Julia Ecosystem Security Advisories

JLSEC-2026-1371: JLSEC-2026-1371

Thu, 20 Aug 2026 00:00:00 +0000

Security advisory JLSEC-2026-1371: JLSEC-2026-1371

JLSEC-2026-1387: A cross-site scripting vulnerability in queryparser/termgenerator_internal.cc in Xapian xapian...

Thu, 20 Aug 2026 00:00:00 +0000

Security advisory JLSEC-2026-1387: A cross-site scripting vulnerability in queryparser/termgenerator_internal.cc in Xapian xapian...

JLSEC-2026-1378: JLSEC-2026-1378

Thu, 20 Aug 2026 00:00:00 +0000

Security advisory JLSEC-2026-1378: JLSEC-2026-1378

JLSEC-2026-1380: JLSEC-2026-1380

Thu, 20 Aug 2026 00:00:00 +0000

Security advisory JLSEC-2026-1380: JLSEC-2026-1380

JLSEC-2026-1373: JLSEC-2026-1373

Thu, 20 Aug 2026 00:00:00 +0000

Security advisory JLSEC-2026-1373: JLSEC-2026-1373

JLSEC-2026-1383: JLSEC-2026-1383

Thu, 20 Aug 2026 00:00:00 +0000

Security advisory JLSEC-2026-1383: JLSEC-2026-1383

JLSEC-2026-1377: JLSEC-2026-1377

Thu, 20 Aug 2026 00:00:00 +0000

Security advisory JLSEC-2026-1377: JLSEC-2026-1377

JLSEC-2026-1376: JLSEC-2026-1376

Thu, 20 Aug 2026 00:00:00 +0000

Security advisory JLSEC-2026-1376: JLSEC-2026-1376

JLSEC-2026-1379: JLSEC-2026-1379

Thu, 20 Aug 2026 00:00:00 +0000

Security advisory JLSEC-2026-1379: JLSEC-2026-1379

JLSEC-2026-1382: JLSEC-2026-1382

Thu, 20 Aug 2026 00:00:00 +0000

Security advisory JLSEC-2026-1382: JLSEC-2026-1382

JLSEC-2026-1381: JLSEC-2026-1381

Thu, 20 Aug 2026 00:00:00 +0000

Security advisory JLSEC-2026-1381: JLSEC-2026-1381

JLSEC-2026-1370: JLSEC-2026-1370

Thu, 20 Aug 2026 00:00:00 +0000

Security advisory JLSEC-2026-1370: JLSEC-2026-1370

JLSEC-2026-1369: JLSEC-2026-1369

Thu, 20 Aug 2026 00:00:00 +0000

Security advisory JLSEC-2026-1369: JLSEC-2026-1369

JLSEC-2026-1372: JLSEC-2026-1372

Thu, 20 Aug 2026 00:00:00 +0000

Security advisory JLSEC-2026-1372: JLSEC-2026-1372

JLSEC-2026-1327: In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to...

Tue, 11 Aug 2026 00:00:00 +0000

Security advisory JLSEC-2026-1327: In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to...

JLSEC-2026-1329: In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be...

Tue, 11 Aug 2026 00:00:00 +0000

Security advisory JLSEC-2026-1329: In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be...

JLSEC-2026-1275: libgit2 versions v0.27.0 through v1.9.0 built with the libssh2 SSH backend (USE_SSH=libssh2)...

Tue, 11 Aug 2026 00:00:00 +0000

Security advisory JLSEC-2026-1275: libgit2 versions v0.27.0 through v1.9.0 built with the libssh2 SSH backend (USE_SSH=libssh2)...

JLSEC-2026-1328: In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of...

Tue, 11 Aug 2026 00:00:00 +0000

Security advisory JLSEC-2026-1328: In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of...

JLSEC-2026-1188: FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow...

Thu, 06 Aug 2026 00:00:00 +0000

Security advisory JLSEC-2026-1188: FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow...

JLSEC-2026-1192: FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write...

Thu, 06 Aug 2026 00:00:00 +0000

Security advisory JLSEC-2026-1192: FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write...

JLSEC-2026-1189: FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read...

Thu, 06 Aug 2026 00:00:00 +0000

Security advisory JLSEC-2026-1189: FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read...

JLSEC-2026-1191: FFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory...

Thu, 06 Aug 2026 00:00:00 +0000

Security advisory JLSEC-2026-1191: FFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory...

JLSEC-2026-1190: FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read...

Thu, 06 Aug 2026 00:00:00 +0000

Security advisory JLSEC-2026-1190: FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read...

JLSEC-2026-1344: TOCTOU in GNU tar allows unauthorized file modification by a local attacker

Mon, 03 Aug 2026 00:00:00 +0000

Security advisory JLSEC-2026-1344: TOCTOU in GNU tar allows unauthorized file modification by a local attacker

JLSEC-2026-1081: ImageMagick: Integer Overflow in JNX decoder causes heap buffer over-write when processing extremly large files on 32-bit builds

Thu, 30 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1081: ImageMagick: Integer Overflow in JNX decoder causes heap buffer over-write when processing extremly large files on 32-bit builds

JLSEC-2026-1082: JLSEC-2026-1082

Thu, 30 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1082: JLSEC-2026-1082

JLSEC-2026-1079: ImageMagick: Heap Buffer Over-Write in morphology operation when an invalid kernel is provided

Thu, 30 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1079: ImageMagick: Heap Buffer Over-Write in morphology operation when an invalid kernel is provided

JLSEC-2026-1080: ImageMagick: Heap Buffer Over-Write in fx operation

Thu, 30 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1080: ImageMagick: Heap Buffer Over-Write in fx operation

JLSEC-2026-1345: GNU Bison allows for an execution of an arbitrary program during HTML report generation due to...

