Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-25983ImageMagick has Use After Free in MSLStartElement in "coders/msl.c"NuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +17 · fixed in 14.10.3
- CVE-2026-25982ImageMagick Has Heap Out-of-Bounds Read in DCM Decoder (ReadDCMImage)NuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +17 · fixed in 14.10.3
- CVE-2026-25971ImageMagick's MSL: Stack overflow in ProcessMSLScriptNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +17 · fixed in 14.10.3
- CVE-2026-25970ImageMagick SIXEL Decoder Has Signed Integer Overflow, Leading to Memory CorruptionNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +17 · fixed in 14.10.3
- CVE-2026-25969ImageMagick has Memory Leak in coders/ashlar.cNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +16 · fixed in 14.10.3
- CVE-2026-25968ImageMagick has MSL attribute stack buffer overflow that leads to out of bounds write.NuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +17 · fixed in 14.10.3
- CVE-2026-25967ImageMagick has stack buffer overflow in FTXT reader via oversized integer fieldNuGet · agick.net-q8-x64, magick.net-q16-anycpu +16 · fixed in 14.10.3
- CVE-2026-25966ImageMagick's Security Policy Bypass through config/policy-secure.xml via "fd handler" leads to stdin/stdout accessNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.10.3
- CVE-2026-25965ImageMagick's policy bypass through path traversal allows reading restricted content despite secured policyNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +17 · fixed in 14.10.3
- CVE-2026-25898Imagemagick Has Global Buffer Overflow (OOB Read) via Negative Pixel Index in UIL and XPM WriterNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.10.3
- CVE-2026-25897ImageMagick has heap overflow in sun decoder on 32-bit systems that can result in out of bounds writeNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +17 · fixed in 14.10.3
- CVE-2026-25799ImageMagick has Division-by-Zero in YUV sampling factor validation, which leads to crashNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +17 · fixed in 14.10.3
- CVE-2026-25798ImageMagick has NULL Pointer Dereference in ClonePixelCacheRepository via crafted imageNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +16 · fixed in 14.10.3
- CVE-2026-25797ImageMagick vulnerable to Code injection via PostScript header in ps codersNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +16 · fixed in 14.10.3
- CVE-2026-25796ImageMagick has memory leak of watermark Image object in ReadSTEGANOImage on multiple error/early-return pathsNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +16 · fixed in 14.10.3
- CVE-2026-25795ImageMagick has NULL pointer dereference in ReadSFWImage after DestroyImageInfo (sfw.c)NuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +16 · fixed in 14.10.3
- CVE-2026-25794ImageMagick has heap-buffer-overflow via signed integer overflow in `WriteUHDRImage` when writing UHDR images with large dimensionsNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +17 · fixed in 14.10.3
- CVE-2026-25638ImageMagick has memory leak in msl encoderNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +17 · fixed in 14.10.3
- CVE-2026-25637ImageMagick: Possible memory leak in ASHLAR encoderNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +17 · fixed in 14.10.3
- CVE-2026-25576ImageMagick: Out of bounds read in multiple coders read raw pixel dataNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +14 · fixed in 14.10.3
- CVE-2026-24485ImageMagick: Infinite loop vulnerability when parsing a PCD fileNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +17 · fixed in 14.10.3
- CVE-2026-24484ImageMagick: Converting multi-layer nested MVG to SVG can cause DoSNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +17 · fixed in 14.10.3
- CVE-2026-24481ImageMagick has Possible Heap Information Disclosure in PSD ZIP DecompressionNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.10.3
- CVE-2026-21218.NET Spoofing VulnerabilityNuGet · system.security.cryptography.cose · fixed in 8.0.2, 9.0.13, 10.0.3
- CVE-2026-25592Semantic Kernel has an Arbitrary File Write via AI Agent Function Calling in .NET SDKNuGet · microsoft.semantickernel.core · fixed in 1.71.0
- CVE-2026-25543HtmlSanitizer has a bypass via template tagNuGet · htmlsanitizer · fixed in 9.0.892, 9.1.893-beta
- CVE-2026-24687Umbraco.Forms has path traversal and file enumeration vulnerability in Linux/MacNuGet · umbraco.forms · fixed in 16.4.1, 17.1.1
- CVE-2026-24838DotNetNuke.Core Vulnerable to Stored XSS via Module TitleNuGet · dotnetnuke.core · fixed in 9.13.10, 10.2.0
- CVE-2026-24837DotNetNuke.Core Vulnerable to Stored XSS in Module Deletion Confirmation ModalNuGet · dotnetnuke.core · fixed in 10.2.0
- CVE-2026-24836DotNetNuke.Core Vulnerable to Stored XSS in Scheduler LogNotesNuGet · dotnetnuke.core · fixed in 10.02.0