Permalink CVE-2026-9754

7.1 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 months ago by @LeSuisse Activity log

• Created suggestion 3 months ago
• @LeSuisse ignored
  22 packages

  • mongodb-cli
  • mongodb-compass
  • mongodb-atlas-cli
  • phpExtensions.mongodb
  • haskellPackages.mongoDB
  • php82Extensions.mongodb
  • php83Extensions.mongodb
  • php84Extensions.mongodb
  • php85Extensions.mongodb
  • akkuPackages.r6rs-mongodb
  • prometheus-mongodb-exporter
  • haskellPackages.pipes-mongodb
  • graylogPlugins.mongodb-profiler
  • terraform-providers.mongodbatlas
  • python313Packages.langchain-mongodb
  • python314Packages.langchain-mongodb
  • terraform-providers.mongodb_mongodbatlas
  • vscode-extensions.mongodb.mongodb-vscode
  • python313Packages.langgraph-store-mongodb
  • python314Packages.langgraph-store-mongodb
  • python313Packages.langgraph-checkpoint-mongodb
  • python314Packages.langgraph-checkpoint-mongodb
  3 months ago
• @LeSuisse accepted 3 months ago
• @LeSuisse published on GitHub 3 months ago

Stack memory disclosure in filemd5 command

• https://jira.mongodb.org/browse/SERVER-122207

---

MongoDB

• <8.2.10
• <8.3.3

Permalink CVE-2026-10142

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 months ago by @LeSuisse Activity log

• Created suggestion 3 months ago
• @LeSuisse accepted 3 months ago
• @LeSuisse published on GitHub 3 months ago

kafka-python prior to 2.3.2 Denial of Service via Protocol Parser Frame Length

• https://www.vulncheck.com/advisories/kafka-python-prior-to-denial-of-service-vi… technical-descriptionthird-party-advisory
• https://github.com/dpkp/kafka-python/pull/3019
• https://github.com/dpkp/kafka-python/pull/3026
• https://github.com/dpkp/kafka-python/commit/6e4831444f972d169cdd11f5c8d50333cea… patch

---

kafka-python

• <2.3.2

Permalink CVE-2026-10143

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 months ago by @LeSuisse Activity log

• Created suggestion 3 months ago
• @LeSuisse accepted 3 months ago
• @LeSuisse published on GitHub 3 months ago

kafka-python prior to 2.3.2 DoS via SCRAM Iteration Count in scram.py

• https://github.com/dpkp/kafka-python/pull/3019 technical-description
• https://github.com/dpkp/kafka-python/commit/6e4831444f972d169cdd11f5c8d50333cea… patch
• https://github.com/dpkp/kafka-python/pull/3026
• https://www.vulncheck.com/advisories/kafka-python-prior-to-dos-via-scram-iterat… third-party-advisory

---

kafka-python

• <2.3.2

Permalink CVE-2026-50127

5.9 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 3 months ago by @LeSuisse Activity log

• Created suggestion 3 months ago
• @LeSuisse ignored
  6 packages

  • python313Packages.weblate-fonts
  • python314Packages.weblate-fonts
  • python313Packages.weblate-schemas
  • python314Packages.weblate-schemas
  • python313Packages.weblate-language-data
  • python314Packages.weblate-language-data
  3 months ago
• @LeSuisse accepted 3 months ago
• @LeSuisse published on GitHub 3 months ago

Weblate SSRF: outbound URL guard misses the NAT64 well-known prefix (64:ff9b::/96)

• https://github.com/WeblateOrg/weblate/security/advisories/GHSA-vmfc-9982-2m45 x_refsource_CONFIRM
• https://github.com/WeblateOrg/weblate/pull/19768 x_refsource_MISC
• https://github.com/WeblateOrg/weblate/releases/tag/weblate-2026.6 x_refsource_MISC

---

weblate

• ==>= 5.15, < 2026.6

Permalink CVE-2026-45106

4.6 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 3 months ago by @LeSuisse Activity log

