WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product .net✕
Overview 567 matches · 0 in Waratek scope · 0 protected · 27 exploited · 11 CISA KEV · 78 public PoC · 26 EPSS ≥ 0.5
567matches 0in Waratek scope0.0% 0protected0.0% 27exploited4.8% 11CISA KEV1.9% 78public PoC13.8% 26EPSS ≥ 0.54.6%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 567 100.0% Withdrawn CVE 0 0.0%
Critical 49 8.6% High 356 62.8% Medium 158 27.9% Low 4 0.7% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 567 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 27 4.8% Working exploit published 59 10.4% Proof of concept only 19 3.4% Forecast only 3 0.5% No public exploit 459 81.0%
split by peak 100 / year
Not applicable: 567 Low: 4Medium: 158High: 356Critical: 49 not blocked: 567 No public exploit: 459Forecast only: 3Proof of concept only: 19Working exploit published: 59Exploited: 27
20024 Not applicable4 High1 Medium3 not blocked4 No public exploit4 20031 Not applicable1 Medium1 not blocked1 No public exploit1 20042 Not applicable2 Critical1 High1 not blocked2 Exploited1 Working exploit published1 20058 Not applicable8 High1 Medium7 not blocked8 Exploited1 Working exploit published1 No public exploit6 200613 Not applicable13 High3 Medium10 not blocked13 Exploited1 Working exploit published6 No public exploit6 200715 Not applicable15 High10 Medium5 not blocked15 Working exploit published8 No public exploit7 200815 Not applicable15 High11 Medium4 not blocked15 Exploited1 Working exploit published1 No public exploit13 200931 Not applicable31 High21 Medium9 Low1 not blocked31 Exploited3 Working exploit published16 No public exploit12 201011 Not applicable11 High4 Medium6 Low1 not blocked11 Exploited1 Working exploit published3 No public exploit7 20116 Not applicable6 High4 Medium2 not blocked6 Working exploit published1 No public exploit5 201219 Not applicable19 High13 Medium6 not blocked19 Working exploit published2 No public exploit17 201320 Not applicable20 High16 Medium4 not blocked20 Exploited1 Forecast only1 No public exploit18 201418 Not applicable18 High6 Medium12 not blocked18 Exploited4 Working exploit published3 No public exploit11 201522 Not applicable22 High15 Medium6 Low1 not blocked22 Exploited1 Working exploit published6 Forecast only1 No public exploit14 20169 Not applicable9 Critical1 High6 Medium2 not blocked9 Working exploit published2 No public exploit7 201719 Not applicable19 Critical7 High9 Medium3 not blocked19 Exploited4 Working exploit published2 No public exploit13 201832 Not applicable32 Critical3 High22 Medium7 not blocked32 Working exploit published1 No public exploit31 201934 Not applicable34 Critical4 High20 Medium10 not blocked34 Exploited1 Working exploit published3 No public exploit30 202020 Not applicable20 Critical3 High14 Medium3 not blocked20 Exploited3 Proof of concept only1 No public exploit16 202126 Not applicable26 Critical6 High14 Medium6 not blocked26 Exploited1 Working exploit published1 Proof of concept only1 No public exploit23 202235 Not applicable35 Critical5 High21 Medium9 not blocked35 Proof of concept only3 No public exploit32 202351 Not applicable51 Critical7 High32 Medium12 not blocked51 Exploited2 Working exploit published1 Proof of concept only6 Forecast only1 No public exploit41 202435 Not applicable35 Critical2 High25 Medium8 not blocked35 Exploited1 Proof of concept only4 No public exploit30 202521 Not applicable21 Critical4 High14 Medium3 not blocked21 Working exploit published1 Proof of concept only1 No public exploit19 2026100 Not applicable100 Critical6 High73 Medium20 Low1 not blocked100 Exploited1 Proof of concept only3 No public exploit96
2002200420062008201020122014201620182020202220242026
567 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 1 of 6 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2026-97788 High 2026-10-13 Not applicable No public exploit Observable discrepancy in Active Directory Federation Services (AD FS) allows an unauthorized attacker to disclose information over a network.
CVE-2026-96960 High 2026-10-13 Not applicable No public exploit Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a network.