Wed, 29 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1345: GNU Bison allows for an execution of an arbitrary program during HTML report generation due to...

JLSEC-2026-1346: GNU Bison improperly handles grammar‑defined output paths. Grammar directives such as %output and...

Wed, 29 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1346: GNU Bison improperly handles grammar‑defined output paths. Grammar directives such as %output and...

JLSEC-2026-799: Unauthenticated TLS records can exhaust memory or CPU during a handshake

Tue, 28 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-799: Unauthenticated TLS records can exhaust memory or CPU during a handshake

JLSEC-2026-801: Native TLS accepts undersized or malformed RSA certificate public keys

Tue, 28 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-801: Native TLS accepts undersized or malformed RSA certificate public keys

JLSEC-2026-800: Slow DNS lookups can stall garbage collection process-wide

Tue, 28 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-800: Slow DNS lookups can stall garbage collection process-wide

JLSEC-2026-803: Windows IOCP poller races unsynchronized registration tables

Tue, 28 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-803: Windows IOCP poller races unsynchronized registration tables

JLSEC-2026-797: Windows IOCP lifetime bugs can corrupt memory during cancellation or shutdown

Tue, 28 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-797: Windows IOCP lifetime bugs can corrupt memory during cancellation or shutdown

JLSEC-2026-798: TLS 1.3 KeyUpdate handling can race concurrent writes

Tue, 28 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-798: TLS 1.3 KeyUpdate handling can race concurrent writes

JLSEC-2026-802: TLS 1.2 session resumption can renew one master secret indefinitely

Tue, 28 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-802: TLS 1.2 session resumption can renew one master secret indefinitely

JLSEC-2026-1386: JLSEC-2026-1386

Mon, 27 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1386: JLSEC-2026-1386

JLSEC-2026-1384: JLSEC-2026-1384

Mon, 27 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1384: JLSEC-2026-1384

JLSEC-2026-1385: JLSEC-2026-1385

Mon, 27 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1385: JLSEC-2026-1385

JLSEC-2026-1083: ImageMagick before 7.1.2-27 contains a memory leak vulnerability in the magick command-line...

Sat, 25 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1083: ImageMagick before 7.1.2-27 contains a memory leak vulnerability in the magick command-line...

JLSEC-2026-1086: libssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-authentication integer underflow...

Fri, 24 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1086: libssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-authentication integer underflow...

JLSEC-2026-1186: FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability...

Fri, 24 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1186: FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability...

JLSEC-2026-1195: GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte...

Fri, 24 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1195: GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte...

JLSEC-2026-1187: FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write...

Fri, 24 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1187: FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write...

JLSEC-2026-1088: libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer...

Fri, 24 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1088: libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer...

JLSEC-2026-1087: libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability...

Fri, 24 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1087: libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability...

JLSEC-2026-1196: GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow...

Fri, 24 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1196: GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow...

JLSEC-2026-1085: libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the...

Fri, 24 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1085: libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the...

JLSEC-2026-1183: FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption...

Fri, 24 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1183: FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption...

JLSEC-2026-1184: FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability...

Fri, 24 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1184: FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability...

JLSEC-2026-1185: FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability...

Fri, 24 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1185: FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability...

JLSEC-2026-1182: FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability...

Fri, 24 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1182: FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability...

JLSEC-2026-1180: FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the...

Thu, 23 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1180: FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the...

JLSEC-2026-791: Writing to SFTP files resulting in sending out-of-bounds data to the server

Thu, 23 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-791: Writing to SFTP files resulting in sending out-of-bounds data to the server

JLSEC-2026-1178: FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video...

Thu, 23 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1178: FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video...

JLSEC-2026-1181: FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect...

Thu, 23 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1181: FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect...

JLSEC-2026-1179: FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause...

Thu, 23 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1179: FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause...

JLSEC-2026-1172: FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub...

Wed, 22 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1172: FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub...

JLSEC-2026-1173: FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability in the Vulkan...

Wed, 22 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1173: FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability in the Vulkan...

JLSEC-2026-1175: FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF...

Wed, 22 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1175: FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF...

JLSEC-2026-1176: FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer...

Wed, 22 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1176: FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer...

JLSEC-2026-1193: JLSEC-2026-1193

Wed, 22 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1193: JLSEC-2026-1193

JLSEC-2026-1174: FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC...

Wed, 22 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1174: FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC...

JLSEC-2026-1177: FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX...

Wed, 22 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1177: FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX...

JLSEC-2026-1096: JLSEC-2026-1096

Tue, 21 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1096: JLSEC-2026-1096

JLSEC-2026-1095: JLSEC-2026-1095

Tue, 21 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1095: JLSEC-2026-1095

JLSEC-2026-1098: JLSEC-2026-1098

Tue, 21 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1098: JLSEC-2026-1098

JLSEC-2026-1097: JLSEC-2026-1097

Tue, 21 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1097: JLSEC-2026-1097

JLSEC-2026-1099: JLSEC-2026-1099

Tue, 21 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1099: JLSEC-2026-1099

JLSEC-2026-1100: JLSEC-2026-1100

Tue, 21 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1100: JLSEC-2026-1100

JLSEC-2026-1163: JLSEC-2026-1163

Mon, 20 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1163: JLSEC-2026-1163

JLSEC-2026-1162: JLSEC-2026-1162

Mon, 20 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1162: JLSEC-2026-1162

JLSEC-2026-1069: ImageMagick before 7.1.2-26 (and 6.x before 6.9.13-51) contains a memory leak in the TIFF encoder...

