Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-26131.NET Elevation of Privilege VulnerabilityNuGet · microsoft.netcore.app.runtime.linux-arm, microsoft.netcore.app.runtime.linux-arm64 +4 · fixed in 10.0.4
- CVE-2026-30937ImageMagick has a heap buffer overflow in WriteXWDImage due to CARD32 arithmetic overflow in bytes_per_line calculationNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +17 · fixed in 14.10.4
- CVE-2026-30936ImageMagick has a heap Buffer Overflow in WaveletDenoiseImageNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +17 · fixed in 14.10.4
- CVE-2026-30935ImageMagick has a heap Buffer Over-Read in BilateralBlurImageNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +17 · fixed in 14.10.4
- CVE-2026-30931ImageMagick has a heap-based buffer overflow in UHDR encoderNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +17 · fixed in 14.10.4
- CVE-2026-30929ImageMagick has a stack buffer overflow in MagnifyImageNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +17 · fixed in 14.10.4
- CVE-2026-30883ImageMagick has a Heap Overflow when writing extremely large image profile in the PNG encoderNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +17 · fixed in 14.10.4
- CVE-2026-28693ImageMagick has an integer overflow in DIB coder can result in out of bounds read or writeNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +17 · fixed in 14.10.4
- CVE-2026-28692ImageMagick has a heap buffer over-read via 32-bit integer overflow in MAT decoderNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +17 · fixed in 14.10.4
- CVE-2026-28691ImageMagick has an uninitialized pointer dereference in JBIG decoderNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +17 · fixed in 14.10.4
- CVE-2026-28690ImageMagick has a stack write buffer overflow in MNG encoderNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +17 · fixed in 14.10.4
- CVE-2026-28689ImageMagick has a Path Policy TOCTOU symlink race bypassNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +17 · fixed in 14.10.4
- CVE-2026-28688ImageMagick has a heap use-after-free in the MSL encoderNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +17 · fixed in 14.10.4
- CVE-2026-28687ImageMagick has a Heap Use-After-Free in ImageMagick MSL decoderNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +17 · fixed in 14.10.4
- CVE-2026-28686ImageMagick has a write heap-buffer-overflow in PCL encoder via undersized output bufferNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +17 · fixed in 14.10.4
- CVE-2026-28494ImageMagick affected by stack corruption through long morphology kernel names or arraysNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +17 · fixed in 14.10.4
- CVE-2026-28493ImageMagick has a Integer Overflow leading to out of bounds write in SIXEL decoderNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +17 · fixed in 14.10.4
- CVE-2026-30227MimeKit: CRLF Injection in Quoted Local-Part Enables SMTP Command Injection and Email ForgeryNuGet · mimekit · fixed in 4.15.1
- CVE-2026-27449Umbraco.Engage.Forms Allows Unauthorized Access to Multiple API EndpointsNuGet · umbraco.engage.forms · fixed in 16.2.1, 17.1.1
- CVE-2026-27799ImageMagick has a heap Buffer Over-read in its DJVU image format handlerNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +17 · fixed in 14.10.3
- CVE-2026-27798ImageMagick: Heap Buffer Over-read in WaveletDenoise when processing small imagesNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +17 · fixed in 14.10.3
- CVE-2026-26983ImageMagick: Invalid MSL <map> can result in a use after freeNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +17 · fixed in 14.10.3
- CVE-2026-26284ImageMagick has heap overflow in pcd decoder that leads to out of bounds read.NuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +17 · fixed in 14.10.3
- CVE-2026-26283ImageMagick has possible infinite loop in JPEG encoder when using `jpeg:extent`NuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +17 · fixed in 14.10.3
- CVE-2026-26066ImageMagick has infinite loop when writing IPTCTEXT leads to denial of service via crafted profileNuGet · agick.net-q8-x86, magick.net-q16-anycpu +17 · fixed in 14.10.3
- CVE-2026-25989ImageMagick has integer overflow or wraparound and incorrect conversion between numeric types in the internal SVG decoderNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +17 · fixed in 14.10.3
- CVE-2026-25988ImageMagick's MSL image stack index not refreshed, leading to leaked images.NuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +16 · fixed in 14.10.3
- CVE-2026-25987ImageMagick has heap buffer over-read in MAP image decoderNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +17 · fixed in 14.10.3
- CVE-2026-25986ImageMagick has a heap buffer overflow in YUV 4:2:2 decoderNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +17 · fixed in 14.10.3
- CVE-2026-25985Memory allocation with excessive without limits in the internal SVG decoderNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +17 · fixed in 14.10.3