CVE-2026-96959 High 2026-10-13 Not applicable No public exploit Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
CVE-2026-96958 High 2026-10-13 Not applicable No public exploit Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
CVE-2026-96957 High 2026-10-13 Not applicable No public exploit Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-96222 High 2026-10-13 Not applicable No public exploit Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-88092 Critical 2026-10-13 Not applicable No public exploit Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network.
CVE-2026-71328 High 2026-09-08 Not applicable No public exploit Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.
CVE-2026-69806 High 2026-09-08 Not applicable No public exploit Exposure of sensitive information to an unauthorized actor in .NET allows an authorized attacker to elevate privileges locally.
CVE-2026-69439 High 2026-09-08 Not applicable No public exploit Heap-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-69304 Medium 2026-09-08 Not applicable No public exploit Improper handling of highly compressed data (data amplification) in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVE-2026-58649 Medium 2026-09-08 Not applicable No public exploit Origin validation error in .NET allows an unauthorized attacker to disclose information over a network.
CVE-2026-57099 High 2026-09-08 Not applicable No public exploit Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVE-2026-70354 High 2026-08-11 Not applicable No public exploit Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally.
CVE-2026-65810 High 2026-08-11 Not applicable No public exploit Relative path traversal in .NET Framework allows an unauthorized attacker to elevate privileges locally.
CVE-2026-62909 High 2026-08-11 Not applicable No public exploit Uncaught exception in .NET allows an authorized attacker to elevate privileges locally.
CVE-2026-62902 Medium 2026-08-11 Not applicable No public exploit Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to disclose information over a network.
CVE-2026-62901 High 2026-08-11 Not applicable No public exploit Unchecked input for loop condition in .NET allows an unauthorized attacker to deny service over a network.
CVE-2026-62900 Medium 2026-08-11 Not applicable No public exploit Improper removal of sensitive information before storage or transfer in .NET allows an unauthorized attacker to disclose information over a network.
CVE-2026-62899 Medium 2026-08-11 Not applicable No public exploit Inconsistent interpretation of http requests ('http request/response smuggling') in .NET allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-62898 High 2026-08-11 Not applicable No public exploit Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.
CVE-2026-62897 High 2026-08-11 Not applicable No public exploit Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to execute code locally.
CVE-2026-62886 High 2026-08-11 Not applicable No public exploit Integer overflow or wraparound in .NET allows an unauthorized attacker to elevate privileges locally.
CVE-2026-62872 High 2026-08-11 Not applicable No public exploit Incorrect authorization in .NET Framework allows an authorized attacker to elevate privileges over a network.
CVE-2026-62871 High 2026-08-11 Not applicable No public exploit Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally.
CVE-2026-58641 High 2026-08-11 Not applicable No public exploit Integer overflow or wraparound in .NET allows an unauthorized attacker to elevate privileges locally.
CVE-2026-14932 Medium 2026-07-22 Not applicable No public exploit In Progress® Telerik® UI for AJAX prior to v2026.2.708, the obsolete RadChart component's ChartImage.axd handler is vulnerable to unauthenticated file read and deletion of image-extension files within the application directory.
CVE-2026-14865 Medium 2026-07-22 Not applicable No public exploit In Progress® Telerik® UI for AJAX prior to v2026.2.708, the internal LayoutBuilder control processes client-state XML without disabling DTD processing, allowing unauthenticated denial of service via recursive XML entity expansion.
CVE-2026-13192 Medium 2026-07-22 Not applicable No public exploit In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of content submitted to the RadEditor PDF export feature may allow an authenticated attacker to trigger server-side requests to arbitrary hosts, resulting in outbound network connections and potential exposure of Windows authentication credentials.
CVE-2026-13190 High 2026-07-22 Not applicable No public exploit In Progress® Telerik® UI for AJAX prior to v2026.2.708, a deserialization vulnerability in the persistence utilities allows unsafe type instantiation from attacker-influenced persisted state, which can lead to remote code execution.
CVE-2026-13189 High 2026-07-22 Not applicable No public exploit In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of the language parameter in the spell check handler may allow an attacker to influence server-side file path resolution and trigger unintended server-side requests.
CVE-2026-13188 Medium 2026-07-22 Not applicable No public exploit In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler request parameters may be tampered with, potentially altering dialog server-side behavior and enabling chained exploitation.
CVE-2026-13187 High 2026-07-22 Not applicable No public exploit In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler provider type input may be tampered with, potentially altering dialog processing and enabling chained exploitation.
