VulDB Recent Entries

A vulnerability was found in ImageMagick up to 6.9.13-57/7.1.2-32 and classified as problematic. This vulnerability affects unknown code of the file policy.xml of the component Delegate Invocation. Executing a manipulation can lead to improper privilege management. This vulnerability is registered as CVE-2026-116140. The attack needs to be launched locally. No exploit is available. It is suggested to upgrade the affected component.

A vulnerability has been found in ImageMagick and classified as problematic. This affects an unknown part of the component Bzip2 Image Handler. Performing a manipulation results in stack-based buffer overflow. This vulnerability is cataloged as CVE-2026-116149. It is possible to initiate the attack remotely. There is no exploit available. The affected component should be upgraded.

A vulnerability, which was classified as problematic, was found in ImageMagick up to 6.9.13-57/7.1.2-32. Affected by this issue is some unknown functionality of the component MVG encoder. Such manipulation leads to injection. This vulnerability is listed as CVE-2026-116148. The attack may be performed from remote. There is no available exploit. You should upgrade the affected component.

A vulnerability, which was classified as problematic, has been found in ImageMagick. Affected by this vulnerability is an unknown functionality of the component DJVU decoder. This manipulation causes null pointer dereference. This vulnerability is tracked as CVE-2026-116147. The attack is possible to be carried out remotely. No exploit exists. It is advisable to upgrade the affected component.

A vulnerability classified as problematic was found in ImageMagick up to 7.1.2-32. Affected is an unknown function of the component Minimum-bounding-box. The manipulation results in heap-based buffer overflow. This vulnerability is identified as CVE-2026-116142. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is advised.

A vulnerability classified as problematic has been found in ImageMagick up to 6.9.13-57/7.1.2-32. This impacts an unknown function of the component MVG Decoder. The manipulation leads to stack-based buffer overflow. This vulnerability is referenced as CVE-2026-116144. The attack can only be performed from a local environment. No exploit is available. It is recommended to upgrade the affected component.

A vulnerability described as problematic has been identified in ImageMagick. This affects an unknown function of the component Compare. Executing a manipulation can lead to memory leak. The identification of this vulnerability is CVE-2026-116158. The attack can only be executed locally. There is no exploit available. Upgrading the affected component is recommended.

A vulnerability marked as problematic has been reported in ImageMagick up to 6.9.13-57/7.1.2-32. The impacted element is an unknown function of the component XMP Profiles. Performing a manipulation results in memory leak. This vulnerability was named CVE-2026-116155. The attack may be initiated remotely. There is no available exploit. It is suggested to upgrade the affected component.

A vulnerability labeled as problematic has been found in ImageMagick up to 6.9.13-57/7.1.2-32. The affected element is an unknown function. Such manipulation leads to memory leak. This vulnerability is uniquely identified as CVE-2026-116156. The attack can be launched remotely. No exploit exists. The affected component should be upgraded.

A vulnerability has been found in GNOME libgsf up to 1.14.60 and classified as critical. The impacted element is the function ole_info_read_metabat of the file gsf/gsf-infile-msole.c of the component OLE2 Parser. The manipulation leads to heap-based buffer overflow. This vulnerability is documented as CVE-2026-116124. The attack can be initiated remotely. There is not any exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability, which was classified as problematic, was found in NocoDB up to 2026.07.0. The affected element is the function validatePassword of the file /auth/user/signup. Executing a manipulation can lead to improper restriction of excessive authentication attempts. This vulnerability is registered as CVE-2026-116123. It is possible to launch the attack remotely. No exploit is available. The vendor documents this as intentional. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.

A vulnerability, which was classified as problematic, has been found in NocoDB up to 2026.07.0. Impacted is the function AuthService.validateUser of the component Sign-in Endpoint. Performing a manipulation of the argument salt results in information disclosure. This vulnerability is cataloged as CVE-2026-116122. It is possible to initiate the attack remotely. There is no exploit available. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.

A vulnerability classified as problematic was found in NocoDB up to 2026.08.0. This issue affects some unknown processing of the file users.service.ts of the component Registration. Such manipulation leads to race condition. This vulnerability is listed as CVE-2026-116121. The attack may be performed from remote. There is no available exploit. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.

A vulnerability classified as problematic has been found in NocoDB up to 2026.07.0. This vulnerability affects the function UserRefreshToken.deleteAllUserToken of the file /auth/user/signup of the component PublicApiLimiterGuard. This manipulation causes allocation of resources. This vulnerability is tracked as CVE-2026-116120. The attack is possible to be carried out remotely. No exploit exists. Code-verified absence of in-app rate limiting on the unauthenticated signup and password-forgot endpoints and per-request refresh/OAuth token invalidation, but the vendor documents the pass-through limiter as intentional design. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.

A vulnerability described as critical has been identified in NocoDB up to 2026.08.0. This affects an unknown part of the file packages/nocodb/src/services/users/users.service.ts of the component Password-Reset Flow. The manipulation results in race condition. This vulnerability is identified as CVE-2026-116119. The attack can be executed remotely. There is not any exploit available. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.

A vulnerability marked as critical has been reported in Z.ai Zcode up to 3.14.3/3.15.1. Affected by this issue is some unknown functionality of the component Sed Command Filter. The manipulation leads to os command injection. This vulnerability is referenced as CVE-2026-116118. Remote exploitation of the attack is possible. Furthermore, an exploit is available.

A vulnerability labeled as critical has been found in halo-dev halo up to 2.27.0-beta.1. Affected by this vulnerability is the function run.halo.app.theme.DefaultViewNameResolver.resolveViewNameOrDefault of the file application/src/main/java/run/halo/app/theme/DefaultViewNameResolver.java of the component View Name Resolver. Executing a manipulation of the argument template can lead to path traversal. The identification of this vulnerability is CVE-2026-116117. The attack may be launched remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability identified as critical has been detected in Yoosee GM8135S Camera 21.00.01.36. Affected is an unknown function of the component Secure Boot. Performing a manipulation results in improper verification of cryptographic signature. This vulnerability was named CVE-2026-116116. The attack needs to be approached locally. In addition, an exploit is available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability categorized as problematic has been discovered in Yoosee GM8135S Camera 21.00.01.36. This impacts an unknown function of the file wpa_supplicantX.conf of the component WiFi Configuration. Such manipulation leads to improper initialization. This vulnerability is uniquely identified as CVE-2026-116115. The attack can only be initiated within the local network. Moreover, an exploit is present. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in Yoosee GM8135S Camera 21.00.01.36. It has been rated as problematic. This affects an unknown function of the file /npc/npc of the component Live UDP H.264 Video Stream Handler. This manipulation causes cleartext transmission of sensitive information. This vulnerability is handled as CVE-2026-116114. The attack can be initiated remotely. Additionally, an exploit exists. The vendor was contacted early about this disclosure but did not respond in any way.