ImageMagick versions before 7.1.2-26 and 6.9.13-x before 6.9.13-51 contain a policy bypass vulnerability in the -script operation. This vulnerability arises from missing security policy checks, allowing unauthorized reading of files from paths that should be disallowed by the configured security policy. The vulnerability has a medium severity with a CVSS score of 3.3.
ImageMagick versions before 7.1.2-26 and 6.9.13-51 contain a use-after-free vulnerability triggered when freetype initialization fails. The vulnerable method does not exit properly and continues to use memory that has already been freed during image processing, potentially causing a denial of service. The CVSS score is 3.7, indicating a medium severity level.
ImageMagick versions before 7.1.2-26 and 6.9.13-51 have an information disclosure vulnerability. When using the identify command to display a profile with non-printable values and debug output enabled, a single byte beyond the profile boundary can be read and printed. This vulnerability has a medium severity with a CVSS score of 2.9.
ImageMagick versions before 7.1.2-26 and 6.9.13-51 contain a memory leak vulnerability in the color transformation to the log colorspace. When this operation fails, a small amount of memory is not released, potentially leading to resource exhaustion. This issue has a low CVSS score of 2.9 and is classified as medium severity. A patch is available to address this vulnerability.
ImageMagick versions before 7.1.2-26 and 6.9.13-51 contain a memory leak vulnerability in the hough lines operation. This occurs when a specific operation fails, causing a small memory leak. The vulnerability has a medium severity with a CVSS score of 2.9. A patch is available to address this issue.
ImageMagick versions before 7.1.2-26 have a memory leak vulnerability in the TIFF encoder that occurs when memory allocation fails. This flaw can be exploited by attackers to cause memory exhaustion and denial of service during TIFF image processing. The vulnerability has a medium severity with a CVSS score of 2.9.
ImageMagick versions before 7.1.2-26 and 6.9.x before 6.9.13-51 contain a memory leak vulnerability in the YUV decoder that occurs when opening of the blob fails. This memory leak can be triggered repeatedly, potentially leading to resource exhaustion and denial of service. The vulnerability has a medium severity with a CVSS score of 3.7. No known exploits are reported in the wild. The affected versions include numerous specific Ubuntu package versions of ImageMagick prior to the fixed releases.
ImageMagick versions before 7.1.2-26 and 6.9.13-51 contain a memory leak vulnerability in the MIFF encoder. This occurs when a memory allocation fails during MIFF image processing and can lead to denial of service. The vulnerability has a medium severity rating with a CVSS score of 2.9. It affects specific Ubuntu package versions of ImageMagick 6.7.7.10. No known exploits are reported in the wild.
ImageMagick versions before 7.1.2-26 and 6.9.13-51 contain a memory leak vulnerability in the ICON decoder triggered when a memory allocation fails. This flaw can cause memory to be leaked during processing of crafted ICON files, potentially leading to denial of service. The vulnerability has a medium severity rating with a CVSS score of 3.7. Affected versions include numerous Ubuntu package versions of ImageMagick prior to the fixed releases.
ImageMagick versions before 7.1.2-26 and 6.9.13-51 contain a memory leak vulnerability in the TIFF encoder triggered by specifying an invalid tiff:tile-geometry parameter. This flaw causes allocated memory not to be released, leading to increased memory consumption during processing of malformed tile geometry parameters.
Twig, a PHP template language, has a vulnerability in versions prior to 3.27.0 where the sandbox policy cache can persist incorrectly across renders. This flaw allows a sandboxed render to reuse a template that was checked under a different or empty policy. The issue is fixed in version 3.27.0.
Puma versions from 5.5.0 until 7.2.1 and 8.0.2 have a vulnerability when PROXY protocol v1 support is enabled. The server reads incoming bytes into an internal buffer while waiting for a CRLF sequence to detect a PROXY v1 line. An attacker can exploit this by continuously sending bytes without CRLF, causing unbounded memory growth and increased CPU usage. This issue is fixed in versions 7.2.1 and 8.0.2.
Puma web server versions from 5.5.0 up to 7.2.1 and 8.0.2 are vulnerable to source IP spoofing when the set_remote_address proxy_protocol: :v1 option is enabled and persistent connections are used. The vulnerability arises because Puma incorrectly re-parses PROXY protocol headers after each keep-alive request on the same connection, allowing an attacker to inject a second PROXY header and overwrite the REMOTE_ADDR value. This issue is fixed in versions 7.2.1 and 8.0.2.
A vulnerability in Symfony PHP framework versions from 5.4.46 until 5.4.52, 6.4.40, 7.4.12, and 8.0.12 allows crafted query strings to bypass runtime argv parsing checks. This discrepancy between parse_str() and the web SAPI can leave $_GET empty while attacker-controlled flags in $_SERVER['argv'] modify application environment variables such as APP_ENV or APP_DEBUG. The issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.
Roundcube Webmail versions before 1.6.17 and 1.7.x before 1.7.2 contain a vulnerability in the password plugin that allows username spoofing via session data, potentially leading to account takeover. The vulnerability has a high CVSS score of 9.8, indicating critical impact on confidentiality, integrity, and availability.
Roundcube Webmail versions before 1.6.17 and 1.7.x before 1.7.2 have insufficient sanitization of CSS in HTML email messages. This vulnerability may allow Server-Side Request Forgery (SSRF) or information disclosure if stylesheet links reference local network hosts. The issue is due to incomplete fixes of previous vulnerabilities.
An infinite loop vulnerability in the TNEF decoder of Roundcube Webmail versions before 1.6.17 and 1.7.x before 1.7.2 can cause a denial of service when an email with a TNEF attachment is opened. This vulnerability affects multiple specific older versions of Roundcube Webmail. No known exploits are reported in the wild, and the severity is assessed as medium.
CVE-2026-62641 is a denial of service vulnerability in the TNEF decoder of Roundcube Webmail versions before 1.6.17 and 1.7.x before 1.7.2. The vulnerability is triggered by a crafted compressed-RTF size that causes the service to become unavailable. It affects multiple specific older versions of Roundcube Webmail. No known exploits are reported in the wild.
CVE-2026-51105 is a buffer overflow vulnerability in aMULE-Project aMule version 2.3.3 and related builds. It allows a remote attacker to cause a denial of service via the OP_SERVERMESSAGE Handler. The vulnerability impacts availability but does not affect confidentiality or integrity. The CVSS score is 7.5, indicating medium severity.
CVE-2026-45092 is a medium severity vulnerability affecting multiple specific versions of the Fastdds software. The exact nature and technical details of the vulnerability are unknown based on the provided data. There is no CVSS score or detailed description available, and no known exploits in the wild have been reported. The affected versions are explicitly listed, but no patch or remediation information is provided.