{"kind": "product", "path": "vulns/ubuntu-25.10/imagemagick", "name": "imagemagick", "product": "imagemagick", "ecosystem": "Ubuntu:25.10", "items": [{"id": "CVE-2026-56374", "noindex": false, "published": "2026-07-08T13:49:04.868Z", "modified": "2026-07-08T15:46:51.394Z", "cvss": 4.8, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00223, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-56374", "title": "ImageMagick - Heap Buffer Overflow in FTXT Encoder via format Parameter", "description": "ImageMagick before 7.1.2-19 contains a heap buffer overflow vulnerability in the FTXT encoder due to missing boundary checks when parsing ftxt:format. Remote attackers can trigger an out of bounds read by crafting malicious FTXT image files to cause denial of service or information disclosure.", "references": ["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-w54j-7wpm-crhj", "https://www.vulncheck.com/advisories/imagemagick-heap-buffer-overflow-in-ftxt-encoder-via-format-parameter", "https://nvd.nist.gov/vuln/detail/CVE-2026-56374"], "fixes": [], "products": [{"name": "imagemagick", "path": "vulns/ubuntu-25.10/imagemagick", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-56362", "noindex": false, "published": "2026-07-08T13:49:04.142Z", "modified": "2026-07-08T17:08:28.947Z", "cvss": 2.1, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N", "severity": "low", "epss": 0.00189, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-56362", "title": "ImageMagick - Heap-buffer-overflow Read in GetPixelIndex via OpenPixelCache Metadata Desynchronization", "description": "ImageMagick before 7.1.2-15 contains a heap-buffer-overflow read vulnerability in GetPixelIndex caused by OpenPixelCache updating image channel metadata before pixel cache memory allocation. Attackers can trigger memory and disk allocation failures to cause a heap-buffer-overflow read affecting any writer calling GetPixelIndex.", "references": ["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gq5v-qf8q-fp77", "https://www.vulncheck.com/advisories/imagemagick-heap-buffer-overflow-read-in-getpixelindex-via-openpixelcache-metadata-desynchronization", "https://nvd.nist.gov/vuln/detail/CVE-2026-56362"], "fixes": [], "products": [{"name": "imagemagick", "path": "vulns/ubuntu-25.10/imagemagick", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-55597", "noindex": false, "published": "2026-07-01T19:03:29.911Z", "modified": "2026-07-01T19:21:38.493Z", "cvss": 5.5, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00104, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-55597", "title": "ImageMagick: Heap Buffer Over-Write in JP2 encoder when due to incorrect handling of arguments", "description": "ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-26, an incorrect handling of arguments can cause a heap buffer over-write in the JP2 encoder. This issue has been fixed in version7.1.2-26.", "references": ["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-c4v7-w88g-m6c4", "https://nvd.nist.gov/vuln/detail/CVE-2026-55597"], "fixes": [], "products": [{"name": "imagemagick", "path": "vulns/ubuntu-25.10/imagemagick", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-55595", "noindex": false, "published": "2026-07-01T19:00:31.074Z", "modified": "2026-07-02T12:46:43.676Z", "cvss": 4.7, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00091, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-55595", "title": "ImageMagick: Infinite Loop in connected-components when providing invalid arguments", "description": "ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, when providing invalid arguments to the connected-components option an infinite loop will occur. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26.", "references": ["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qhmf-7fc4-8q3h", "https://nvd.nist.gov/vuln/detail/CVE-2026-55595"], "fixes": [], "products": [{"name": "imagemagick", "path": "vulns/ubuntu-25.10/imagemagick", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-55594", "noindex": false, "published": "2026-07-01T18:58:46.046Z", "modified": "2026-07-02T14:38:08.174Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "severity": "medium", "epss": 0.00241, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-55594", "title": "ImageMagick: Stack Overflow in MVG decoder due to missing depth check.", "description": "ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, a missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26.", "references": ["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mx48-2qq3-23hf", "https://nvd.nist.gov/vuln/detail/CVE-2026-55594"], "fixes": [], "products": [{"name": "imagemagick", "path": "vulns/ubuntu-25.10/imagemagick", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-55577", "noindex": false, "published": "2026-07-01T18:56:28.768Z", "modified": "2026-07-01T19:24:45.452Z", "cvss": 5.9, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00226, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-55577", "title": "ImageMagick: Heap Buffer Overflow in ImageMagick MVG decoder", "description": "ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, a heap buffer overflow occurs in the MVG decoder that could result in an out of bounds write when processing a crafted image. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26.", "references": ["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wx47-rm3x-jx6p", "https://nvd.nist.gov/vuln/detail/CVE-2026-55577"], "fixes": [], "products": [{"name": "imagemagick", "path": "vulns/ubuntu-25.10/imagemagick", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-55510", "noindex": false, "published": "2026-07-01T18:53:58.567Z", "modified": "2026-07-01T19:21:37.355Z", "cvss": 5.5, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00148, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-55510", "title": "ImageMagick: Use-After-Free in crafted 8BIM when identifying an image", "description": "ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, when identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26.", "references": ["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-ff5c-8x9r-8qcw", "https://nvd.nist.gov/vuln/detail/CVE-2026-55510"], "fixes": [], "products": [{"name": "imagemagick", "path": "vulns/ubuntu-25.10/imagemagick", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-53467", "noindex": false, "published": "2026-07-01T18:50:56.821Z", "modified": "2026-07-01T19:27:13.148Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": 0.00198, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-53467", "title": "ImageMagick: Information Disclosure in MNG decoder because allocated memory is left unchanged", "description": "ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, the MNG decoder contains a possible heap information disclosure vulnerability because part of the pixels are left unchanged. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26.", "references": ["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8g53-9m3c-69xg", "https://nvd.nist.gov/vuln/detail/CVE-2026-53467"], "fixes": [], "products": [{"name": "imagemagick", "path": "vulns/ubuntu-25.10/imagemagick", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-53466", "noindex": false, "published": "2026-07-01T18:20:44.416Z", "modified": "2026-07-01T18:52:17.717Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "severity": "medium", "epss": 0.0022, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-53466", "title": "ImageMagick: Heap Buffer Over-Read in XCF decoder due to integer conversion overflow", "description": "ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, an integer overflow in the XCF decoder can result in an out of bounds read when a crafted image is read, potentially resulting in a crash. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26.", "references": ["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pjxj-pchx-4c3m", "https://nvd.nist.gov/vuln/detail/CVE-2026-53466"], "fixes": [], "products": [{"name": "imagemagick", "path": "vulns/ubuntu-25.10/imagemagick", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-55628", "noindex": false, "published": "2026-07-01T18:16:23.076Z", "modified": "2026-07-29T20:30:01.982Z", "cvss": 5.5, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00098, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-55628", "title": "ImageMagick: Policy Bypass in concatenate operation due to missing checks", "description": "ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-26he, the `-concatenate` operation is missing policy checks, potentially resulting in both reading and writing to paths disallowed by the security policy. This issue has been fixed in version 7.1.2-26.", "references": ["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-82mp-vp5c-9pf7", "https://nvd.nist.gov/vuln/detail/CVE-2026-55628"], "fixes": [], "products": [{"name": "imagemagick", "path": "vulns/ubuntu-25.10/imagemagick", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-56377", "noindex": false, "published": "2026-06-30T22:08:39.614Z", "modified": "2026-07-01T14:55:29.511Z", "cvss": 4.8, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00164, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-56377", "title": "ImageMagick - Policy Bypass via Incorrect Path Validation", "description": "ImageMagick before 7.1.2-24 contains an incorrect policy check that allows attackers to create or truncate files disallowed by security policies. Remote attackers can bypass path policy restrictions in sandboxed conversion services to write arbitrary files outside intended boundaries.", "references": ["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gm48-c7f2-v67p", "https://www.vulncheck.com/advisories/imagemagick-policy-bypass-via-incorrect-path-validation", "https://nvd.nist.gov/vuln/detail/CVE-2026-56377"], "fixes": [], "products": [{"name": "imagemagick", "path": "vulns/ubuntu-25.10/imagemagick", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-56369", "noindex": false, "published": "2026-06-30T22:08:38.920Z", "modified": "2026-07-01T15:07:57.635Z", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.0023, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-56369", "title": "ImageMagick - Information Disclosure via AES-CTR Nonce Reuse in PasskeyEncipherImage", "description": "ImageMagick before 7.1.2-22 contains an information disclosure vulnerability in the PasskeyEncipherImage method due to AES-CTR nonce reuse. Attackers can exploit nonce reuse in the cipher implementation to recover plaintext information from encrypted images.", "references": ["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qv2q-c278-pch5", "https://www.vulncheck.com/advisories/imagemagick-information-disclosure-via-aes-ctr-nonce-reuse-in-passkeyencipherimage", "https://nvd.nist.gov/vuln/detail/CVE-2026-56369"], "fixes": [], "products": [{"name": "imagemagick", "path": "vulns/ubuntu-25.10/imagemagick", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-56365", "noindex": false, "published": "2026-06-30T22:08:38.238Z", "modified": "2026-07-01T13:16:12.822Z", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00284, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-56365", "title": "ImageMagick - Memory Leak in PNG Encoder via MNG Image Writing", "description": "ImageMagick before 7.1.2-19 contains a memory leak vulnerability in the PNG encoder when writing MNG images. Attackers can trigger the encoder failure condition to exhaust memory resources and cause denial of service.", "references": ["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-x928-4434-crqj", "https://www.vulncheck.com/advisories/imagemagick-memory-leak-in-png-encoder-via-mng-image-writing", "https://nvd.nist.gov/vuln/detail/CVE-2026-56365"], "fixes": [], "products": [{"name": "imagemagick", "path": "vulns/ubuntu-25.10/imagemagick", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-56364", "noindex": false, "published": "2026-06-30T22:08:37.521Z", "modified": "2026-07-01T13:50:14.626Z", "cvss": 1.8, "cvss_vector": "CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "severity": "low", "epss": 0.00154, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-56364", "title": "ImageMagick - Memory Leak in LoadOpenCLDeviceBenchmark() via Malformed XML", "description": "ImageMagick before 7.1.2-13 contains a memory leak vulnerability in LoadOpenCLDeviceBenchmark() function when parsing malformed OpenCL device profile XML files with unclosed device elements. Attackers with write access to the OpenCL cache directory can place malicious XML files to exhaust memory and cause denial of service.", "references": ["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qp59-x883-77qv", "https://github.com/ImageMagick/ImageMagick/commit/a52c1b402be08ef8ae193f28ac5b2e120f2fa26f", "https://www.vulncheck.com/advisories/imagemagick-memory-leak-in-loadopencldevicebenchmark-via-malformed-xml"], "fixes": [], "products": [{"name": "imagemagick", "path": "vulns/ubuntu-25.10/imagemagick", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-56363", "noindex": false, "published": "2026-06-30T22:08:36.839Z", "modified": "2026-07-01T14:46:38.751Z", "cvss": 4.8, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00111, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-56363", "title": "ImageMagick - Division by Zero in Binomial Kernel Processing", "description": "ImageMagick before 7.1.2-22 contains a division by zero vulnerability in binomial kernel processing that allows attackers to cause denial of service. An attacker can supply a large binomial kernel value causing integer overflow, resulting in division by zero and application crash.", "references": ["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vf33-6r7x-66xx", "https://www.vulncheck.com/advisories/imagemagick-division-by-zero-in-binomial-kernel-processing", "https://nvd.nist.gov/vuln/detail/CVE-2026-56363"], "fixes": [], "products": [{"name": "imagemagick", "path": "vulns/ubuntu-25.10/imagemagick", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-56361", "noindex": false, "published": "2026-06-30T22:08:36.159Z", "modified": "2026-07-01T14:28:19.148Z", "cvss": 4.8, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00128, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-56361", "title": "ImageMagick - Heap Buffer Overflow via Off-by-One in Morphology Processing", "description": "ImageMagick before 7.1.2-19 contains an off-by-one error in morphology validation allowing out-of-bounds heap buffer reads. Attackers can trigger heap buffer overflow by providing incorrect morphology parameters causing single pixel memory access violations.", "references": ["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-q8h3-jv9v-57qx", "https://www.vulncheck.com/advisories/imagemagick-heap-buffer-overflow-via-off-by-one-in-morphology-processing", "https://nvd.nist.gov/vuln/detail/CVE-2026-56361"], "fixes": [], "products": [{"name": "imagemagick", "path": "vulns/ubuntu-25.10/imagemagick", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-56370", "noindex": false, "published": "2026-06-24T11:53:21.113Z", "modified": "2026-06-25T13:20:32.154Z", "cvss": 4.8, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00177, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-56370", "title": "ImageMagick - Out-of-bounds Access in ConnectedComponentsImage via