|
491
|
6.2 |
MEDIUM
Local
|
-
|
-
|
ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below 7.1.2-19, an off by one error in the MSL decoder could result in a crash when a malico…
Update
|
CWE-193
Off-by-one Error
|
CVE-2026-40312
|
2026-04-18 00:26 |
2026-04-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
492
|
6.1 |
MEDIUM
Local
|
-
|
-
|
jq is a command-line JSON processor. In commits after 69785bf77f86e2ea1b4a20ca86775916889e91c9, the _strindices builtin in jq's src/builtin.c passes its arguments directly to jv_string_indexes() with…
Update
|
CWE-125
CWE-476
CWE-843
Out-of-bounds Read
NULL Pointer Dereference
Type Confusion
|
CVE-2026-39956
|
2026-04-18 00:26 |
2026-04-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
493
|
- |
|
-
|
-
|
jq is a command-line JSON processor. In commits before 2f09060afab23fe9390cce7cb860b10416e1bf5f, the jv_parse_sized() API in libjq accepts a counted buffer with an explicit length parameter, but its …
Update
|
CWE-125
Out-of-bounds Read
|
CVE-2026-39979
|
2026-04-18 00:26 |
2026-04-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
494
|
- |
|
-
|
-
|
jq is a command-line JSON processor. Commits before 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b contain a vulnerability where CLI input parsing allows validation bypass via embedded NUL bytes. When read…
Update
|
CWE-20
CWE-170
Improper Input Validation
Improper Null Termination
|
CVE-2026-33948
|
2026-04-18 00:26 |
2026-04-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
495
|
5.3 |
MEDIUM
Network
|
-
|
-
|
nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. In versions 1.2.2 and below, an unauthenticated p2p peer can cause th…
Update
|
CWE-617
Reachable Assertion
|
CVE-2026-34069
|
2026-04-18 00:26 |
2026-04-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
496
|
4.6 |
MEDIUM
Network
|
-
|
-
|
MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain an incomplete fix for CVE-2025-53928, where a Remote Code Execution vulnerability still exists in the MCP node of…
Update
|
CWE-20
CWE-78
Improper Input Validation
OS Command
|
CVE-2026-39417
|
2026-04-18 00:26 |
2026-04-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
497
|
7.5 |
HIGH
Network
|
-
|
-
|
jq is a command-line JSON processor. Before commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784, jq used MurmurHash3 with a hardcoded, publicly visible seed (0x432A9843) for all JSON object hash table op…
Update
|
CWE-328
CWE-407
Use of Weak Hash
Inefficient Algorithmic Complexity
|
CVE-2026-40164
|
2026-04-18 00:26 |
2026-04-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
498
|
5.0 |
MEDIUM
Network
|
-
|
-
|
MaxKB is an open-source AI assistant for enterprise. In versions 2.7.1 and below, sandbox network protection can be bypassed by using socket.sendto() with the MSG_FASTOPEN flag. This allows authentic…
Update
|
CWE-918
Server-Side Request Forgery (SSRF)
|
CVE-2026-39418
|
2026-04-18 00:26 |
2026-04-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
499
|
6.3 |
MEDIUM
Network
|
-
|
-
|
MaxKB is an open-source AI assistant for enterprise. In versions 2.7.1 and below, an incomplete sandbox protection mechanism allows an authenticated user with tool execution privileges to escape the …
Update
|
CWE-78
CWE-693
OS Command
Protection Mechanism Failure
|
CVE-2026-39420
|
2026-04-18 00:26 |
2026-04-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
500
|
6.3 |
MEDIUM
Network
|
-
|
-
|
MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain a sandbox escape vulnerability in the ToolExecutor component. By leveraging Python's ctypes library to execute ra…
Update
|
CWE-94
CWE-693
Code Injection
Protection Mechanism Failure
|
CVE-2026-39421
|
2026-04-18 00:26 |
2026-04-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