• Created suggestion 3 months ago
• @LeSuisse ignored
  6 packages

  • python313Packages.weblate-fonts
  • python314Packages.weblate-fonts
  • python313Packages.weblate-schemas
  • python314Packages.weblate-schemas
  • python313Packages.weblate-language-data
  • python314Packages.weblate-language-data
  3 months ago
• @LeSuisse accepted 3 months ago
• @LeSuisse published on GitHub 3 months ago

Weblate: Stored HTML injection in editor search preview

• https://github.com/WeblateOrg/weblate/security/advisories/GHSA-6wxc-8mgq-w26m x_refsource_CONFIRM
• https://github.com/WeblateOrg/weblate/pull/19422 x_refsource_MISC
• https://github.com/WeblateOrg/weblate/releases/tag/weblate-2026.5 x_refsource_MISC

---

weblate

• ==< 2026.5

Permalink CVE-2026-53436

4.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 3 months ago by @LeSuisse Activity log

• Created suggestion 3 months ago
• @LeSuisse ignored
  7 packages

  • jenkins-job-builder
  • python313Packages.jenkinsapi
  • python314Packages.jenkinsapi
  • python313Packages.python-jenkins
  • python314Packages.python-jenkins
  • python313Packages.jenkins-job-builder
  • python314Packages.jenkins-job-builder
  3 months ago
• @LeSuisse accepted 3 months ago
• @LeSuisse published on GitHub 3 months ago

Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines …

• Jenkins Security Advisory 2026-06-10 vendor-advisory

---

Jenkins

• *
• <2.555.*

Permalink CVE-2026-53440

4.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 3 months ago by @LeSuisse Activity log

• Created suggestion 3 months ago
• @LeSuisse ignored
  7 packages

  • jenkins-job-builder
  • python313Packages.jenkinsapi
  • python314Packages.jenkinsapi
  • python313Packages.python-jenkins
  • python314Packages.python-jenkins
  • python313Packages.jenkins-job-builder
  • python314Packages.jenkins-job-builder
  3 months ago
• @LeSuisse accepted 3 months ago
• @LeSuisse published on GitHub 3 months ago

Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not …

• Jenkins Security Advisory 2026-06-10 vendor-advisory

---

Jenkins

• *
• <2.555.*

Permalink CVE-2026-53437

4.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 3 months ago by @LeSuisse Activity log

• Created suggestion 3 months ago
• @LeSuisse ignored
  7 packages

  • jenkins-job-builder
  • python313Packages.jenkinsapi
  • python314Packages.jenkinsapi
  • python313Packages.python-jenkins
  • python314Packages.python-jenkins
  • python313Packages.jenkins-job-builder
  • python314Packages.jenkins-job-builder
  3 months ago
• @LeSuisse accepted 3 months ago
• @LeSuisse published on GitHub 3 months ago

Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines …

• Jenkins Security Advisory 2026-06-10 vendor-advisory

---

Jenkins

• *
• <2.555.*

Permalink CVE-2026-53435

8.8 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 3 months ago by @LeSuisse Activity log

• Created suggestion 3 months ago
• @LeSuisse ignored
  7 packages

  • jenkins-job-builder
  • python313Packages.jenkinsapi
  • python314Packages.jenkinsapi
  • python313Packages.python-jenkins
  • python314Packages.python-jenkins
  • python313Packages.jenkins-job-builder
  • python314Packages.jenkins-job-builder
  3 months ago
• @LeSuisse accepted 3 months ago
• @LeSuisse published on GitHub 3 months ago

In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it …

• Jenkins Security Advisory 2026-06-10 vendor-advisory

---

Jenkins

• *
• <2.555.*

Permalink CVE-2026-53441

updated 3 months ago by @LeSuisse Activity log

• Created suggestion 3 months ago
• @LeSuisse ignored
  7 packages

  • jenkins-job-builder
  • python313Packages.jenkinsapi
  • python314Packages.jenkinsapi
  • python313Packages.python-jenkins
  • python314Packages.python-jenkins
  • python313Packages.jenkins-job-builder
  • python314Packages.jenkins-job-builder
  3 months ago
• @LeSuisse accepted 3 months ago
• @LeSuisse published on GitHub 3 months ago

