Archive
7 September 2026
Vulnerabilities first published on this day (UTC), newest first.
23 results · Clear filters · Feed
-
Low 2.3
Terminal escape sequence injection in the mix igniter.install confirmation prompt via package metadata
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project igniter allows a malicious package publisher to forge the mix igniter.install confirmation prompt. mix igniter.install prints a confirmation panel (an anti-typosquattin…
-
Low 2.1
Non-canonical ULID spellings are accepted and alias to the same record in ash_double_entry
Improper Handling of Alternate Encoding vulnerability in ash-project ash_double_entry allows an attacker to submit several distinct string spellings of the same identifier. AshDoubleEntry.ULID renders a 128-bit ULID as 26 Crockford base-32 characters, but the…
-
Low 3.3
In JetBrains IntelliJ IDEA before 2026.2.2 opening an untrusted project could trigger SSRF via Kubernetes spec-source U…
-
Low 3.3
In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust check leaked project metadata to JetBrains Marketplace
-
Low 2.8
In JetBrains IntelliJ IDEA before 2026.2.2 terminal command input could be written to idea.log
-
Low 3.5
In JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project and organization icon uploads
-
Low 3.1
In JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed read-only whiteboard users to modify canv…
-
Low 3.5
In JetBrains YouTrack before 2026.2.18634 iP spoofing via HTTP headers allowed forged Bitbucket webhooks
-
Low 3.7
In JetBrains YouTrack before 2026.2.18634 the generic VCS webhook handler failed open when its secret was blank
-
Low 3.3
ImageMagick before 7.1.2-30 Heap-use-after-free via Layer
ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after-free vulnerability in the Layer method of PerlMagick. An attacker who supplies a crafted list of images can trigger memory access after deallocation, resulting in a crash (denial…
-
Low 2.5
ImageMagick before 7.1.2-30 Path Traversal via TOCTOU Symlink Race
ImageMagick before 7.1.2-30 and 6.9.13-55 contains a time-of-check-time-of-use (TOCTOU) vulnerability in the video decoder that allows attackers to bypass path policy write restrictions via symlink swaps. An attacker can replace a symlink between policy valid…
-
Low 3.3
ImageMagick before 7.1.2-30 Path Policy TOCTOU Symlink Race
ImageMagick before 7.1.2-30 contains a time-of-check-time-of-use vulnerability in path policy enforcement on Windows that allows attackers to bypass read or write restrictions by exploiting symlink race conditions. Attackers can swap symlinks between policy v…
-
Low 3.3
ImageMagick before 7.1.2-30 Heap-use-after-free via GetList
ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after-free vulnerability in the GetList method of PerlMagick. A crafted call to the GetList method can trigger the use-after-free, resulting in a crash (denial of service).
-
Low 3.7
ImageMagick before 7.1.2-30 Memory Leak via MSL decoder
ImageMagick before 7.1.2-30 and 6.9.13-55 contains a memory leak in the MSL image decoder. A crafted MSL image triggers memory allocation without proper deallocation, allowing an attacker to exhaust memory and cause a denial of service.
-
Low 3.7
ImageMagick before 7.1.2-30 Denial of Service Memory Budget
ImageMagick before 7.1.2-30 and 6.9.13-55 fails to properly lower the memory budget when an operation inside OpenPixelCache fails. Repeated triggering of such failures can exhaust the process memory budget and result in a denial of service.
-
Low 2.3
MISP Dashboard Organisation Widgets Bypass Organisation-Index Restrictions and Expose Hidden Organisation Data
Affected versions of MISP contain inconsistent authorization checks across dashboard widgets that display organisation information. Several organisation-related widgets did not honor Security.hide_organisation_index_from_users. As a result, authenticated user…
-
Low 2.3
MISP Dashboard Organisation Picker Exposes Hidden Organisation Metadata to Unauthorized Users
Affected versions of MISP expose organisation metadata through the dashboard organisation picker without applying the same visibility restrictions enforced by the normal organisation index and per-organisation view. The affected endpoint returned fields inclu…
-
Low 3.5
code-projects Hospital Information System Patient Management editPatient.php cross site scripting
A vulnerability has been found in code-projects Hospital Information System 1.0. Affected is an unknown function of the file /HIS/src/patients/editPatient.php of the component Patient Management. Such manipulation of the argument ID leads to cross site script…
-
Low 3.5
HCL MyXalytics is affected by multiple security vulnerabilities.
HCL MyXalytics was affected by Potential DOS Vulnerability. It allows users to input data without any restriction on the number of characters which can impact system performance or availability.
-
Low 3.5
HCL MyXalytics is affected by multiple security vulnerabilities.
HCL MyXalytics was affected by Content Spoofing Vulnerability. It may allow an attacker to manipulate displayed content, making it appear as though it originates from a trusted source, potentially leading to phishing or data theft.
-
Low 3.5
HCL MyXalytics is affected by multiple security vulnerabilities.
HCL MyXalytics was affected by Improper Input validation Vulnerability. It allow malicious or unexpected data to cause unintended system behaviour or security issues.
-
Low 1.8
OpenVPN 2.0.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows allows local authenticated users to cause a denial…
-
Low 2.3
OpenVPN 2.5.0 through 2.7.6 on Windows using the tap-windows6 driver allows attackers to trigger an out-of-bounds write…