CVE-2026-13186 High 2026-07-22 Not applicable No public exploit In Progress® Telerik® UI for AJAX prior to v2026.2.708, a path traversal vulnerability in the file-based persistence storage provider can be exploited when the storage key is derived from user-controlled input, enabling attacker-controlled deserialization and remote code execution.
CVE-2026-13185 High 2026-07-22 Not applicable No public exploit In Progress® Telerik® UI for AJAX prior to v2026.2.708, applications using cookie-based storage in RadPersistenceManager or RadDockLayout deserialize attacker-controlled cookie content, allowing unauthenticated remote code execution.
CVE-2026-13184 High 2026-07-22 Not applicable No public exploit In Progress® Telerik® UI for AJAX prior to v2026.2.708, when Telerik.Upload.ConfigurationHashKey is absent and machineKey is not explicitly configured, upload metadata integrity protection may fall back to a predictable default key, enabling attackers to forge protected upload metadata and unlock further exploit chains.
CVE-2026-13183 High 2026-07-22 Not applicable No public exploit In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload upload metadata processing may leak cryptographic validity through measurable timing differences, enabling remote attackers to recover protected metadata values.
CVE-2026-13182 High 2026-07-22 Not applicable No public exploit In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload client-state processing can distinguish decrypt failures from invalid-JSON parse failures, creating an oracle that reveals protected metadata values to remote attackers.
CVE-2026-13181 High 2026-07-22 Not applicable No public exploit In Progress® Telerik® UI for AJAX prior to v2026.2.708, forged upload metadata can influence AsyncUploadTypeName processing and trigger unsafe attacker-controlled type resolution, enabling remote code execution in affected deployments.
CVE-2026-57108 High 2026-07-14 Not applicable No public exploit Access of resource using incompatible type ('type confusion') in .NET Core allows an unauthorized attacker to deny service over a network.
CVE-2026-56170 High 2026-07-14 Not applicable No public exploit Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVE-2026-50659 Medium 2026-07-14 Not applicable No public exploit Improper encoding or escaping of output in .NET allows an authorized attacker to perform spoofing over a network.
CVE-2026-50653 High 2026-07-14 Not applicable No public exploit Loop with unreachable exit condition ('infinite loop') in Azure Active Directory allows an unauthorized attacker to deny service over a network.
CVE-2026-50652 High 2026-07-14 Not applicable No public exploit Deserialization of untrusted data in Azure Active Directory allows an unauthorized attacker to deny service over a network.
CVE-2026-50651 High 2026-07-14 Not applicable No public exploit Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
CVE-2026-50650 High 2026-07-14 Not applicable No public exploit Improper control of generation of code ('code injection') in .NET Framework allows an unauthorized attacker to elevate privileges locally.
CVE-2026-50649 High 2026-07-14 Not applicable No public exploit Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally.
CVE-2026-50648 High 2026-07-14 Not applicable No public exploit Allocation of resources without limits or throttling in .NET Framework allows an unauthorized attacker to deny service over a network.
CVE-2026-50647 High 2026-07-14 Not applicable No public exploit Loop with unreachable exit condition ('infinite loop') in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.
CVE-2026-50646 High 2026-07-14 Not applicable No public exploit Protection mechanism failure in .NET Framework allows an unauthorized attacker to execute code locally.
CVE-2026-50528 High 2026-07-14 Not applicable No public exploit Incorrect authorization in .NET allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-50527 High 2026-07-14 Not applicable No public exploit Stack-based buffer overflow in .NET Framework allows an unauthorized attacker to deny service over a network.
CVE-2026-50526 High 2026-07-14 Not applicable No public exploit Improper link resolution before file access ('link following') in .NET allows an authorized attacker to perform tampering locally.
CVE-2026-50525 High 2026-07-14 Not applicable No public exploit Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
CVE-2026-50524 High 2026-07-14 Not applicable No public exploit Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to deny service over a network.
CVE-2026-50506 High 2026-07-14 Not applicable No public exploit Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVE-2026-50411 High 2026-07-14 Not applicable No public exploit Stack-based buffer overflow in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.
CVE-2026-50368 High 2026-07-14 Not applicable No public exploit Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker to deny service over a network.
CVE-2026-50355 High 2026-07-14 Not applicable No public exploit Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker to deny service over a network.