Wed, 15 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1069: ImageMagick before 7.1.2-26 (and 6.x before 6.9.13-51) contains a memory leak in the TIFF encoder...

JLSEC-2026-1078: ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the TIFF encoder when an...

Wed, 15 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1078: ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the TIFF encoder when an...

JLSEC-2026-1061: ImageMagick before 7.1.2-26 and 6.9.13-51 contains a heap-based buffer over-write vulnerability...

Wed, 15 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1061: ImageMagick before 7.1.2-26 and 6.9.13-51 contains a heap-based buffer over-write vulnerability...

JLSEC-2026-1074: ImageMagick before 7.1.2-26 and 6.9.x before 6.9.13-51 contains a memory leak in the YUV decoder...

Wed, 15 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1074: ImageMagick before 7.1.2-26 and 6.9.x before 6.9.13-51 contains a memory leak in the YUV decoder...

JLSEC-2026-1075: ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the MIFF encoder that occurs...

Wed, 15 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1075: ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the MIFF encoder that occurs...

JLSEC-2026-1066: ImageMagick before 7.1.2-26 and 6.9.13-51 contains a use-after-free vulnerability that occurs...

Wed, 15 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1066: ImageMagick before 7.1.2-26 and 6.9.13-51 contains a use-after-free vulnerability that occurs...

JLSEC-2026-1065: ImageMagick before 7.1.2-26 and 6.9.13-x before 6.9.13-51 contains a policy bypass vulnerability...

Wed, 15 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1065: ImageMagick before 7.1.2-26 and 6.9.13-x before 6.9.13-51 contains a policy bypass vulnerability...

JLSEC-2026-1073: ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the TIFF encoder when memory...

Wed, 15 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1073: ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the TIFF encoder when memory...

JLSEC-2026-1072: ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the JNG encoder when a blob...

Wed, 15 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1072: ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the JNG encoder when a blob...

JLSEC-2026-1056: ImageMagick through 7.1.2-18 contains a memory leak vulnerability in the ASHLAR coder when an...

Wed, 15 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1056: ImageMagick through 7.1.2-18 contains a memory leak vulnerability in the ASHLAR coder when an...

JLSEC-2026-1068: ImageMagick before 7.1.2-26 and 6.9.13-51 contains an information disclosure vulnerability: when...

Wed, 15 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1068: ImageMagick before 7.1.2-26 and 6.9.13-51 contains an information disclosure vulnerability: when...

JLSEC-2026-1071: ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the hough lines operation:...

Wed, 15 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1071: ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the hough lines operation:...

JLSEC-2026-1070: ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in color transformation to the...

Wed, 15 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1070: ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in color transformation to the...

JLSEC-2026-1077: ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the ICON decoder that occurs...

Wed, 15 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1077: ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the ICON decoder that occurs...

JLSEC-2026-785: Use after free vulnerability in gawk 5.4.0 and earlier

Mon, 13 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-785: Use after free vulnerability in gawk 5.4.0 and earlier

JLSEC-2026-787: Integer overflow in gawk's `do_sub()` can cause buffer overflow and denial of service

Mon, 13 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-787: Integer overflow in gawk's do_sub() can cause buffer overflow and denial of service

JLSEC-2026-788: Buffer overflow in gawk's `readdir.c` can cause denial of service and possible code execution

Mon, 13 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-788: Buffer overflow in gawk's readdir.c can cause denial of service and possible code execution

JLSEC-2026-786: Integer overflow in gawk's `builtin.c` can cause buffer overflow and denial of service

Mon, 13 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-786: Integer overflow in gawk's builtin.c can cause buffer overflow and denial of service

JLSEC-2026-1062: ImageMagick before 7.1.2-26 and 6.9.13-51 is missing a check for the allowed memory allocation...

Sat, 11 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1062: ImageMagick before 7.1.2-26 and 6.9.13-51 is missing a check for the allowed memory allocation...

JLSEC-2026-1063: ImageMagick before 7.1.2-26 contains a heap use-after-free vulnerability caused by missing null...

Sat, 11 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1063: ImageMagick before 7.1.2-26 contains a heap use-after-free vulnerability caused by missing null...

JLSEC-2026-1067: ImageMagick before 7.1.2-26 contains a use-after-free vulnerability in the FormatMagickCaption...

Sat, 11 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1067: ImageMagick before 7.1.2-26 contains a use-after-free vulnerability in the FormatMagickCaption...

JLSEC-2026-1076: ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the VIFF encoder when memory...

Sat, 11 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1076: ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the VIFF encoder when memory...

JLSEC-2026-1064: ImageMagick before 7.1.2-26 contains a policy bypass vulnerability in the APNG encoder and...

Sat, 11 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1064: ImageMagick before 7.1.2-26 contains a policy bypass vulnerability in the APNG encoder and...

JLSEC-2026-1053: ImageMagick before 7.1.2-19 contains a heap buffer overflow vulnerability in the magnify...

Sat, 11 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1053: ImageMagick before 7.1.2-19 contains a heap buffer overflow vulnerability in the magnify...

JLSEC-2026-1054: ImageMagick before 7.1.2-15 contains a use-after-free vulnerability in the PDB decoder that uses...

Fri, 10 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1054: ImageMagick before 7.1.2-15 contains a use-after-free vulnerability in the PDB decoder that uses...

JLSEC-2026-1047: ImageMagick before 7.1.2-18 contains a memory leak vulnerability in the META reader when...

Fri, 10 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1047: ImageMagick before 7.1.2-18 contains a memory leak vulnerability in the META reader when...

