A middleware bypass vulnerability exists in hono versions from 4.12.4 up to but not including 4.13.11. This flaw in the serveStatic middleware allows unauthenticated attackers to bypass prefix middleware by exploiting double decoding of percent-encoded paths, enabling access to static files without authentication checks.
A vulnerability in Siemens SIMATIC IPC BX-21A and related models allows bypassing UEFI Secure Boot protections due to the presence of a BIOS vendor test key in the UEFI Secure Boot key database. This affects all versions prior to V31.01.13 for IPC BX-21A, prior to V1.1.4 for IPC RW-543A, and prior to V28.01.15 for IPC227G, IPC277G, IPC277G PRO, IPC327G, and IPC377G. An attacker with local physical or administrative access could exploit this to boot unauthorized operating systems or UEFI applications, potentially compromising device confidentiality, integrity, and availability.
The WP Testimonials WordPress plugin through 1.4.13 does not properly escape testimonial content and reverses WordPress's HTML sanitization when rendering it, allowing users with the Author role and above to store JavaScript that executes in the session of any user viewing the testimonials, including administrators.
CVE-2026-108954 is a buffer overflow vulnerability in the OfflineTransducerGreedySearchDecoder::Decode function of k2-fsa sherpa-onnx versions 1.13.0 through 1.13.8. The issue arises from improper handling of the vocab_size argument, which can be exploited remotely by supplying malformed or tampered model metadata. While using only official model packs with consistent metadata may prevent exploitation in normal usage, the underlying vulnerability remains due to lack of validation.
This entry provides Indicators of Compromise (IOCs) related to ThreatFox for the date 2026-10-13. It is categorized as OSINT related to network activity and payload delivery but lacks detailed technical information or specific malware signatures.
Shaark versions 1.2.13 through 1.2.44 have an authorization bypass vulnerability in several API controllers. Authenticated non-admin users can exploit this flaw by sending PUT or DELETE requests with numeric IDs to overwrite or delete content owned by other users, including private items. This occurs due to missing ownership checks in the Link, Story, Chest, and Album API controllers.
ImageMagick versions before 6.9.13-57 and 7.x before 7.1.2-32 have a type confusion vulnerability in the INFO, JSON, and YAML encoders. This flaw occurs when an internal method receives a pointer of an unexpected type during image writing in a compressed format. Exploitation can cause the process to crash with SIGABRT or SIGSEGV, resulting in denial of service.
ImageMagick versions before 6.9.13-57 and 7.x before 7.1.2-32 have a race condition due to improper synchronization when accessing the security policy. This can lead to a heap buffer overwrite and cause the application to crash, resulting in a denial of service. The vulnerability requires concurrent access to the security policy by multiple threads. The CVSS score is low, reflecting limited impact as it only causes denial of service without confidentiality or integrity loss.
ImageMagick versions before 6.9.13-57 and 7.x before 7.1.2-32 contain a code injection vulnerability in the MVG decoder when using a PostScript renderer. This vulnerability allows attackers to supply a crafted MVG file that injects code into the PostScript rendering path, potentially causing limited integrity and availability impacts. The CVSS score is 4.8, indicating medium severity.
ImageMagick versions before 6.9.13-57 and 7.x before 7.1.2-32 have a flaw in the JNG decoder where temporary files are not properly cleaned up after processing crafted input. This can lead to repeated leakage of temporary files, consuming disk space and potentially degrading system availability.
A memory leak vulnerability exists in ImageMagick versions before 6.9.13-57 and 7.x before 7.1.2-32 in the wavelet-denoise operation. This flaw causes allocated memory to not be released when a required resource cannot be acquired. An attacker can exploit this by repeatedly triggering the wavelet-denoise process under resource-constrained conditions, leading to memory exhaustion and degraded service availability.
ImageMagick versions before 6.9.13-57 and 7.x before 7.1.2-32 contain an information disclosure vulnerability in the JPEG decoder. This flaw allows an attacker to supply a crafted JPEG file that causes the decoder to read and disclose uninitialized memory contents. The vulnerability has a medium severity rating with a CVSS score of 5.3.
ImageMagick versions before 6.9.13-57 and 7.x before 7.1.2-32 have a use after free vulnerability in the PDF writer component when processing CMYK images with JPEG2000 compression. This flaw can lead to memory reuse of freed memory, potentially causing the process to crash. The vulnerability has a medium severity score and does not impact confidentiality or integrity, only availability.
ImageMagick versions before 6.9.13-57 and 7.x before 7.1.2-32 have an information disclosure vulnerability in the PostScript decoder. This flaw allows an attacker to supply a crafted PostScript file that causes the decoder to allocate a buffer one byte longer than the decoded data, exposing a single uninitialized byte of memory. The vulnerability has a medium severity rating with a CVSS score of 5.3.
ImageMagick versions before 6.9.13-57 and 7.x before 7.1.2-32 have a stack overflow vulnerability in the MSL decoder due to an incorrect depth check that fails to limit recursion. This flaw allows crafted MSL images to exhaust the stack, causing the process to crash and resulting in a denial of service. There is no impact on confidentiality or integrity. The vulnerability has a medium severity rating with a CVSS score of 5.3.
ImageMagick versions before 6.9.13-57 and 7.x before 7.1.2-32 contain a vulnerability in the MVG decoder involving uncontrolled recursion that can exhaust the program stack. This flaw can be triggered by an attacker controlling a file name processed by ImageMagick, leading to a stack overflow and process crash, resulting in denial of service. The vulnerability has a medium severity with a CVSS score of 3.7.
ImageMagick versions before 6.9.13-57 and 7.x before 7.1.2-32 have a memory leak vulnerability in the GIF encoder. This occurs because allocated memory is not released when color quantization fails during GIF encoding. An attacker can exploit this by supplying images that cause quantization failure, leading to memory leaks and potential degradation of system availability.
ImageMagick versions before 6.9.13-57 and 7.x before 7.1.2-32 have a vulnerability in the TGA image decoder that causes an uninitialized memory read. This flaw allows attackers to craft malicious TGA images that, when processed, can disclose contents of uninitialized memory from the ImageMagick process. The vulnerability has a medium severity rating with a CVSS score of 5.3.
A memory leak vulnerability exists in ImageMagick versions before 6.9.13-57 and 7.x before 7.1.2-32 in the YUV encoder. This leak occurs when a specific encoder operation fails, causing allocated memory not to be released. An attacker can exploit this by supplying crafted input that triggers the failure, potentially leading to resource exhaustion and denial of service. The vulnerability has a medium severity score of 3.7 and does not impact confidentiality or integrity.
ImageMagick versions before 6.9.13-57 and 7.x before 7.1.2-32 have an XML injection vulnerability in the CIP encoder. This flaw occurs because the encoder does not properly escape input-derived data when generating Cisco IP Phone XML output. An attacker can craft a file that, when converted to CIP format, injects arbitrary XML markup. The vulnerability has a medium severity with a CVSS score of 5.3.