CVE-2026-47304 Critical 2026-07-14 Not applicable No public exploit Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-47303 High 2026-07-14 Not applicable No public exploit Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
CVE-2026-47302 High 2026-07-14 Not applicable No public exploit Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
CVE-2026-47300 High 2026-07-14 Not applicable No public exploit Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
CVE-2026-45646 High 2026-07-14 Not applicable No public exploit Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVE-2026-47898 Medium 2026-07-03 Not applicable No public exploit Improper Restriction of XML External Entity Reference vulnerability in Apache Lucene.Net (Lucene.Net.Analysis.Common library). This issue affects Apache Lucene.Net.Analysis.Common: from 4.8.0-beta00005 before 4.8.0-beta00018. Users are recommended to upgrade to version 4.8.0-beta00018, which fixes the issue.
CVE-2026-47897 High 2026-07-03 Not applicable No public exploit Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Lucene.Net (Lucene.Net.Replicator library). This issue affects Apache Lucene.Net.Replicator: from 4.8.0-beta00005 before 4.8.0-beta00018. Users are recommended to upgrade to version 4.8.0-beta00018, which fixes the issue.
CVE-2026-47896 High 2026-07-03 Not applicable No public exploit Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Lucene.Net (Lucene.Net.Replicator library). This issue affects Apache Lucene.Net.Replicator: from 4.8.0-beta00005 through 4.8.0-beta00017. Users are recommended to upgrade to version 4.8.0-beta00018, which fixes the issue.
CVE-2026-45591 High 2026-06-09 Not applicable No public exploit Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVE-2026-45491 Medium 2026-06-09 Not applicable No public exploit Improper link resolution before file access ('link following') in .NET allows an unauthorized attacker to perform tampering locally.
CVE-2026-45490 High 2026-06-09 Not applicable No public exploit Improper authorization in .NET allows an authorized attacker to elevate privileges locally.
CVE-2026-42899 High 2026-05-12 Not applicable No public exploit Loop with unreachable exit condition ('infinite loop') in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVE-2026-35433 High 2026-05-12 Not applicable No public exploit Improper input validation in .NET allows an unauthorized attacker to elevate privileges locally.
CVE-2026-32177 High 2026-05-12 Not applicable No public exploit Heap-based buffer overflow in .NET allows an unauthorized attacker to elevate privileges locally.
CVE-2026-32175 Medium 2026-05-12 Not applicable No public exploit A tampering vulnerability exists when .NET Core improperly handles specially crafted files. An attacker who successfully exploited this vulnerability could write arbitrary files and directories to certain locations on a vulnerable system. However, an attacker would have limited control over the destination of the files and directories. To exploit the vulnerability, an attacker must send a specially crafted file to a vulnerable system. The security update fixes the vulnerability by ensuring .NET Core properly handles files.
CVE-2026-6023 Critical 2026-04-22 Not applicable No public exploit In Progress® Telerik® UI for AJAX versions 2024.4.1114 through 2026.1.421, the RadFilter control is vulnerable to insecure deserialization when restoring filter state if the state is exposed to the client. If an attacker tampers with this state, a server-side remote code execution is possible.
CVE-2026-6022 High 2026-04-22 Not applicable No public exploit In Progress® Telerik® UI for AJAX prior to 2026.1.421, RadAsyncUpload contains an uncontrolled resource consumption vulnerability that allows file uploads to exceed the configured maximum size due to missing cumulative size enforcement during chunk reassembly, leading to disk space exhaustion.
CVE-2026-40372 Critical 2026-04-21 Not applicable No public exploit Improper verification of cryptographic signature in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-5964 Critical 2026-04-20 Not applicable No public exploit EasyFlow .NET developed by Digiwin has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.
CVE-2026-5963 Critical 2026-04-20 Not applicable No public exploit EasyFlow .NET developed by Digiwin has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.
CVE-2026-33116 High 2026-04-14 Not applicable No public exploit Loop with unreachable exit condition ('infinite loop') in .NET, .NET Framework, Visual Studio allows an unauthorized attacker to deny service over a network.
CVE-2026-32226 Medium 2026-04-14 Not applicable No public exploit Concurrent execution using shared resource with improper synchronization ('race condition') in .NET Framework allows an unauthorized attacker to deny service over a network.
CVE-2026-32203 High 2026-04-14 Not applicable No public exploit Stack-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to deny service over a network.