JLSEC-2026-1257: Cesanta Mongoose before 7.22 contains an out-of-bounds read in the built-in TLS server function...

Thu, 09 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1257: Cesanta Mongoose before 7.22 contains an out-of-bounds read in the built-in TLS server function...

JLSEC-2026-1261: GNU patch is vulnerable to a denial of service (DoS) due to improper validation of hunk (single...

Thu, 09 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1261: GNU patch is vulnerable to a denial of service (DoS) due to improper validation of hunk (single...

JLSEC-2026-1260: GNU patch is vulnerable to a NULL pointer dereference when processing a specially crafted unified...

Thu, 09 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1260: GNU patch is vulnerable to a NULL pointer dereference when processing a specially crafted unified...

JLSEC-2026-1325: sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay.

Wed, 08 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1325: sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay.

JLSEC-2026-1148: JLSEC-2026-1148

Wed, 08 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1148: JLSEC-2026-1148

JLSEC-2026-1055: ImageMagick before 7.1.2-19 contains a heap buffer overflow vulnerability in the FTXT encoder due...

Wed, 08 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1055: ImageMagick before 7.1.2-19 contains a heap buffer overflow vulnerability in the FTXT encoder due...

JLSEC-2026-1153: JLSEC-2026-1153

Wed, 08 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1153: JLSEC-2026-1153

JLSEC-2026-1154: JLSEC-2026-1154

Wed, 08 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1154: JLSEC-2026-1154

JLSEC-2026-1152: JLSEC-2026-1152

Wed, 08 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1152: JLSEC-2026-1152

JLSEC-2026-1151: JLSEC-2026-1151

Wed, 08 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1151: JLSEC-2026-1151

JLSEC-2026-1320: scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when...

Wed, 08 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1320: scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when...

JLSEC-2026-1321: internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments,...

Wed, 08 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1321: internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments,...

JLSEC-2026-1326: ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a...

Wed, 08 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1326: ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a...

JLSEC-2026-1147: JLSEC-2026-1147

Wed, 08 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1147: JLSEC-2026-1147

JLSEC-2026-1150: JLSEC-2026-1150

Wed, 08 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1150: JLSEC-2026-1150

JLSEC-2026-1149: JLSEC-2026-1149

Wed, 08 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1149: JLSEC-2026-1149

JLSEC-2026-1323: In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over...

Wed, 08 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1323: In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over...

JLSEC-2026-1368: JLSEC-2026-1368

Wed, 08 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1368: JLSEC-2026-1368

JLSEC-2026-1146: JLSEC-2026-1146

Wed, 08 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1146: JLSEC-2026-1146

JLSEC-2026-1043: ImageMagick before 7.1.2-15 contains a heap-buffer-overflow read vulnerability in GetPixelIndex...

Wed, 08 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1043: ImageMagick before 7.1.2-15 contains a heap-buffer-overflow read vulnerability in GetPixelIndex...

JLSEC-2026-1319: sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when ...

Wed, 08 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1319: sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when ...

JLSEC-2026-1324: sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource...

Wed, 08 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1324: sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource...

JLSEC-2026-1322: sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior:...

Wed, 08 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1322: sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior:...

JLSEC-2026-1161: GNU Wget through 1.25.0, fixed in commit dd692d9, contains a heap buffer overflow vulnerability...

Tue, 07 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1161: GNU Wget through 1.25.0, fixed in commit dd692d9, contains a heap buffer overflow vulnerability...

JLSEC-2026-1160: GNU Wget through 1.25.0, fixed in commit c2640fe, contains a heap buffer overflow vulnerability...

Tue, 07 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1160: GNU Wget through 1.25.0, fixed in commit c2640fe, contains a heap buffer overflow vulnerability...

JLSEC-2026-1158: GNU Wget through 1.25.0, fixed in commit 37a40fc, contains a heap buffer underread vulnerability...

Tue, 07 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1158: GNU Wget through 1.25.0, fixed in commit 37a40fc, contains a heap buffer underread vulnerability...

JLSEC-2026-1159: GNU Wget through 1.25.0, fixed in commit 43d3ba9, contains an integer overflow vulnerability in...

Tue, 07 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1159: GNU Wget through 1.25.0, fixed in commit 43d3ba9, contains an integer overflow vulnerability in...

JLSEC-2026-796: XSS via unescaped code-fence language in default code block renderer

Mon, 06 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-796: XSS via unescaped code-fence language in default code block renderer

JLSEC-2026-794: Hugo: XSS via text/html content files

Mon, 06 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-794: Hugo: XSS via text/html content files

JLSEC-2026-795: Hugo: security.http.urls allow-list bypass via HTTP redirects

Mon, 06 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-795: Hugo: security.http.urls allow-list bypass via HTTP redirects

JLSEC-2026-1220: In this scenario, libcurl first uses a proper HTTP/3 server for the initial transfers, and when...

Fri, 03 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1220: In this scenario, libcurl first uses a proper HTTP/3 server for the initial transfers, and when...

JLSEC-2026-1200: By default, curl automatically responds to WebSocket PING frames. Because curl lacks an upper...

Fri, 03 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1200: By default, curl automatically responds to WebSocket PING frames. Because curl lacks an upper...

JLSEC-2026-1199: libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse...

Fri, 03 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1199: libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse...

JLSEC-2026-1197: A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream...

Fri, 03 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1197: A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream...

JLSEC-2026-1221: A vulnerability in libcurl caused the HTTP `Referer:` header to persist even when explicitly...

Fri, 03 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1221: A vulnerability in libcurl caused the HTTP Referer: header to persist even when explicitly...

