-116148: ImageMagick: ImageMagick: Command injection via unvalidated drawing options in MVG encoder

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains an injection vulnerability in the MVG encoder, which does not properly neutralize user-specified drawing options before writing them into generated MVG output. Attackers who can supply drawing options can inject arbitrary MVG drawing...

Red Hat: CVE-2026-116149: ImageMagick: ImageMagick: Memory corruption via crafted bzip2 compressed images

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a stack-based buffer overflow in the handling of bzip2 compressed images. Attackers can supply a crafted image using bzip2 compression to overwrite stack memory during decoding, causing crashes or memory corruption...

Red Hat: CVE-2026-116150: ImageMagick: ImageMagick: Denial of Service via memory leak in FPX encoder

ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the FPX encoder that allows attackers to exhaust memory by supplying a crafted image. Attackers can submit crafted images for FPX encoding to leak memory repeatedly, causing resource exhaustion and denial of service...

Red Hat: CVE-2026-116151: ImageMagick: ImageMagick: Denial of Service via memory leak in JNG encoder

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the JNG encoder that fails to release allocated memory when processing a crafted image. Attackers can supply crafted images that are encoded to JNG to leak memory, potentially causing resource exhaustion and a limited...

Red Hat: CVE-2026-116152: ImageMagick: ImageMagick: Denial of Service via memory leak in MAT decoder

ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the MAT decoder that fails to release allocated memory in a specific error path. Attackers can supply crafted MAT files that trigger this error path repeatedly, causing small memory leaks that gradually consume process memory...

Eclipse Adoptium: CVE-2026-114820: Vulnerability with JSSE component

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java SE: 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2, 27.0.1.0.2; Oracle Graal...

FreeBSD: VID-9647af6d-7a05-11f1-99fc-40b034429ecf (CVE-2026-46531): cacti -- multiple vulnerabilities

Cacti is an open source performance and fault management framework. From version 1.2.27 to before version 1.2.31, Cacti contains an authenticated stored second-order SQL injection in the automation tree rule item handler. A user holding the Automation realm default General Administration role can...

FreeBSD: VID-9647af6d-7a05-11f1-99fc-40b034429ecf (CVE-2026-39902): cacti -- multiple vulnerabilities

Cacti is an open source performance and fault management framework. Prior to version 1.2.31, the prior blocklist ;&| $\n\r omitted single-quote, double-quote, redirect operators, subshell parens and braces. An authenticated admin could save an inputstring containing single-quote, redirect...

CVE-2025-30043: Missing Authentication for Critical Function

CGM CLININET is vulnerable to Missing Authentication for Critical Function in the /DocManagment path. The endpoint is accessible without authentication, allowing an unauthenticated attacker in the adjacent network to retrieve the list of patient documents and download those documents. This issue...

CVE-2025-30046: Execution with Unnecessary Privileges

In the CGM CLININET application server, multiple processes responsible for HL7 communication with external systems run with root privileges while processing untrusted data received from those external systems. An attacker in adjacent network able to send data to these HL7 communication processes...

CVE-2025-30047: Deserialization of Untrusted Data

CGM CLININET is vulnerable to Remote Code Execution caused by deserialization of untrusted data. The server exposes an HTTP-based API, used by the administrative module, that exchanges data using Java object serialization. An attacker within the same local network is able to send requests to this...

CVE-2025-30049: Use of Password Hash With Insufficient Computational Effort

The CGM CLININET application stores user passwords as unsalted MD5 hashes. This issue was fixed in versions 2026.MS1 and 2026.MS3...

CVE-2025-30050: Improper Control of Generation of Code

CGM CLININET is vulnerable to Code Injection in the RunCGI.pm component, which dynamically imports the module specified as a query parameter and executes code from untrusted data provided by the user. An attacker from adjacent network can supply a crafted query parameter to have an...

CVE-2025-30051: Incorrect Permission Assignment for Critical Resource

The CGM CLININET application stores the production database login and password, as well as RabbitMQ broker credentials, in the SysIO.pl configuration file. Insecure file permissions make this file readable by any local account. This issue was fixed in version 2026.MS3...

