A memory leak vulnerability exists in ImageMagick's magick stream command when multiple consecutive %d format specifiers are used in a filename template. This issue affects versions prior to 14.7.0 and was identified in version 7.1.1-47. The leak occurs during memory allocation in the StreamImage function. The vulnerability has a low severity score and does not impact confidentiality or integrity, only availability due to resource leakage. A fix has been implemented in version 14.7.0.
A heap buffer overflow vulnerability exists in the InterpretImageFilename function of ImageMagick, triggered by processing format strings with consecutive percent signs (%%). This off-by-one error leads to out-of-bounds memory access. The issue affects Magick.NET Q16 AnyCPU versions prior to 14.7.0. The vulnerability has a low CVSS score of 3.7 and does not impact integrity or availability. A fix is available in version 14.7.0.
A stack buffer overflow vulnerability (CWE-124) exists in ImageMagick's Magick.NET Q16 AnyCPU version prior to 14.7.0. The flaw occurs in the InterpretImageFilename() function within MagickCore/image.c when processing multiple consecutive %d format specifiers in filename templates, causing negative pointer arithmetic and buffer underwrite during vsnprintf() calls. This affects multiple subcommands including mogrify, compare, composite, conjure, convert, identify, and montage. Exploitation can lead to denial of service or potentially remote code execution (RCE) under specific conditions such as disabled ASLR and controlled input. A fix is available in version 14.7.0.
CVE-2025-49015 is a vulnerability in the Couchbase .NET SDK client library versions before 3.7.1. The issue involves improper hostname verification for TLS certificates, where the SDK incorrectly uses IP addresses instead of hostnames due to a misconfigured default setting. This flaw could allow an attacker to bypass hostname verification during TLS connections.
The sharpdefender package version 1.0.0 on NuGet has been identified as containing malicious code. This is a supply chain threat involving a malicious package published to the NuGet ecosystem. There is no CVSS score or detailed technical exploit information available. No known exploits in the wild have been reported. No patch or remediation guidance is currently provided.
The seedefender NuGet package versions 1.0.0, 1.0.1, and 1.0.2 contain malicious code. This is identified as a malicious package threat rather than a traditional vulnerability. There is no CVSS score or detailed technical exploit information available. No known exploits in the wild have been reported. No patch or remediation guidance is provided in the available data.
The markdown-to-html NuGet package versions 1.0.0, 1.0.30, and 1.0.32 contain malicious code. This is a supply chain threat where the package itself is compromised to include harmful functionality. No CVSS score or detailed technical exploitation information is provided.
The Microsofft.EntetyFrameworkCore NuGet package version 1.0.0 has been identified as containing malicious code. This package is flagged as a malicious package in the NuGet ecosystem. There is no CVSS score or detailed technical vulnerability description available. No known exploits in the wild have been reported. No patch or remediation guidance is currently provided.
The Modernzel.UI.WinForms NuGet package versions 1.0.0 through 1.0.49 and 3.8.0.7 contain malicious code. This is a supply chain threat where the package itself is identified as malicious. No specific technical details or exploitation methods are provided.
The Modernial.UI.WinForm NuGet package version 3.8.0.7 contains malicious code as identified by the OpenSSF malicious packages database. This is a supply chain threat involving a compromised or intentionally harmful package distributed via NuGet.
The Modernial.UI.WinForms NuGet package contains malicious code in multiple versions ranging from 1.0.0 through 1.0.40 and select 2.x versions up to 2.16.0. This is a supply chain threat involving a malicious package published to the NuGet ecosystem. No specific technical details about the malicious behavior are provided in the source data.
The Discord_Rpc.Net NuGet package versions 1.0.0 through 1.0.49 and 1.2.1.24 through 1.2.1.25 contain malicious code. This is a supply chain threat where the package itself is identified as malicious. There is no CVSS score or detailed technical exploit information available.
The Bunifu.Form NuGet package versions 1.0.0 through 1.0.49 and version 8.3.53 contain malicious code as identified by the OpenSSF malicious packages database. This is a supply chain threat involving a malicious package distributed via NuGet.
The DiscordNetApi NuGet package versions 1.0.0 through 1.0.49 and 1.2.567 contain malicious code. This is a supply chain threat where the package itself is compromised with malicious content.
LibEmbedder.Fody NuGet package versions 1.0.0 through 1.0.59 and 2.56.7 through 2.56.9 contain malicious code. This is a supply chain threat involving a malicious package distributed via the NuGet ecosystem. No detailed technical exploitation or impact information is provided.
Malicious code has been identified in multiple versions of the Blazor.Net package distributed via NuGet. The affected versions range from 0.0.0 through 0.0.119 and include versions 1.0.25 through 1.0.28. This is a supply chain threat involving a malicious package that could compromise systems using these versions.
The NuGet package 'xopxopxopxopxopx' version 1.4.0.2 has been identified as containing malicious code. This package is flagged as a malicious package in the OpenSSF malicious packages database. There is no CVSS score or detailed technical exploit information available. No known exploits in the wild have been reported.
The NuGet package 'testt22esttest' version 1.4.2 has been identified as containing malicious code. This package is flagged as a malicious package by the OpenSSF project and is listed in the GHSA malware database. No specific technical details about the nature of the malicious code or its impact are provided.
The NuGet package 'psbuiId' version 1.1.1-beta has been identified as containing malicious code. This is a case of a malicious package rather than a traditional vulnerability. No CVSS score or detailed technical exploitation information is provided.
Multiple versions of the dnlib.net package distributed via NuGet contain malicious code. This issue affects specific versions ranging from 4.2.8 through 4.4.2, including many intermediate releases. No CVSS score or detailed technical exploitation information is provided. There is no indication of known exploits in the wild or available patches.