JLSEC-2026-1218: libcurl had a flaw that when instructed to clear proxy authentication credentials which made it...

Fri, 03 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1218: libcurl had a flaw that when instructed to clear proxy authentication credentials which made it...

JLSEC-2026-1201: Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with Digest...

Fri, 03 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1201: Successfully using libcurl to do a transfer to a specific HTTP origin (hostA) with Digest...

JLSEC-2026-1216: When reusing a libcurl handle for sequential transfers driven by environment-variable proxy...

Fri, 03 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1216: When reusing a libcurl handle for sequential transfers driven by environment-variable proxy...

JLSEC-2026-1214: The curl logic that works with SASL authentication could end up cleaning up the GSASL context ...

Fri, 03 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1214: The curl logic that works with SASL authentication could end up cleaning up the GSASL context ...

JLSEC-2026-1222: When a libcurl-based application performs transfers via `SCP://` or `SFTP://` and utilizes the ...

Fri, 03 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1222: When a libcurl-based application performs transfers via SCP:// or SFTP:// and utilizes the ...

JLSEC-2026-1212: libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate...

Fri, 03 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1212: libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate...

JLSEC-2026-1211: A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might...

Fri, 03 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1211: A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might...

JLSEC-2026-1219: Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNCTION` callback triggers a...

Fri, 03 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1219: Calling curl_easy_pause() within the event-based CURLMOPT_SOCKETFUNCTION callback triggers a...

JLSEC-2026-1202: When a user invokes curl using a schemeless URL combined with `--proto-default` sftp (or scp), a...

Fri, 03 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1202: When a user invokes curl using a schemeless URL combined with --proto-default sftp (or scp), a...

JLSEC-2026-1215: When asking curl to use a `.netrc` file to find credentials and at the same time specifying a URL...

Fri, 03 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1215: When asking curl to use a .netrc file to find credentials and at the same time specifying a URL...

JLSEC-2026-1198: An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server to trigger a remote...

Fri, 03 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1198: An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server to trigger a remote...

JLSEC-2026-1217: libcurl would reuse a previously created connection even when some mTLS config related option had...

Fri, 03 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1217: libcurl would reuse a previously created connection even when some mTLS config related option had...

JLSEC-2026-1213: A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set 'super cookies' that...

Fri, 03 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1213: A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set 'super cookies' that...

JLSEC-2026-1039: ImageMagick: Infinite Loop in connected-components when providing invalid arguments

Wed, 01 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1039: ImageMagick: Infinite Loop in connected-components when providing invalid arguments

JLSEC-2026-1041: ImageMagick: Policy Bypass in concatenate operation due to missing checks

Wed, 01 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1041: ImageMagick: Policy Bypass in concatenate operation due to missing checks

JLSEC-2026-1034: JLSEC-2026-1034

Wed, 01 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1034: JLSEC-2026-1034

JLSEC-2026-1367: JLSEC-2026-1367

Wed, 01 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1367: JLSEC-2026-1367

JLSEC-2026-1035: ImageMagick: Information Disclosure in MNG decoder because allocated memory is left unchanged

Wed, 01 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1035: ImageMagick: Information Disclosure in MNG decoder because allocated memory is left unchanged

JLSEC-2026-1037: JLSEC-2026-1037

Wed, 01 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1037: JLSEC-2026-1037

JLSEC-2026-1036: ImageMagick: Use-After-Free in crafted 8BIM when identifying an image

Wed, 01 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1036: ImageMagick: Use-After-Free in crafted 8BIM when identifying an image

JLSEC-2026-1040: ImageMagick: Heap Buffer Over-Write in JP2 encoder when due to incorrect handling of arguments

Wed, 01 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1040: ImageMagick: Heap Buffer Over-Write in JP2 encoder when due to incorrect handling of arguments

JLSEC-2026-1038: ImageMagick: Stack Overflow in MVG decoder due to missing depth check.

Wed, 01 Jul 2026 00:00:00 +0000

Security advisory JLSEC-2026-1038: ImageMagick: Stack Overflow in MVG decoder due to missing depth check.

JLSEC-2026-1246: A flaw was found in GLib. A buffer over-read can occur in giochannelreadline_backend() in the...

Tue, 30 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1246: A flaw was found in GLib. A buffer over-read can occur in giochannelreadline_backend() in the...

JLSEC-2026-1042: ImageMagick before 7.1.2-19 contains an off-by-one error in morphology validation allowing out-of...

Tue, 30 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1042: ImageMagick before 7.1.2-19 contains an off-by-one error in morphology validation allowing out-of...

JLSEC-2026-1044: ImageMagick before 7.1.2-22 contains a division by zero vulnerability in binomial kernel...

Tue, 30 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1044: ImageMagick before 7.1.2-22 contains a division by zero vulnerability in binomial kernel...

JLSEC-2026-1243: A flaw was found in GLib. An off-by-one error can occur in the gvstupleis_normal function in...

Tue, 30 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1243: A flaw was found in GLib. An off-by-one error can occur in the gvstupleis_normal function in...

JLSEC-2026-1248: A flaw was found in GLib. The D-Bus client-side implementation of the DBUSCOOKIESHA1 SASL...

Tue, 30 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1248: A flaw was found in GLib. The D-Bus client-side implementation of the DBUSCOOKIESHA1 SASL...

JLSEC-2026-1244: A flaw was found in GLib. An out-of-bounds read of only 2 bytes can occur in the...

Tue, 30 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1244: A flaw was found in GLib. An out-of-bounds read of only 2 bytes can occur in the...