Jenkins 2.483 through 2.567 (both inclusive), LTS 2.492.1 through 2.555.2 …

• Jenkins Security Advisory 2026-06-10 vendor-advisory

---

Jenkins

• <2.555.*
• *
• <2.483

Permalink CVE-2026-53438

4.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 3 months ago by @LeSuisse Activity log

• Created suggestion 3 months ago
• @LeSuisse ignored
  7 packages

  • jenkins-job-builder
  • python313Packages.jenkinsapi
  • python314Packages.jenkinsapi
  • python313Packages.python-jenkins
  • python314Packages.python-jenkins
  • python313Packages.jenkins-job-builder
  • python314Packages.jenkins-job-builder
  3 months ago
• @LeSuisse accepted 3 months ago
• @LeSuisse published on GitHub 3 months ago

A missing permission check in Jenkins 2.567 and earlier, LTS …

• Jenkins Security Advisory 2026-06-10 vendor-advisory

---

Jenkins

• *
• <2.555.*

Permalink CVE-2026-53439

4.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 3 months ago by @LeSuisse Activity log

• Created suggestion 3 months ago
• @LeSuisse ignored
  7 packages

  • jenkins-job-builder
  • python313Packages.jenkinsapi
  • python314Packages.jenkinsapi
  • python313Packages.python-jenkins
  • python314Packages.python-jenkins
  • python313Packages.jenkins-job-builder
  • python314Packages.jenkins-job-builder
  3 months ago
• @LeSuisse accepted 3 months ago
• @LeSuisse published on GitHub 3 months ago

Missing permission checks in Jenkins 2.567 and earlier, LTS 2.555.2 …

• Jenkins Security Advisory 2026-06-10 vendor-advisory

---

Jenkins

• *
• <2.555.*

Permalink CVE-2026-53442

5.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 3 months ago by @LeSuisse Activity log

• Created suggestion 3 months ago
• @LeSuisse ignored
  7 packages

  • jenkins-job-builder
  • python313Packages.jenkinsapi
  • python314Packages.jenkinsapi
  • python313Packages.python-jenkins
  • python314Packages.python-jenkins
  • python313Packages.jenkins-job-builder
  • python314Packages.jenkins-job-builder
  3 months ago
• @LeSuisse accepted 3 months ago
• @LeSuisse published on GitHub 3 months ago

Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not …

• Jenkins Security Advisory 2026-06-10 vendor-advisory

---

Jenkins

• *
• <2.555.*

Permalink CVE-2026-53464

4.0 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): Low (L)

updated 3 months ago by @LeSuisse Activity log

• Created suggestion 3 months ago
• @LeSuisse ignored
  2 packages

  • haskellPackages.ihp-imagemagick
  • graphicsmagick-imagemagick-compat
  3 months ago
• @LeSuisse accepted 3 months ago
• @LeSuisse published on GitHub 3 months ago

ImageMagick: Memory Leak in wand option parser when providing invalid arguments

• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-j989-f892-2335 x_refsource_CONFIRM

---

ImageMagick

• ==< 7.1.2-25

Permalink CVE-2026-53465

6.2 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 3 months ago by @LeSuisse Activity log

• Created suggestion 3 months ago
• @LeSuisse ignored
  2 packages

  • graphicsmagick-imagemagick-compat
  • haskellPackages.ihp-imagemagick
  3 months ago
• @LeSuisse accepted 3 months ago
• @LeSuisse published on GitHub 3 months ago

ImageMagick: Heap Buffer Over-Write in SF3 encoder when writing multi-frame image

• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-44cp-c3ww-9rv5 x_refsource_CONFIRM

