ImageMagick before 7.1.2-15 and 6.9.x before 6.9.13-40 contains an integer overflow in the PSB (PSD v2) RLE decoding path (ReadPSDChannelRLE in coders/psd.c) that causes a heap out-of-bounds read on 32-bit builds. Processing a crafted PS…

▾ SunlitImageMagick · ImageMagickEPSS 0.24%via CVEORG

CVE-2026-56378Low· 3.7

4mo ago

ImageMagick - Heap Out-of-Bounds Read in PCD Decoder

ImageMagick before 7.1.2-15 (and 6.x before 6.9.13-40) contains a heap out-of-bounds read in the PCD coder's DecodeImage loop. A crafted PCD file can trigger a one-byte heap out-of-bounds read during image decoding, resulting in denial o…

▾ SunlitImageMagick · ImageMagickEPSS 0.39%via CVEORG

CVE-2026-12799Medium· 4.3

4mo ago

BerriAI litellm: UI User Enumeration leads to System-Wide Information Disclosure

▾ Sunlitlitellm · litellmEPSS 0.43%via OSV

GHSA-24r3-p3x6-cqvxCritical· 9.6

4mo ago

Duplicate Advisory: SiYuan Vulnerable to Remote Code Execution via Malicious Bazaar Package — Marketplace XSS

▾ Midnightsiyuan-note · github.com/siyuan-note/siyuan/kernelvia GHSA

CVE-2026-56397Critical· 9.6PoC

4mo ago

SiYuan before v3.6.1 fails to sanitize package metadata and README content in the Bazaar marketplace, allowing malicious package authors to inject arbitrary HTML and JavaScript

SiYuan before v3.6.1 fails to sanitize package metadata and README content in the Bazaar marketplace, allowing malicious package authors to inject arbitrary HTML and JavaScript. Attackers can achieve remote code execution on any user bro…

▾ AbyssalSiYuan · SiYuanEPSS 0.50%via NVD

CVE-2026-56265Critical· 9.8PoC

4mo ago

Crawl4AI - Authentication Bypass via Hardcoded JWT Signing Key

Crawl4AI before 0.8.7 contains an authentication bypass vulnerability due to a hardcoded default JWT signing key in the Docker API server. Attackers who know the default key can forge valid authentication tokens for any user, bypassing a…

▾ AbyssalCrawl4AI · Crawl4AIEPSS 2.6%via CVEORG

CVE-2026-12796Medium· 6.3

4mo ago

BerriAI litellm: SSO Login Does Not Invalidate Previous UI Session Tokens

▾ Sunlitlitellm · litellmEPSS 0.57%via OSV

CVE-2026-12798Medium· 6.3

4mo ago

BerriAI litellm has SSRF via Unvalidated spec_path URL in MCP OpenAPI Spec Loader

▾ Sunlitlitellm · litellmEPSS 0.40%via OSV

Tagged “ghsa”

Glances: XML-RPC Server Missing Host Header Validation Enables DNS Rebinding Attack

@actual-app/cli `--format csv` Output Vulnerable to CSV Formula Injection via Custom `escapeCsv` Helper

@actual-app/sync-server's missing authorization on GET /secret/:name allows non-admin OpenID users to enumerate admin-configured bank-sync secrets

Gogs has SSRF in webhook deliveries

skillctl: argument injection, path traversal in --dest, FIFO/device DoS, hardlink exfiltration, and commit-trailer forgery

Budibase: SSRF via OAuth2 token endpoint URL reaches internal hosts and cloud metadata

nebula-mesh's stores enrollment tokens unhashed in SQLite

devbridge-autocomplete has XSS in its default formatters: formatGroup and formatResult fail to escape HTML in untrusted inputs

zeroconf: Unvalidated rdlength in record payload readers allows LAN-local cache corruption via crafted mDNS packet

Budibase has an Account Impersonation Issue — Chat Identity Link Hijacking via Missing Consent & CSRF

Budibase: Unauthenticated S3 signed upload URL generation allows arbitrary writes with stored datasource credentials

Budibase: POST /api/attachments/:datasourceId/url is unauthenticated and lets anonymous callers mint S3 PUT pre-signed URLs using stored datasource IAM credentials

@actual-app/sync-server: Disabled OpenID users keep access through existing session tokens

Budibase: Mass Assignment in Webhook Trigger Allows Cross-Workspace Automation Execution via appId Override

Budibase has arbitrary file read by workspace-builder via PWA-zip symlink upload

@budibase/backend-core has potential SSRF DNS rebinding bypass in outbound fetch validation

@actual-app/web has CSV Formula Injection in Transaction Export via Imported Payee/Notes Fields

Gogs has DoS in rendering issue index pattern

Gogs has Stored XSS in `.ipynb` Preview

Gogs Missing Authorization in Attachment Download

Duplicate Advisory: ImageMagick: Malicious PCD files trigger 1‑byte heap Out-of-bounds Read and DoS

Duplicate Advisory: ImageMagick: Integer Overflow in PSB (PSD v2) RLE decoding path causes heap Out of Bounds reads for 32-bit builds

ImageMagick - Heap Out-of-Bounds Read in PSB RLE Decoding

ImageMagick - Heap Out-of-Bounds Read in PCD Decoder

BerriAI litellm: UI User Enumeration leads to System-Wide Information Disclosure

Duplicate Advisory: SiYuan Vulnerable to Remote Code Execution via Malicious Bazaar Package — Marketplace XSS

SiYuan before v3.6.1 fails to sanitize package metadata and README content in the Bazaar marketplace, allowing malicious package authors to inject arbitrary HTML and JavaScript

Crawl4AI - Authentication Bypass via Hardcoded JWT Signing Key

BerriAI litellm: SSO Login Does Not Invalidate Previous UI Session Tokens

BerriAI litellm has SSRF via Unvalidated spec_path URL in MCP OpenAPI Spec Loader