JLSEC-2026-1058: ImageMagick before 7.1.2-24 contains an incorrect policy check that allows attackers to create or...

Tue, 30 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1058: ImageMagick before 7.1.2-24 contains an incorrect policy check that allows attackers to create or...

JLSEC-2026-1247: A flaw was found in GLib. An off-by-one error can occur in the gkeyfilegetlocalestringlist...

Tue, 30 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1247: A flaw was found in GLib. An off-by-one error can occur in the gkeyfilegetlocalestringlist...

JLSEC-2026-1046: ImageMagick before 7.1.2-19 contains a memory leak vulnerability in the PNG encoder when writing...

Tue, 30 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1046: ImageMagick before 7.1.2-19 contains a memory leak vulnerability in the PNG encoder when writing...

JLSEC-2026-1249: A flaw was found in GLib. A state confusion issue exists in gdbusnodeinfonewforxml() in the...

Tue, 30 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1249: A flaw was found in GLib. A state confusion issue exists in gdbusnodeinfonewforxml() in the...

JLSEC-2026-1245: A flaw was found in GLib. A buffer over-read can occur in the gregexreplace function when used...

Tue, 30 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1245: A flaw was found in GLib. A buffer over-read can occur in the gregexreplace function when used...

JLSEC-2026-1045: ImageMagick before 7.1.2-13 contains a memory leak vulnerability in LoadOpenCLDeviceBenchmark()...

Tue, 30 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1045: ImageMagick before 7.1.2-13 contains a memory leak vulnerability in LoadOpenCLDeviceBenchmark()...

JLSEC-2026-1050: ImageMagick before 7.1.2-22 contains an information disclosure vulnerability in the...

Tue, 30 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1050: ImageMagick before 7.1.2-22 contains an information disclosure vulnerability in the...

JLSEC-2026-1264: GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file...

Mon, 29 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1264: GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file...

JLSEC-2026-1263: JLSEC-2026-1263

Mon, 29 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1263: JLSEC-2026-1263

JLSEC-2026-1265: GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by...

Mon, 29 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1265: GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by...

JLSEC-2026-1169: 7-Zip for Windows fails to preserve the Mark-of-the-Web when extracting a crafted RAR5 archive

Sun, 28 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1169: 7-Zip for Windows fails to preserve the Mark-of-the-Web when extracting a crafted RAR5 archive

JLSEC-2026-663: libssh2 through 1.11.1 grows its publickey list with `SSH2_REALLOC` but does not zero-initialize new...

Sun, 28 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-663: libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC but does not zero-initialize new...

JLSEC-2026-1171: FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes...

Sun, 28 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1171: FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes...

JLSEC-2026-1157: nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a...

Sun, 28 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1157: nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a...

JLSEC-2026-662: libssh2 through 1.11.1 reads an attacker-controlled 32-bit attribute count from a...

Sun, 28 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-662: libssh2 through 1.11.1 reads an attacker-controlled 32-bit attribute count from a...

JLSEC-2026-697: X.509 trust-chain bypass in the OpenSSL compatibility certificate verifier...

Thu, 25 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-697: X.509 trust-chain bypass in the OpenSSL compatibility certificate verifier...

JLSEC-2026-735: Un-negotiated Raw Public Key (RFC 7250) accepted in place of an X.509 certificate, bypassing chain...

Thu, 25 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-735: Un-negotiated Raw Public Key (RFC 7250) accepted in place of an X.509 certificate, bypassing chain...

JLSEC-2026-748: The ML-KEM ARM64 NEON ciphertext comparison only compares half of the input, breaking the...

Thu, 25 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-748: The ML-KEM ARM64 NEON ciphertext comparison only compares half of the input, breaking the...

JLSEC-2026-695: The X25519 `x86_64` assembly implementation fails to clear the most significant bit during the final...

Thu, 25 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-695: The X25519 x86_64 assembly implementation fails to clear the most significant bit during the final...

JLSEC-2026-700: Out-of-bounds heap read during SM2/SM3 certificate signature verification

Thu, 25 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-700: Out-of-bounds heap read during SM2/SM3 certificate signature verification

JLSEC-2026-746: Out-of-bounds write in SetSuitesHashSigAlgo when processing an oversized signature algorithms list,...

Thu, 25 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-746: Out-of-bounds write in SetSuitesHashSigAlgo when processing an oversized signature algorithms list,...

JLSEC-2026-743: When `HAVE_ENCRYPT_THEN_MAC` is configured, the implementation could fall back to MAC-then-Encrypt...

Thu, 25 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-743: When HAVE_ENCRYPT_THEN_MAC is configured, the implementation could fall back to MAC-then-Encrypt...

JLSEC-2026-699: X.509 trust-chain bypass (path-depth exhaustion) in the OpenSSL compatibility certificate verifier...

Thu, 25 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-699: X.509 trust-chain bypass (path-depth exhaustion) in the OpenSSL compatibility certificate verifier...

JLSEC-2026-755: X.509 name constraint bypass via the Subject Common Name when treated as a DNS-type name

Thu, 25 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-755: X.509 name constraint bypass via the Subject Common Name when treated as a DNS-type name

JLSEC-2026-745: Bleichenbacher padding oracle in PKCS#7 KTRI decryption

Thu, 25 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-745: Bleichenbacher padding oracle in PKCS#7 KTRI decryption

JLSEC-2026-753: A heap buffer overflow could occur in the DTLS 1.3 ACK serialization path before the connecting peer...

Thu, 25 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-753: A heap buffer overflow could occur in the DTLS 1.3 ACK serialization path before the connecting peer...

JLSEC-2026-742: Partial-chain certificate verification may accept chains that terminate at a peer-supplied,...