---

ImageMagick

• ==< 7.1.2-25

Permalink CVE-2026-53462

5.9 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 3 months ago by @LeSuisse Activity log

• Created suggestion 3 months ago
• @LeSuisse ignored
  2 packages

  • graphicsmagick-imagemagick-compat
  • haskellPackages.ihp-imagemagick
  3 months ago
• @LeSuisse accepted 3 months ago
• @LeSuisse published on GitHub 3 months ago

ImageMagick: Use-After-Free when allocation in CheckPrimitiveExtent fails

• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-px7q-ggqj-hcf2 x_refsource_CONFIRM

---

ImageMagick

• ==< 7.1.2-25
• ==< 6.9.13-50

Permalink CVE-2026-53460

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 3 months ago by @LeSuisse Activity log

• Created suggestion 3 months ago
• @LeSuisse ignored
  2 packages

  • graphicsmagick-imagemagick-compat
  • haskellPackages.ihp-imagemagick
  3 months ago
• @LeSuisse accepted 3 months ago
• @LeSuisse published on GitHub 3 months ago

ImageMagick: Policy Bypass can trigger out-of-Memory condition

• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-q62c-h75r-2xhc x_refsource_CONFIRM

---

ImageMagick

• ==< 7.1.2-25
• ==< 6.9.13-50

Permalink CVE-2026-53463

4.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): Low (L)

updated 3 months ago by @LeSuisse Activity log

• Created suggestion 3 months ago
• @LeSuisse ignored
  2 packages

  • graphicsmagick-imagemagick-compat
  • haskellPackages.ihp-imagemagick
  3 months ago
• @LeSuisse accepted 3 months ago
• @LeSuisse published on GitHub 3 months ago

ImageMagick: Null Pointer Dereference in distort operation when passing incorrect arguments

• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p9rq-q46c-g4x6 x_refsource_CONFIRM

---

ImageMagick

• ==< 7.1.2-25
• ==< 6.9.13-50

Permalink CVE-2026-53461

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 3 months ago by @LeSuisse Activity log

• Created suggestion 3 months ago
• @LeSuisse ignored
  2 packages

  • graphicsmagick-imagemagick-compat
  • haskellPackages.ihp-imagemagick
  3 months ago
• @LeSuisse accepted 3 months ago
• @LeSuisse published on GitHub 3 months ago

ImageMagick: Out-of-bounds write in ICON decoder due to incorrect loop

• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-g22q-f7gc-5jhr x_refsource_CONFIRM

---

ImageMagick

• ==< 6.9.13-50
• ==< 7.1.2-25

Permalink CVE-2026-48994

5.9 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 3 months ago by @LeSuisse Activity log

• Created suggestion 3 months ago
• @LeSuisse ignored
  2 packages

  • graphicsmagick-imagemagick-compat
  • haskellPackages.ihp-imagemagick
  3 months ago
• @LeSuisse ignored
  3 maintainers

  • @rhendric
  • @faukah
  • @dotlambda
  3 months ago maintainer.ignore
• @LeSuisse accepted 3 months ago
• @LeSuisse published on GitHub 3 months ago

ImageMagick: Heap Buffer Over-Write in MAT decoder on 32-bit systems

• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-4v89-6mgq-6rgc x_refsource_CONFIRM

---

ImageMagick

• ==< 7.1.2-24
• ==< 6.9.13-48

Permalink CVE-2026-48724

5.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 3 months ago by @LeSuisse Activity log

• Created suggestion 3 months ago
• @LeSuisse ignored
  2 packages

  • graphicsmagick-imagemagick-compat
  • haskellPackages.ihp-imagemagick
  3 months ago
• @LeSuisse ignored
  3 maintainers

  • @rhendric
  • @faukah
  • @dotlambda
  3 months ago maintainer.ignore
• @LeSuisse accepted 3 months ago
• @LeSuisse published on GitHub 3 months ago

ImageMagick: Heap Buffer Underwrite in Floyd-Steinberg depth dithering

• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-2hhq-c99x-492r x_refsource_CONFIRM

