Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-116153 | low | 2.5 | No | ImageMagick before 7.1.2-33 contains a heap buffer overflow vulnerability on 32-bit systems that allows attackers to overwrite heap memory w... | 2026-11-03 |
| CVE-2026-12763 | medium | 4.2 | No | IBM Langflow OSS 1.0.0 through 1.11.5 could allow an authenticated attacker to access another user's MCP server context due to improper cach... | 2026-11-03 |
| CVE-2026-17628 | medium | 5.4 | No | IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to change the password of an account due to improper authe... | 2026-11-03 |
| CVE-2026-109274 | low | 2.5 | No | ImageMagick before 7.1.2-32 contains a time-of-check time-of-use symlink race vulnerability that allows attackers to bypass the path securit... | 2026-11-03 |
| CVE-2026-109273 | medium | 5.3 | No | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an information disclosure vulnerability in the PostScript decoder, which alloc... | 2026-11-03 |
| CVE-2026-109272 | low | 3.7 | No | ImageMagick 7.1.1-31 before 7.1.2-32 contains a NULL pointer dereference in the PostScript decoder that is triggered when a policy limit is... | 2026-11-03 |
| CVE-2026-109271 | low | 3.7 | No | ImageMagick 7.1.2-30 before 7.1.2-32 contains a use after free vulnerability in the WBINFO decoder that occurs when a memory allocation fail... | 2026-11-03 |
| CVE-2026-109270 | low | 3.3 | No | ImageMagick before 7.1.2-32 contains a memory leak vulnerability in the -process option that allows attackers to cause unreleased memory all... | 2026-11-03 |
| CVE-2026-109269 | medium | 5.3 | No | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an information disclosure vulnerability in the JPEG decoder, which performs a... | 2026-11-03 |
| CVE-2026-109280 | low | 2.5 | No | ImageMagick 7.1.0-20 before 7.1.2-32 contains a use after free vulnerability in the -fx option that occurs when a memory allocation fails du... | 2026-11-03 |
| CVE-2026-109279 | low | 2.5 | No | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 lacks proper synchronization when the security policy is accessed, so simultaneous read... | 2026-11-03 |
| CVE-2026-109278 | low | 3.7 | No | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the wavelet-denoise operation, which fails to release allocat... | 2026-11-03 |
| CVE-2026-109277 | low | 3.3 | No | ImageMagick before 7.1.2-32 contains a policy bypass vulnerability in the -script operation due to missing checks on file descriptor handlin... | 2026-11-03 |
| CVE-2026-109276 | medium | 5.3 | No | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an incomplete cleanup flaw in the JNG decoder that fails to remove temporary f... | 2026-11-03 |
| CVE-2026-109275 | medium | 4.8 | No | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a code injection vulnerability in the MVG decoder when a PostScript renderer i... | 2026-11-03 |
| CVE-2026-116144 | low | 3.3 | No | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains uncontrolled recursion in the MVG decoder that can lead to a stack overflow. A... | 2026-11-03 |
| CVE-2026-116143 | low | 3.3 | No | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a policy bypass in the PS, PDF and XPS decoders that allows the security polic... | 2026-11-03 |
| CVE-2026-109964 | medium | 5.6 | No | ImageMagick before 7.1.2-33 and 6.9.13-58 contains a heap buffer underwrite vulnerability in DecodeImage() in coders/pict.c on 32-bit builds... | 2026-11-03 |
| CVE-2026-109282 | low | 2.5 | No | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a type confusion flaw in the INFO, JSON and YAML encoders, where an internal m... | 2026-11-03 |
| CVE-2026-109281 | medium | 4.4 | No | ImageMagick 7.1.0-21 before 7.1.2-32 contains a heap buffer over-read in its handling of the -fx option, where a certain -fx operation reads... | 2026-11-03 |