CVE Vulnerability Catalog

In ImageMagick prior to 7.1.2-32, the delegate symlink cleanup does not check the MAGICK_SHRED_PASSES environment variable. This allows a local privileged workflow to overwrite a file with random data. The issue is fixed in version 7.1.2-32.

In ImageMagick prior to 7.1.2-32 and 6.9.13-57, a missing end-of-file check while reading bzip2-compressed image data can cause an infinite loop. This exhausts processing resources. The issue is fixed in versions 7.1.2-32 and 6.9.13-57.

In ImageMagick prior to 7.1.2-32, a crafted EXR image can cause the EXR decoder to write beyond a heap buffer. This causes the process to crash. The issue is fixed in version 7.1.2-32.

In praisonai-platform prior to 0.1.9, dependency deletion can be authorized against the wrong side of a dependency edge. A workspace member cannot delete a dependency through the owner-created issue endpoint, but can delete the same dependency through a member-owned related issue endpoint because the route accepts either endpoint and checks delete permission only against the caller-selected URL issue. Version 0.1.9 patches the issue.

A flaw was found in source-to-image where unpacking archive files fails to properly sanitize symbolic links pointing to absolute file paths. An attacker supplying a malicious builder image can embed links pointing outside the extraction directory. This bypasses sandbox boundaries, potentially leading to unauthorized information disclosure or file modification on the host system.

A flaw was found in m17n-lib where an attacker could provide specially crafted or truncated UTF-8 input to trigger an unhandled null pointer dereference during text processing. This causes the application to crash unexpectedly, resulting in a Denial of Service (DoS).

A flaw was found in m17n-lib where a user providing specially crafted text input can trigger a heap use-after-free condition during input-method state transitions. Under specific conditions, the library frees an internal input context object but subsequently attempts to write to that freed memory. This can cause applications relying on the library to crash, leading to a Denial of Service (DoS), or potentially allow arbitrary code execution.

A flaw has been found in XnView Classic 2.52.5 in an unknown function of the FLI File Parser component. Manipulation of the starting_line argument causes a heap-based buffer overflow. Remote exploitation is possible. Upgrading to version 2.52.6 is recommended.

In Backstage prior to 0.21.8, the @backstage/plugin-kubernetes-backend package is affected by improper entity validation in a deprecated Kubernetes services endpoint. An authenticated user with Kubernetes read permissions could access Kubernetes workload data beyond their intended scope by supplying crafted entity data to the deprecated services endpoint. The exposure is limited to read-only access to Kubernetes object metadata across configured clusters. This issue is fixed in version 0.21.8.

In Backstage prior to 2.1.6 in @backstage/plugin-search-backend and 1.8.7 in @backstage/plugin-search-backend-module-elasticsearch, search engine permission filtering could return documents denied by policy. An authenticated Backstage user subject to a DENY policy for search document types could receive unauthorized results in deployments with permission.enabled set to true and an Elasticsearch or OpenSearch backend. This issue is fixed in @backstage/plugin-search-backend 2.1.6 and @backstage/plugin-search-backend-module-elasticsearch 1.8.7.

The @backstage/plugin-kubernetes-backend package prior to 0.21.9 allows an authenticated user with standard Kubernetes resource read permission to retrieve sensitive values that the plugin is designed to mask. This can expose credentials and other confidential material held in connected clusters, limited to resources the Backstage service account is permitted to read.

The @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package prior to 0.3.25 is affected by improper input validation in the Confluence to Markdown scaffolder module. This could allow an attacker to influence file write operations during template execution if a Backstage user runs a template that processes attacker-influenced Confluence content.

A heap-based buffer overflow exists in GIMP's GIF export plug-in. Exporting an image with very large width and height can cause a 32-bit overflow when computing the pixel buffer size, leading to an integer overflow and a mismatch between allocation and actual write by GEGL.

Coturn 4.10.0 contains an uninitialized memory disclosure vulnerability that allows remote unauthenticated attackers to leak stack memory contents by sending a TURN Allocate request without credentials. The stun_init_error_response_common_str() function fails to zero-initialize the avalue buffer before computing its length and copying leaked stack bytes into the ERROR-CODE reason phrase.

The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user-supplied data. The lack of sanitization allows for the injection of HTML which can be used to execute malicious JavaScript code on any target browser which renders the device log component.

The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user-supplied data. The lack of sanitization allows for the injection of HTML which can be used to execute malicious JavaScript code on any target browser which renders the device log component.

An issue in iTerm2 macOS before 3.6.12 allows a local attacker to obtain sensitive information.

In NTFS-3G before 2026.7.7, an out-of-bounds read exists in ntfs_fix_file_name() in libntfs-3g/reparse.c that allows an attacker to read possibly confidential information from ntfs-3g process memory by crafting a malicious NTFS image. The out-of-bounds read is triggered by a readlink on a corrupted file.

In wger prior to version 2.6, an authenticated attacker can inject arbitrary workout log entries into any other user's SlotEntry by supplying the victim's slot_entry ID in a POST /api/v2/workoutlog/ request. The slot_entry foreign key is not included in ownership verification, and the injected data is silently folded into the victim's progressive-overload calculations, corrupting auto-generated targets.

In wger prior to version 2.6, a vulnerability in the authentication/session lifecycle allows bearer-style API credentials to remain valid after a user logs out and after a password change. An attacker who steals a DRF authtoken or JWT refresh token can continue to access protected /api/v2/* endpoints until the token is manually rotated/deleted or naturally expires.