---

ImageMagick

• ==< 7.1.2-24

Permalink CVE-2026-47712

3.3 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 3 months ago by @LeSuisse Activity log

• Created suggestion 3 months ago
• @LeSuisse accepted 3 months ago
• @LeSuisse published on GitHub 3 months ago

Dulwich doesn't sanitize commit subjects in `porcelain.format_patch`

• https://github.com/jelmer/dulwich/security/advisories/GHSA-555p-6grf-mh7f x_refsource_CONFIRM
• https://github.com/jelmer/dulwich/commit/c2446e51b x_refsource_MISC
• https://github.com/jelmer/dulwich/releases/tag/dulwich-1.2.5 x_refsource_MISC

---

dulwich

• ==>= 0.24.0, < 1.2.5

Permalink CVE-2026-48733

4.7 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 3 months ago by @LeSuisse Activity log

• Created suggestion 3 months ago
• @LeSuisse ignored
  2 packages

  • graphicsmagick-imagemagick-compat
  • haskellPackages.ihp-imagemagick
  3 months ago
• @LeSuisse ignored
  3 maintainers

  • @rhendric
  • @faukah
  • @dotlambda
  3 months ago maintainer.ignore
• @LeSuisse accepted 3 months ago
• @LeSuisse published on GitHub 3 months ago

ImageMagick: Infinite Loop in subimage-search with crafted image

• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5v62-8fq6-cp9m x_refsource_CONFIRM

---

ImageMagick

• ==< 7.1.2-24
• ==< 6.9.13-49

Permalink CVE-2026-49219

5.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 3 months ago by @LeSuisse Activity log

• Created suggestion 3 months ago
• @LeSuisse ignored
  2 packages

  • haskellPackages.ihp-imagemagick
  • graphicsmagick-imagemagick-compat
  3 months ago
• @LeSuisse ignored
  3 maintainers

  • @dotlambda
  • @rhendric
  • @faukah
  3 months ago maintainer.ignore
• @LeSuisse accepted 3 months ago
• @LeSuisse published on GitHub 3 months ago

ImageMagick: Policy Bypass can read disallowed files

• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xcjm-wqff-m669 x_refsource_CONFIRM

---

ImageMagick

• ==< 7.1.2-24
• ==< 6.9.13-48

Permalink CVE-2026-42563

7.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 months ago by @LeSuisse Activity log

• Created suggestion 3 months ago
• @LeSuisse accepted 3 months ago
• @LeSuisse published on GitHub 3 months ago

Dulwich Vulnerable to Command Injection via Merge Driver Path

• https://github.com/jelmer/dulwich/security/advisories/GHSA-9277-mp7x-85jf x_refsource_CONFIRM
• https://github.com/jelmer/dulwich/commit/e3331b3b3a122fc313460182f928f59723580b7b x_refsource_MISC
• https://github.com/jelmer/dulwich/releases/tag/dulwich-1.2.5 x_refsource_MISC

---

dulwich

• ==>= 0.24.0, < 1.2.5

Permalink CVE-2026-49218

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 3 months ago by @LeSuisse Activity log

• Created suggestion 3 months ago
• @LeSuisse ignored
  2 packages

  • graphicsmagick-imagemagick-compat
  • haskellPackages.ihp-imagemagick
  3 months ago
• @LeSuisse ignored
  3 maintainers

  • @rhendric
  • @faukah
  • @dotlambda
  3 months ago maintainer.ignore
• @LeSuisse accepted 3 months ago
• @LeSuisse published on GitHub 3 months ago

ImageMagick: Policy Bypass in DCM decoder could result in image with invalid dimensions

• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8pj9-6897-74xc x_refsource_CONFIRM

---

ImageMagick

• ==< 7.1.2-24
• ==< 6.9.13-48

Permalink CVE-2026-48734

5.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 3 months ago by @LeSuisse Activity log

