Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-61520 | high | 7.7 | No | Simple Machines Forum 2.1 prior to commit b4d23df (fixed in 2.1.8) and 3.0 prior to commit 4bf35cf contains a server-side request forgery vu... | 2026-10-29 |
| CVE-2026-61858 | medium | 5.3 | No | ImageMagick before 7.1.2-26 contains a policy bypass vulnerability in the APNG encoder and external delegates due to missing validation chec... | 2026-10-29 |
| CVE-2026-61857 | high | 7.5 | No | ImageMagick before 7.1.2-26 contains a heap use-after-free vulnerability caused by missing null check when parsing XMP profiles. Attackers c... | 2026-10-29 |
| CVE-2026-58660 | high | 8.1 | No | Kanboard before 1.2.53, fixed in commit 564cc30, BoardAjaxController save() method (used by the kanban board drag-and-drop endpoint) validat... | 2026-10-29 |
| CVE-2026-61464 | low | 1.8 | No | ImageMagick before 7.1.2-26 and 6.9.13-51 contains a heap-based buffer over-write vulnerability that occurs when running an X11 import with... | 2026-10-29 |
| CVE-2026-61451 | critical | 9.6 | No | The Grav API plugin (grav-plugin-api) before 1.0.4 does not validate the origin of the client-supplied admin_base_url field in the POST /api... | 2026-10-29 |
| CVE-2026-61465 | medium | 6.5 | No | ImageMagick before 7.1.2-26 and 6.9.13-51 is missing a check for the allowed memory allocation limit in matrix-backed operations such as -ca... | 2026-10-29 |
| CVE-2026-58652 | high | 7.5 | No | luci-app-travelmate (and the travelmate package) contain a privilege-escalation flaw: a LuCI/rpcd session holding the luci-app-travelmate wr... | 2026-10-29 |
| CVE-2026-56379 | high | 8.1 | No | ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows attackers to inject arbi... | 2026-10-29 |
| CVE-2026-56373 | medium | 5.3 | No | ImageMagick before 7.1.2-15 contains a use-after-free vulnerability in the PDB decoder that uses a stale pointer when memory allocation fail... | 2026-10-29 |
| CVE-2026-56377 | low | 3.3 | No | ImageMagick before 7.1.2-24 contains an incorrect policy check that allows attackers to create or truncate files disallowed by security poli... | 2026-10-29 |
| CVE-2026-56369 | low | 3.7 | No | ImageMagick before 7.1.2-22 contains an information disclosure vulnerability in the PasskeyEncipherImage method due to AES-CTR nonce reuse.... | 2026-10-29 |
| CVE-2026-56370 | high | 7.8 | No | ImageMagick before 7.1.2-19 contains an out-of-bounds access vulnerability in ConnectedComponentsImage() when processing connected-component... | 2026-10-29 |
| CVE-2026-56368 | high | 7.5 | No | ImageMagick before 7.1.2-15 contains a memory leak vulnerability in multiple coders that write raw pixel data where allocated objects are no... | 2026-10-29 |
| CVE-2026-56376 | low | 3.3 | No | ImageMagick before 7.1.2-15 and 6.9.13-40 contains a heap use-after-free in the meta coder: when memory allocation fails, a single byte is w... | 2026-10-29 |
| CVE-2026-56371 | medium | 5.3 | No | ImageMagick before 7.1.2-15 and 6.9.13-40 contains a memory leak in coders/txt.c when processing TXT files with texture attributes: the text... | 2026-10-29 |
| CVE-2026-56378 | high | 8.2 | No | ImageMagick before 7.1.2-15 (and 6.x before 6.9.13-40) contains a heap out-of-bounds read in the PCD coder's DecodeImage loop. A crafted PCD... | 2026-10-29 |
| CVE-2026-56366 | medium | 6.5 | No | ImageMagick before 7.1.2-18 contains a memory leak vulnerability in the META reader when processing APP1JPEG input paths. Attackers can trig... | 2026-10-29 |
| CVE-2026-56362 | medium | 4.2 | No | ImageMagick before 7.1.2-15 contains a heap-buffer-overflow read vulnerability in GetPixelIndex caused by OpenPixelCache updating image chan... | 2026-10-29 |
| CVE-2026-56365 | medium | 5.3 | No | ImageMagick before 7.1.2-19 contains a memory leak vulnerability in the PNG encoder when writing MNG images. Attackers can trigger the encod... | 2026-10-29 |