CVE Vulnerability Catalog

ImageMagick before versions 7.1.2-26 and 6.9.13-51 contains a memory leak in the TIFF encoder when an invalid tiff:tile-geometry is specified. Supplying malformed tile geometry parameters causes allocated memory not to be released, which can lead to increased memory consumption.

ImageMagick before versions 7.1.2-26 and 6.9.13-51 contains a memory leak in the ICON decoder that occurs when a memory allocation fails. Processing a crafted ICON file that triggers an allocation failure leaks memory, which may lead to a denial of service.

ImageMagick before versions 7.1.2-26 and 6.9.13-51 contains a memory leak in the MIFF encoder that occurs when a memory allocation fails during MIFF image processing, potentially leading to denial of service (DoS).

A vulnerability in ImageMagick before versions 7.1.2-26 and 6.9.13-51 causes a memory leak in the YUV decoder when blob opening fails. Repeated triggering can lead to resource exhaustion (denial of service).

ImageMagick before version 7.1.2-26 contains a memory leak vulnerability in the TIFF encoder when memory allocation fails. Attackers can trigger allocation failures during TIFF image processing to cause memory exhaustion and denial of service.

A vulnerability in ImageMagick before version 7.1.2-26 causes a memory leak in the JNG encoder when a blob cannot be opened. Attackers can trigger resource exhaustion by providing malformed JNG files that fail blob operations.

ImageMagick before versions 7.1.2-26 and 6.9.13-51 contains a memory leak in the Hough line detection operation. When a specific operation fails, a small memory leak occurs.

ImageMagick before versions 7.1.2-26 and 6.9.13-51 contains a memory leak in color transformation to the log colorspace. When the operation fails, a small amount of memory is not released.

In ImageMagick before version 7.1.2-26 (and 6.x before 6.9.13-51) there is a memory leak in the TIFF encoder that occurs when a temporary file cannot be created, resulting in a small memory leak.

In ImageMagick before versions 7.1.2-26 and 6.9.13-51, there is an information disclosure vulnerability. When a profile is displayed with the identify command and the profile value is not printable, a single byte past the profile boundary can be read. This behavior occurs when debug output is enabled.

ImageMagick before versions 7.1.2-26 and 6.9.13-51 contains a use-after-free vulnerability that occurs when freetype initialization fails. The method does not exit and continues to use already freed memory, which can lead to a denial of service.

A vulnerability in ImageMagick before versions 7.1.2-26 and 6.9.13-51 allows bypassing security policy in the -script operation. Missing security policy checks enable reading files from paths that are otherwise disallowed.

In ImageMagick before versions 7.1.2-26 and 6.9.13-51, a heap-based buffer over-write vulnerability exists when running an X11 import with a crafted window title, which can result in heap memory corruption and denial of service.

Hono before version 4.11.10 contains a timing attack vulnerability in the basicAuth and bearerAuth middlewares due to non-constant-time string comparison in the timingSafeEqual function. Attackers can exploit early termination of string equality checks to infer valid credentials through precise timing measurements.

A memory leak vulnerability in ImageMagick through version 7.1.2-18 exists in the ASHLAR coder when an action fails. Attackers can trigger failed actions to exhaust memory resources and cause denial of service.

In jadx-gui prior to version 1.5.6, there is an HTML injection vulnerability in the Summary tab. This occurs because SummaryNode.java appends arches and perArchCount values from .so file paths in an APK into an HTML panel without proper escaping.

HCL BigFix Platform is affected by a user enumeration vulnerability. An attacker, through careful system control and response time monitoring, can determine which users are registered with the BigFix service.

ColdFusion is affected by an Insufficient Session Expiration vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.

Adobe Commerce is affected by an Information Exposure vulnerability that could lead to a limited disclosure of sensitive information. Exploit depends on conditions beyond the attacker's control and does not require user interaction.

In Devolutions Server 2026.1.22.0 and 2026.2.11.0, the Recovery Kit response file generation feature inserts sensitive information into a file. This allows an attacker with access to the generated file to obtain the Azure Key Vault client secret in cleartext, even when the option to exclude sensitive data is selected.