• Created suggestion 3 months ago
• @LeSuisse ignored
  2 packages

  • haskellPackages.ihp-imagemagick
  • graphicsmagick-imagemagick-compat
  3 months ago
• @LeSuisse ignored
  3 maintainers

  • @rhendric
  • @faukah
  • @dotlambda
  3 months ago maintainer.ignore
• @LeSuisse accepted 3 months ago
• @LeSuisse published on GitHub 3 months ago

ImageMagick: Stack Overflow in MVG decoder

• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-h36c-3666-h489 x_refsource_CONFIRM

---

ImageMagick

• ==< 7.1.2-24
• ==< 6.9.13-49

Permalink CVE-2026-47734

5.7 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 3 months ago by @LeSuisse Activity log

• Created suggestion 3 months ago
• @LeSuisse accepted 3 months ago
• @LeSuisse published on GitHub 3 months ago

Dulwich has unbounded memory allocation in receive-pack from crafted thin packs

• https://github.com/jelmer/dulwich/security/advisories/GHSA-xrvj-v92f-53gj x_refsource_CONFIRM
• https://github.com/jelmer/dulwich/releases/tag/dulwich-1.2.5 x_refsource_MISC

---

dulwich

• ==>= 0.1.0, < 1.2.5

Permalink CVE-2026-52726

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 3 months ago by @LeSuisse Activity log

• Created suggestion 3 months ago
• @LeSuisse accepted 3 months ago
• @LeSuisse published on GitHub 3 months ago

Dulwich's submodule path traversal in porcelain.submodule_update / porcelain.clone(recurse_submodules=True) yields RCE via attacker-dropped .git/hooks payload

• https://github.com/jelmer/dulwich/security/advisories/GHSA-gfhv-vqv2-4544 x_refsource_CONFIRM
• https://github.com/jelmer/dulwich/releases/tag/dulwich-1.2.5 x_refsource_MISC

---

dulwich

• ==>= 0.23.2, < 1.2.5

Permalink CVE-2026-49848

4.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 3 months ago by @LeSuisse Activity log

• Created suggestion 3 months ago
• @LeSuisse accepted 3 months ago
• @LeSuisse published on GitHub 3 months ago

FreeSWITCH: Pre-authentication `userVariables` injection in `mod_verto`

• https://github.com/signalwire/freeswitch/security/advisories/GHSA-j38x-xm7f-9p2f x_refsource_CONFIRM
• https://github.com/signalwire/freeswitch/releases/tag/v1.11.1 x_refsource_MISC

---

freeswitch

• ==< 1.11.1

Permalink CVE-2026-49475

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 3 months ago by @LeSuisse Activity log

• Created suggestion 3 months ago
• @LeSuisse accepted 3 months ago
• @LeSuisse published on GitHub 3 months ago

FreeSWITCH: Out-of-bounds memory access in core STUN attribute parsing

• https://github.com/signalwire/freeswitch/security/advisories/GHSA-9j6h-hc95-q926 x_refsource_CONFIRM
• https://github.com/signalwire/freeswitch/releases/tag/v1.11.0 x_refsource_MISC

---

freeswitch

• ==< 1.11.0

Permalink CVE-2026-49840

9.1 CRITICAL

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 3 months ago by @LeSuisse Activity log

• Created suggestion 3 months ago
• @LeSuisse accepted 3 months ago
• @LeSuisse published on GitHub 3 months ago

FreeSWITCH: Pre-authentication heap buffer overflow in libesl `Content-Length` parsing

• https://github.com/signalwire/freeswitch/security/advisories/GHSA-g597-9fgg-ghg9 x_refsource_CONFIRM
• https://github.com/signalwire/freeswitch/releases/tag/v1.11.1 x_refsource_MISC

---

freeswitch

• ==< 1.11.1

Permalink CVE-2026-49842

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 3 months ago by @LeSuisse Activity log

• Created suggestion 3 months ago
• @LeSuisse accepted 3 months ago
• @LeSuisse published on GitHub 3 months ago