Thu, 25 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-742: Partial-chain certificate verification may accept chains that terminate at a peer-supplied,...

JLSEC-2026-750: Certificate policy and RFC 8446 compliance concerns regarding the continued acceptance of SHA-1/MD5...

Thu, 25 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-750: Certificate policy and RFC 8446 compliance concerns regarding the continued acceptance of SHA-1/MD5...

JLSEC-2026-734: Out-of-bounds write in the Renesas TSIP TLS 1.3 transcript buffer

Thu, 25 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-734: Out-of-bounds write in the Renesas TSIP TLS 1.3 transcript buffer

JLSEC-2026-744: Heap buffer overread in `wc_PKCS7_DecodeEnvelopedData` when parsing crafted PKCS7 EnvelopedData

Thu, 25 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-744: Heap buffer overread in wc_PKCS7_DecodeEnvelopedData when parsing crafted PKCS7 EnvelopedData

JLSEC-2026-694: OCSP CertID serial-number length-confusion in `wolfSSL_OCSP_resp_find_status` allows a same-issuer...

Thu, 25 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-694: OCSP CertID serial-number length-confusion in wolfSSL_OCSP_resp_find_status allows a same-issuer...

JLSEC-2026-693: ML-KEM-1024 x64 AVX2 implicit rejection failure in the Fujisaki-Okamoto transform breaks IND-CCA2...

Thu, 25 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-693: ML-KEM-1024 x64 AVX2 implicit rejection failure in the Fujisaki-Okamoto transform breaks IND-CCA2...

JLSEC-2026-737: TLS 1.3 post-handshake authentication (PHA) issue where a server could accept a client's Finished...

Thu, 25 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-737: TLS 1.3 post-handshake authentication (PHA) issue where a server could accept a client's Finished...

JLSEC-2026-738: Chain intermediate CA:TRUE without keyCertSign accepted as a signing CA

Thu, 25 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-738: Chain intermediate CA:TRUE without keyCertSign accepted as a signing CA

JLSEC-2026-757: Use-after-free in PQC hybrid key-share handling

Thu, 25 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-757: Use-after-free in PQC hybrid key-share handling

JLSEC-2026-751: A CRL critical extension bypass exists in `ParseCRL_Extensions` where critical extensions are not...

Thu, 25 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-751: A CRL critical extension bypass exists in ParseCRL_Extensions where critical extensions are not...

JLSEC-2026-747: PKCS#12 MAC verification uses an attacker-controlled comparison length, weakening the integrity...

Thu, 25 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-747: PKCS#12 MAC verification uses an attacker-controlled comparison length, weakening the integrity...

JLSEC-2026-752: Integer underflow in `wc_PKCS7_DecryptOri` when handling crafted Other Recipient Info, leading to...

Thu, 25 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-752: Integer underflow in wc_PKCS7_DecryptOri when handling crafted Other Recipient Info, leading to...

JLSEC-2026-739: AES-GCM encryption/decryption with extremely large cumulative single message sizes (>64 GiB) were...

Thu, 25 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-739: AES-GCM encryption/decryption with extremely large cumulative single message sizes (>64 GiB) were...

JLSEC-2026-754: The PKCS#7 decode path ignores the caller-supplied output buffer size (outputSz), allowing decoded...

Thu, 25 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-754: The PKCS#7 decode path ignores the caller-supplied output buffer size (outputSz), allowing decoded...

JLSEC-2026-698: Missing SNI/ALPN binding on stateful (session-ID) resumption, which previously skipped the binding...

Thu, 25 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-698: Missing SNI/ALPN binding on stateful (session-ID) resumption, which previously skipped the binding...

JLSEC-2026-758: iPAddress name constraints bypass when `WOLFSSL_IP_ALT_NAME` is not defined

Thu, 25 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-758: iPAddress name constraints bypass when WOLFSSL_IP_ALT_NAME is not defined

JLSEC-2026-696: Certificates with wildcard DNS SANs (e.g

Thu, 25 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-696: Certificates with wildcard DNS SANs (e.g

JLSEC-2026-756: `PKCS7_verify` signer confusion allows forged signatures, where the signer associated with a...

Thu, 25 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-756: PKCS7_verify signer confusion allows forged signatures, where the signer associated with a...

JLSEC-2026-749: HMAC zero-length tag forgery in `EVP_DigestVerifyFinal`, where a zero-length tag could be accepted...

Thu, 25 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-749: HMAC zero-length tag forgery in EVP_DigestVerifyFinal, where a zero-length tag could be accepted...

JLSEC-2026-736: `wolfSSL_PKCS7_verify()` returning success for a degenerate (certs-only) PKCS#7 object that contains...

Thu, 25 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-736: wolfSSL_PKCS7_verify() returning success for a degenerate (certs-only) PKCS#7 object that contains...