connected-components Artifact", "description": "ImageMagick before 7.1.2-19 contains an out-of-bounds access vulnerability in ConnectedComponentsImage() when processing connected-components artifacts with invalid indices. Attackers can trigger access violations by specifying malformed connected-components definitions via CLI, causing denial of service or potential code execution.", "references": ["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pmpg-6pww-fg6q", "https://www.vulncheck.com/advisories/imagemagick-out-of-bounds-access-in-connectedcomponentsimage-via-connected-components-artifact", "https://nvd.nist.gov/vuln/detail/CVE-2026-56370"], "fixes": [], "products": [{"name": "imagemagick", "path": "vulns/ubuntu-25.10/imagemagick", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-56368", "noindex": false, "published": "2026-06-24T11:53:20.423Z", "modified": "2026-06-24T13:40:10.781Z", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.0046, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-56368", "title": "ImageMagick - Memory Leak in Raw Pixel Data Coders", "description": "ImageMagick before 7.1.2-15 contains a memory leak vulnerability in multiple coders that write raw pixel data where allocated objects are not properly freed. Attackers can trigger this leak by processing specially crafted images, causing memory exhaustion and denial of service.", "references": ["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wfx3-6g53-9fgc", "https://www.vulncheck.com/advisories/imagemagick-memory-leak-in-raw-pixel-data-coders", "https://nvd.nist.gov/vuln/detail/CVE-2026-56368"], "fixes": [], "products": [{"name": "imagemagick", "path": "vulns/ubuntu-25.10/imagemagick", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-56379", "noindex": false, "published": "2026-06-23T12:13:05.492Z", "modified": "2026-07-15T00:42:36.269Z", "cvss": 9.2, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "critical", "epss": 0.01643, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-56379", "title": "ImageMagick - Command Injection via SVG Decoder", "description": "ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows attackers to inject arbitrary MVG drawing commands. Attackers can craft malicious SVG files with injected Magick Vector Graphics commands that execute during rendering.", "references": ["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xpg8-7m6m-jf56", "https://www.vulncheck.com/advisories/imagemagick-command-injection-via-svg-decoder", "https://access.redhat.com/security/cve/CVE-2026-56379"], "fixes": [], "products": [{"name": "imagemagick", "path": "vulns/ubuntu-25.10/imagemagick", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-56376", "noindex": false, "published": "2026-06-23T12:13:04.795Z", "modified": "2026-06-23T13:06:10.787Z", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.0032, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-56376", "title": "ImageMagick - Heap Use-After-Free in Meta Coder", "description": "ImageMagick before 7.1.2-15 and 6.9.13-40 contains a heap use-after-free in the meta coder: when memory allocation fails, a single byte is written to a stale pointer. Remote attackers can trigger it by processing specially crafted image files, causing a denial of service.", "references": ["https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-2gq3-ww97-wfjm", "https://www.vulncheck.com/advisories/imagemagick-heap-use-after-free-in-meta-coder", "https://nvd.nist.gov/vuln/detail/CVE-2026-56376"], "fixes": [], "products": [{"name": "imagemagick", "path": "vulns/ubuntu-25.10/imagemagick", "ecosystem": "Ubuntu:25.10"}]}], "total": 132, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 7, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "imagemagick", "path": "vulns/ubuntu-25.10/imagemagick", "ecosystem": "Ubuntu:25.10"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-07-29T20:30:01.982Z", "early_advisories": [], "license": "You may freely use the PatchFirst selection and our additions (priorities, early warnings, texts, summaries and aggregates) for your own purposes, including internal business use. Resale, commercial distribution and bulk mirroring of this selection or these additions require a written agreement with the operator. Whenever you use or publish the selection or our additions, credit PatchFirst (https://patchfirst.dev/vulns/) with this link to the regional feed page. Original records from open sources remain subject to their respective licenses and terms. These conditions do not restrict your rights to the original data, which you can obtain directly from those sources.", "terms_url": "https://patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "Records are selected, normalized and combined by PatchFirst; summaries and translations may be added. News is credited with a link to the original source in each entry.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Upstream licenses vary; see the source catalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Free public scores; attribution requested (FIRST EPSS, scores generated by Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}