FreeSWITCH: Pre-authentication bandwidth amplification via `mod_verto` speed-test frames

• https://github.com/signalwire/freeswitch/security/advisories/GHSA-p3gx-p2w7-wp35 x_refsource_CONFIRM
• https://github.com/signalwire/freeswitch/releases/tag/v1.11.1 x_refsource_MISC

---

freeswitch

• ==< 1.11.1

Permalink CVE-2026-49847

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 3 months ago by @LeSuisse Activity log

• Created suggestion 3 months ago
• @LeSuisse accepted 3 months ago
• @LeSuisse published on GitHub 3 months ago

FreeSWITCH: Stack overflow in bundled cJSON parser via deeply nested JSON

• https://github.com/signalwire/freeswitch/security/advisories/GHSA-2v74-pcgh-75wg x_refsource_CONFIRM
• https://github.com/signalwire/freeswitch/releases/tag/v1.11.1 x_refsource_MISC

---

freeswitch

• ==< 1.11.1

Permalink CVE-2026-49472

5.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 3 months ago by @LeSuisse Activity log

• Created suggestion 3 months ago
• @LeSuisse accepted 3 months ago
• @LeSuisse published on GitHub 3 months ago

FreeSWITCH includes a vulnerable function, PREFIX(prologTok)() from libexpat

• https://github.com/signalwire/freeswitch/security/advisories/GHSA-4jm3-xpcm-mwwq x_refsource_CONFIRM
• https://github.com/signalwire/freeswitch/releases/tag/v1.11.0 x_refsource_MISC

---

freeswitch

• ==< 1.11.0

Permalink CVE-2026-49841

9.8 CRITICAL

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 3 months ago by @LeSuisse Activity log

• Created suggestion 3 months ago
• @LeSuisse accepted 3 months ago
• @LeSuisse published on GitHub 3 months ago

FreeSWITCH: Pre-authentication heap buffer overflow in `mod_verto` HTTP POST body read

• https://github.com/signalwire/freeswitch/security/advisories/GHSA-wfrq-qvg2-f88f x_refsource_CONFIRM
• https://github.com/signalwire/freeswitch/releases/tag/v1.11.1 x_refsource_MISC

---

freeswitch

• ==< 1.11.1

Permalink CVE-2026-49843

5.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): Low (L)

updated 3 months ago by @LeSuisse Activity log

• Created suggestion 3 months ago
• @LeSuisse accepted 3 months ago
• @LeSuisse published on GitHub 3 months ago

FreeSWITCH: Pre-authentication session eviction via attacker-chosen `sessid` in `mod_verto`

• https://github.com/signalwire/freeswitch/security/advisories/GHSA-9457-fxr9-x78m x_refsource_CONFIRM
• https://github.com/signalwire/freeswitch/releases/tag/v1.11.1 x_refsource_MISC

---

freeswitch

• ==< 1.11.1

Permalink CVE-2026-49762

5.1 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 months ago by @LeSuisse Activity log

