Security advisories

low2026-04-14

CVE-2026-56370-ImageMagick has out-of-bounds access in ConnectedComponentsImage() via CLI-controlled connected-components:* artifacts

imagemagick/imagemagick · GHSA-pmpg-6pww-fg6q

low2026-04-14

ImageMagick has a heap buffer overflow read in magnify operation via unrecognized magnify:method value

imagemagick/imagemagick · GHSA-8vfj-q2cp-5m5j

medium2026-04-14

ImageMagick has has a stack-buffer-overflow in MNG encoder with oversized pallete

imagemagick/imagemagick · GHSA-98cp-rj9f-6v5g

low2026-04-14

ImageMagick has has an off-by-one origin validation in allows out-of-bounds read in morphology processing

imagemagick/imagemagick · GHSA-q8h3-jv9v-57qx

low2026-04-14

ImageMagick has a heap-buffer-overflow in FTXT encoder

imagemagick/imagemagick · GHSA-w54j-7wpm-crhj

high2026-04-14

CVE-2026-26171-Microsoft Security Advisory CVE-2026-26171 – .NET Denial of Service Vulnerability

dotnet/runtime · GHSA-w3x6-4m5h-cxqf

high2026-04-14

CVE-2026-33116-Microsoft Security Advisory CVE-2026-33116 – .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability

dotnet/runtime · GHSA-37gx-xxp4-5rgx

low2026-04-14

CVE-2026-32178-Microsoft Security Advisory CVE-2026-32178 – .NET Spoofing Vulnerability

dotnet/runtime · GHSA-vmwf-m9c5-3jvc

high2026-04-14

CVE-2026-41064-WWBN AVideo has an incomplete fix for CVE-2026-33502: Command Injection

wwbn/avideo · GHSA-pq8p-wc4f-vg7j

medium2026-04-14

CVE-2026-41063-WWBN AVideo has an incomplete fix for CVE-2026-33500: XSS

wwbn/avideo · GHSA-m7r8-6q9j-m2hc

medium2026-04-14

CVE-2026-41062-WWBN AVideo has an Incomplete fix: Directory traversal bypass via query string in ReceiveImage downloadURL parameters

wwbn/avideo · GHSA-m63r-m9jh-3vc6

high2026-04-14

Novu has a XSS sanitization bypass

novuhq/novu · GHSA-26wg-9xf2-q495

high2026-04-14

Novu has SSRF via conditions filter webhook bypasses validateUrlSsrf() protection

novuhq/novu · GHSA-4x48-cgf9-q33f

medium2026-04-14

CVE-2026-41061-WWBN AVideo has Stored XSS via Unanchored Duration Regex in Video Encoder Receiver

wwbn/avideo · GHSA-8pv3-29pp-pf8f

high2026-04-14

CVE-2026-41060-WWBN AVideo has a SSRF via same-domain hostname with alternate port bypasses isSSRFSafeURL

wwbn/avideo · GHSA-j432-4w3j-3w8j

medium2026-04-14

CVE-2026-41058-WWBN AVideo has an incomplete fix for CVE-2026-33293: Path Traversal

wwbn/avideo · GHSA-5879-4fmr-xwf2

high2026-04-14

CVE-2026-41057-WWBN AVideo has a CORS Origin Reflection Bypass via plugin/API/router.php and allowOrigin(true) Exposes Authenticated API Responses

wwbn/avideo · GHSA-ff5q-cc22-fgp4

high2026-04-14

CVE-2026-41056-WWBN AVideo has CORS Origin Reflection with Credentials on Sensitive API Endpoints Enables Cross-Origin Account Takeover

wwbn/avideo · GHSA-ccq9-r5cw-5hwq

medium2026-04-14

CVE-2026-41055-WWBN AVideo has an incomplete fix for CVE-2026-33039: SSRF

wwbn/avideo · GHSA-793q-xgj6-7frp

high2026-04-14

CVE-2026-40944-Oxia's TLS CA certificate chain validation fails with multi-certificate PEM bundles

oxia-db/oxia · GHSA-7jrq-q4pq-rhm6