CVE-2026-32178 High 2026-04-14 Not applicable No public exploit Improper neutralization of special elements in .NET allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-26171 High 2026-04-14 Not applicable No public exploit Uncontrolled resource consumption in .NET allows an unauthorized attacker to deny service over a network.
CVE-2026-23666 High 2026-04-14 Not applicable No public exploit Improper input validation in .NET Framework allows an unauthorized attacker to deny service over a network.
CVE-2026-25667 High 2026-03-19 Not applicable No public exploit ASP.NET Core Kestrel in Microsoft .NET 8.0 before 8.0.22 and .NET 9.0 before 9.0.11 allows a remote attacker to cause excessive CPU consumption by sending a crafted QUIC packet, because of an incorrect exit condition for HTTP/3 Encoder/Decoder stream processing.
CVE-2026-26131 High 2026-03-10 Not applicable No public exploit Incorrect default permissions in .NET allows an authorized attacker to elevate privileges locally.
CVE-2026-26130 High 2026-03-10 Not applicable No public exploit Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVE-2026-26127 High 2026-03-10 Not applicable Exploited Out-of-bounds read in .NET allows an unauthorized attacker to deny service over a network.
CVE-2026-3263 Medium 2026-02-26 Not applicable Proof of concept only A vulnerability was found in go2ismail Asp.Net-Core-Inventory-Order-Management-System up to 9.20250118. Affected by this vulnerability is an unknown functionality of the file /api/Security/ of the component Security API. Performing a manipulation results in improper authorization. Remote exploitation of the attack is possible. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-3262 Low 2026-02-26 Not applicable Proof of concept only A vulnerability has been found in go2ismail Asp.Net-Core-Inventory-Order-Management-System up to 9.20250118. Affected is an unknown function of the component Administrative Interface. Such manipulation leads to execution after redirect. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-27799 Medium 2026-02-26 Not applicable No public exploit ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer over-read vulnerability exists in the DJVU image format handler. The vulnerability occurs due to integer truncation when calculating the stride (row size) for pixel buffer allocation. The stride calculation overflows a 32-bit signed integer, resulting in an out-of-bounds memory reads. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-27798 High 2026-02-26 Not applicable No public exploit ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer over-read vulnerability occurs when processing an image with small dimension using the `-wavelet-denoise` operator. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-2878 Medium 2026-02-25 Not applicable No public exploit In Progress® Telerik® UI for AJAX, versions prior to 2026.1.225, an insufficient entropy vulnerability exists in RadAsyncUpload, where a predictable temporary identifier, based on timestamp and filename, can enable collisions and file content tampering.
CVE-2026-25637 Medium 2026-02-24 Not applicable No public exploit ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-15, a memory leak in the ASHLAR image writer allows an attacker to exhaust process memory by providing a crafted image that results in small objects that are allocated but never freed. Version 7.1.2-15 contains a patch.
CVE-2026-25576 Medium 2026-02-24 Not applicable No public exploit ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer over-read vulnerability exists in multiple raw image format handles. The vulnerability occurs when processing images with -extract dimensions larger than -size dimensions, causing out-of-bounds memory reads from a heap-allocated buffer. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-24485 High 2026-02-24 Not applicable No public exploit ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, when a PCD file does not contain a valid Sync marker, the DecodeImage() function becomes trapped in an infinite loop while searching for the Sync marker, causing the program to become unresponsive and continuously consume CPU resources, ultimately leading to system resource exhaustion and denial of service. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-24484 Medium 2026-02-24 Not applicable No public exploit ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, Magick fails to check for multi-layer nested mvg conversions to svg, leading to DoS. Versions 7.1.2-15 and 6.9.13-40 contain a patch.
CVE-2026-21218 High 2026-02-10 Not applicable No public exploit Improper handling of missing special element in .NET allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-23952 High 2026-01-22 Not applicable Proof of concept only ImageMagick is free and open-source software used for editing and manipulating digital images. Versions 14.10.1 and below have a NULL pointer dereference vulnerability in the MSL (Magick Scripting Language) parser when processing <comment> tags before images are loaded. This can lead to DoS attack due to assertion failure (debug builds) or NULL pointer dereference (release builds). This issue is fixed in version 14.10.2.
‹ prev page 1 of 6 next ›