• Created suggestion 3 months ago
• @LeSuisse ignored
  40 packages

  • elixir-ls
  • elixir_1_17
  • elixir_1_18
  • elixir_1_19
  • protoc-gen-elixir
  • beam27Packages.elixir
  • beam28Packages.elixir
  • beam29Packages.elixir
  • beam27Packages.elixir-ls
  • beam28Packages.elixir-ls
  • python314Packages.tree-sitter-grammars.tree-sitter-elixir
  • python313Packages.tree-sitter-grammars.tree-sitter-elixir
  • vimPlugins.nvim-treesitter-parsers.elixir
  • beamMinimal29Packages.elixir_1_20
  • beamMinimal28Packages.elixir_1_20
  • beamMinimal29Packages.elixir_1_18
  • tree-sitter-grammars.tree-sitter-elixir
  • vscode-extensions.elixir-lsp.vscode-elixir-ls
  • beamMinimal29Packages.elixir-ls
  • beamMinimal27Packages.elixir_1_17
  • beamMinimal27Packages.elixir_1_18
  • beamMinimal27Packages.elixir_1_19
  • beamMinimal27Packages.elixir_1_20
  • beamMinimal28Packages.elixir_1_18
  • beamMinimal28Packages.elixir-ls
  • beamMinimal27Packages.elixir-ls
  • beamMinimal29Packages.elixir
  • beamMinimal28Packages.elixir
  • beamMinimal27Packages.elixir
  • beam29Packages.elixir_1_20
  • beam29Packages.elixir_1_18
  • beam28Packages.elixir_1_20
  • beam28Packages.elixir_1_19
  • beam28Packages.elixir_1_18
  • beam27Packages.elixir_1_20
  • beam27Packages.elixir_1_19
  • beam27Packages.elixir_1_18
  • beam27Packages.elixir_1_17
  • beam29Packages.elixir-ls
  • beamMinimal28Packages.elixir_1_19
  3 months ago
• @LeSuisse restored
  3 packages

  • elixir_1_17
  • elixir_1_18
  • elixir_1_19
  3 months ago
• @LeSuisse accepted 3 months ago
• @LeSuisse published on GitHub 3 months ago

Unbounded integer parsing in the Version module enables CPU and memory exhaustion denial of service

• https://github.com/elixir-lang/elixir/security/advisories/GHSA-w2h8-8x3g-278p relatedvendor-advisory
• https://cna.erlef.org/cves/CVE-2026-49762.html related
• https://osv.dev/vulnerability/EEF-CVE-2026-49762 related
• https://github.com/elixir-lang/elixir/commit/c64417d72fd5c7d09e963ca3ac5fa2b140… patch

---

elixir-lang/elixir

• <1.20.1
• <c64417d72fd5c7d09e963ca3ac5fa2b140978d9e

Permalink CVE-2009-10007

9.1 CRITICAL

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 3 months ago by @LeSuisse Activity log

• Created suggestion 3 months ago
• @LeSuisse accepted 3 months ago
• @LeSuisse published on GitHub 3 months ago

Catalyst::Plugin::Authentication versions before 0.10_027 for Perl is susceptible to session fixation attacks

• https://metacpan.org/release/ETHER/Catalyst-Plugin-Authentication-0.10_027/chan… release-notes
• https://github.com/perl-catalyst/Catalyst-Plugin-Authentication/commit/b1385ea8… patch
• https://metacpan.org/pod/Catalyst::Plugin::Session#change_session_id
• https://metacpan.org/pod/Plack::Middleware::Session#change_id
• http://www.openwall.com/lists/oss-security/2026/06/09/10

---

Catalyst-Plugin-Authentication

• <0.10_027

Permalink CVE-2026-50636

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 months ago by @LeSuisse Activity log

• Created suggestion 3 months ago
• @LeSuisse ignored reference Official … 3 months ago
• @LeSuisse accepted 3 months ago
• @LeSuisse published on GitHub 3 months ago

LimeSurvey RemoteControl invite_participants/remind_participants SQL Injection

• GitHub Pull Request 5031 patch
• VulnCheck Advisory: LimeSurvey RemoteControl invite_participants/remind_participants SQL Injection third-party-advisory

Ignored references (1)

• Official Product Homepage product

---

LimeSurvey

• =<7.0

Permalink CVE-2026-50635

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 months ago by @LeSuisse Activity log

• Created suggestion 3 months ago
• @LeSuisse ignored reference Official … 3 months ago
• @LeSuisse accepted 3 months ago
• @LeSuisse published on GitHub 3 months ago

LimeSurvey Password Reset Host Header Injection Discloses Reset Token

• GitHub Pull Request 5032 patch
• VulnCheck Advisory: LimeSurvey Password Reset Host Header Injection Discloses Reset Token third-party-advisory

Ignored references (1)

• Official Product Homepage product

---

LimeSurvey

• =<7.0