漏洞公告

ImageMagick has a Heap Buffer Over-Write in MAT decoder on 32-bit systems

ImageMagick Vulnerable to Stack Overflow in its MVG Decoder

ImageMagick has an Infinite Loop in subimage-search with crafted image

ImageMagick has a Heap Buffer Underwrite in the Floyd-Steinberg depth dithering method

nextflow auth login command has incorrect default permissions

Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic

GitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion

MessagePack-CSharp: Typeless deserialization type restrictions do not recurse into arrays or generic arguments

MessagePack-CSharp: InterfaceLookupFormatter bypasses collision-resistant comparer settings

MessagePack-CSharp: Multi-dimensional array formatters allocate from unchecked dimensions

MessagePack-CSharp: Unity unsafe blit formatter allocates from unbounded byte length

MessagePack-CSharp: DynamicUnionResolver-generated deserializers miss depth enforcement

MessagePack-CSharp: JSON conversion APIs can recurse without consistent depth enforcement

MessagePack-CSharp: ExpandoObject formatter can perform quadratic insertion work on untrusted maps

MessagePack-CSharp: LZ4 decompression allocates from unbounded declared output lengths

MessagePack-CSharp: ASP.NET Core MessagePackInputFormatter defaults to TrustedData for HTTP request bodies

Lemur has an authorization bypass in StrictRolePermission / AuthorityCreatorPermission

MessagePack-CSharp: MessagePackReader.Skip can recurse without enforcing maximum object graph depth

Filament: Multi-factor authentication (app) recovery codes can still be used multiple times via concurrent submission

opentelemetry_sdk has unbounded memory allocation in W3C Baggage propagation

MessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflows

amazon-braket-sdk vulnerable to Insecure Deserialization via pickle.loads()

LangGraph SDK has unsafe URL path construction