CVE-2025-30052: Authentication Bypass by Spoofing

The rsyncd service of the CGM CLININET is vulnerable to Authentication Bypass via IP spoofing. Access is granted based solely on the client's source IP address. An attacker able to spoof an allowed IP address, can bypass this check and gain the ability to edit files on the affected system. The...

CVE-2025-30054: Incorrect Permission Assignment for Critical Resource

CGM CLININET is vulnerable to local privilege escalation. The service that processes incoming HL7 messages runs with root privileges, but due to incorrect permissions, its scripts and configuration files can be modified by the uhcapache user. An attacker with uhcapache privileges can modify these...

Red Hat: CVE-2026-115484: open-iscsi: open-iscsi: DHCPv4 option parser heap out-of-bounds read in iscsiuio parse_msg

A flaw was found in the iscsiuio component of open-iscsi. The DHCPv4 option parser incorrectly calculates the length of the options data, causing it to read beyond the allocated buffer into adjacent heap memory. An attacker on the same network segment can send a crafted DHCP response to crash the...

Red Hat: CVE-2026-115485: open-iscsi: open-iscsi: DHCPv6 vendor option strlen heap out-of-bounds read and 1-byte write in iscsiuio

A flaw was found in the iscsiuio component of open-iscsi. The DHCPv6 option parser calls strlen on raw network data without ensuring a NUL terminator is present, causing it to read past the buffer into heap memory. This can result in a daemon crash, a 1-byte heap overwrite, or corruption of the...

Red Hat: CVE-2026-55888: xdg-desktop-portal: xdg-desktop-portal: Unauthorized host file access via unvalidated FileChooser filenames

XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileChooser.SaveFiles method to gain arbitrary file access to non-existing files on the host limited to files the user has access to. The FileChooser.SaveFiles method takes...

CVE-2025-30045: Improper Control of Generation of Code

CGM CLININET is vulnerable to Code Injection in the ConvExpr function, which processes Perl expressions into RTF document content. Due to improper control of the code evaluated from these expressions, an authenticated, high-privileged attacker can cause arbitrary code to be executed with root...

CVE-2025-45528: Undefined Security Weakness

An issue in Nitro Software, Inc Nitro PDF Pro for macOS v.14.7 allows a local attacker to execute arbitrary code via a crafted PDF...

Node.js: CVE-2026-105482: dns.resolve truncates hostnames containing a NUL byte

A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve functions and dns.reverse. This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup and the net/tls host options. Because the name is passed to c-ares as a C strin...

Node.js: CVE-2026-106069: TLS certificate validated against a different IP address for non-canonical IPv4 literals

A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal with a leading zero, such as 0127.0.0.1. tls.checkServerIdentity normalizes the host...

Red Hat: CVE-2026-115486: open-iscsi: open-iscsi: IPv6 Neighbor Discovery missing option length validation in iscsiuio allows ARP table poisoning

A flaw was found in the iscsiuio component of open-iscsi. The IPv6 Neighbor Discovery handler accesses link-layer address options at a fixed offset without verifying the packet contains them. Additionally, the ARP table is updated unconditionally with attacker-controlled addresses from the packet...

Node.js: CVE-2026-105483: TLS certificate hostname verification bypass for IPv4 addresses written with fullwidth digits

A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth digits １２７.0.0.1. tls.checkServerIdentity did not recognize such hosts as IP...

Red Hat: CVE-2026-55889: xdg-desktop-portal: xdg-desktop-portal: unauthorized data disclosure via predictable token generation

XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileTransfer.RetrieveFiles method to redirect drag-and-drop and copy-paste data targeted at other applications to itself. Some portals generate tokens which provide access to...

Red Hat: CVE-2026-98876: kernel: host1x: bus: Fix missing ops null check in error teardown

In the Linux kernel, the following vulnerability has been resolved: host1x: bus: Fix missing ops null check in error teardown In host1xdeviceinit, the error teardown paths do not check client-ops before dereferencing it, unlike the forward init paths which correctly guard with 'client-ops &&'. Th...

Red Hat: CVE-2026-98874: kernel: wifi: iwlwifi: mld: don't WARN on WoWLAN suspend w/o netdetect

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: don't WARN on WoWLAN suspend w/o netdetect Clearly, from a user perspective, it must be valid to configure WoWLAN and then suspend while not connected to a network. Since mac80211 doesn't distinguish these cas...