JLSEC-2026-633: vtk vtk-dicom vtkDICOMItem::NewDataElement heap-based buffer overflow vulnerability

Thu, 25 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-633: vtk vtk-dicom vtkDICOMItem::NewDataElement heap-based buffer overflow vulnerability

JLSEC-2026-1051: JLSEC-2026-1051

Wed, 24 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1051: JLSEC-2026-1051

JLSEC-2026-1049: JLSEC-2026-1049

Wed, 24 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1049: JLSEC-2026-1049

JLSEC-2026-1166: Deno: process.loadEnvFile() bypasses env permission checks and mutates process.env with only read access

Tue, 23 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1166: Deno: process.loadEnvFile() bypasses env permission checks and mutates process.env with only read access

JLSEC-2026-620: WebSocket reader data race in auto-PONG/CLOSE-echo handling in HTTP.jl

Tue, 23 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-620: WebSocket reader data race in auto-PONG/CLOSE-echo handling in HTTP.jl

JLSEC-2026-614: WebSocket default Origin check ignores scheme and port in HTTP.jl

Tue, 23 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-614: WebSocket default Origin check ignores scheme and port in HTTP.jl

JLSEC-2026-623: Insufficient HTTP/2 pseudo-header and Host/:authority validation in HTTP.jl server

Tue, 23 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-623: Insufficient HTTP/2 pseudo-header and Host/:authority validation in HTTP.jl server

JLSEC-2026-616: HTTP/1 client request smuggling via CR/LF in method, target, or host in HTTP.jl

Tue, 23 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-616: HTTP/1 client request smuggling via CR/LF in method, target, or host in HTTP.jl

JLSEC-2026-1167: Deno: Denial of service via non-ASCII bytes in WebSocket response headers

Tue, 23 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1167: Deno: Denial of service via non-ASCII bytes in WebSocket response headers

JLSEC-2026-656: Deno: Command Injection via spawnSync & spawn on Windows

Tue, 23 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-656: Deno: Command Injection via spawnSync & spawn on Windows

JLSEC-2026-619: CR/LF injection in server-sent events (SSE) fields in HTTP.jl

Tue, 23 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-619: CR/LF injection in server-sent events (SSE) fields in HTTP.jl

JLSEC-2026-617: Open redirect in the HTTP.jl static file server canonical redirects

Tue, 23 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-617: Open redirect in the HTTP.jl static file server canonical redirects

JLSEC-2026-618: HTTP/1 request smuggling via bare-LF, lenient chunk size, and TE/CL handling in HTTP.jl server

Tue, 23 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-618: HTTP/1 request smuggling via bare-LF, lenient chunk size, and TE/CL handling in HTTP.jl server

JLSEC-2026-654: Deno's TLS retry copies stale upgrade hook, risking plaintext traffic

Tue, 23 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-654: Deno's TLS retry copies stale upgrade hook, risking plaintext traffic

JLSEC-2026-667: GNU libidn before 1.44 is prone to out-of-bounds reads of uninitialized memory in the ToUnicode APIs...

Tue, 23 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-667: GNU libidn before 1.44 is prone to out-of-bounds reads of uninitialized memory in the ToUnicode APIs...

JLSEC-2026-1084: CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS...

Tue, 23 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1084: CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS...

JLSEC-2026-612: Path traversal in the HTTP.jl static file server via separator/absolute path segments

Tue, 23 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-612: Path traversal in the HTTP.jl static file server via separator/absolute path segments

JLSEC-2026-613: Redirect credential leakage across scheme/port in HTTP.jl

Tue, 23 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-613: Redirect credential leakage across scheme/port in HTTP.jl

JLSEC-2026-1057: ImageMagick before 7.1.2-15 and 6.9.13-40 contains a heap use-after-free in the meta coder: when...

Tue, 23 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1057: ImageMagick before 7.1.2-15 and 6.9.13-40 contains a heap use-after-free in the meta coder: when...

JLSEC-2026-1060: ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG...

Tue, 23 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1060: ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG...

JLSEC-2026-622: Predictable WebSocket masking key and handshake nonce in HTTP.jl client

Tue, 23 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-622: Predictable WebSocket masking key and handshake nonce in HTTP.jl client

JLSEC-2026-1164: Deno: `fetch()` API sandbox bypass via missing DNS resolution check

Tue, 23 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1164: Deno: fetch() API sandbox bypass via missing DNS resolution check

JLSEC-2026-658: Deno: Miller-Rabin Primality Test Allows Zero Rounds

Tue, 23 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-658: Deno: Miller-Rabin Primality Test Allows Zero Rounds

JLSEC-2026-624: HTTP/2 client HPACK desynchronization via header blocks for unknown streams in HTTP.jl

Tue, 23 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-624: HTTP/2 client HPACK desynchronization via header blocks for unknown streams in HTTP.jl

JLSEC-2026-611: Unbounded HTTP/2 concurrent streams and Rapid Reset denial of service in HTTP.jl server

Tue, 23 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-611: Unbounded HTTP/2 concurrent streams and Rapid Reset denial of service in HTTP.jl server

JLSEC-2026-657: Deno: BYONM module resolution allows `package.json` main path traversal to bypass `--allow-read` restrictions

Tue, 23 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-657: Deno: BYONM module resolution allows package.json main path traversal to bypass --allow-read restrictions

JLSEC-2026-1165: Deno: WebSocket API sandbox bypass via missing post-DNS check

Tue, 23 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1165: Deno: WebSocket API sandbox bypass via missing post-DNS check

JLSEC-2026-621: Thread-safety and out-of-bounds reads in the HTTP.jl content-type sniffer

Tue, 23 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-621: Thread-safety and out-of-bounds reads in the HTTP.jl content-type sniffer

JLSEC-2026-615: Cookie jar accepts `Secure/Host-/Secure-` cookies from non-secure origins in HTTP.jl

Tue, 23 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-615: Cookie jar accepts Secure/__Host-/__Secure- cookies from non-secure origins in HTTP.jl

JLSEC-2026-655: Deno: Permission Bypass via Unicode Normalization Mismatch on macOS (APFS)

Tue, 23 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-655: Deno: Permission Bypass via Unicode Normalization Mismatch on macOS (APFS)

JLSEC-2026-1052: ImageMagick before 7.1.2-15 and 6.9.13-40 contains a memory leak in coders/txt.c when processing...

Tue, 23 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1052: ImageMagick before 7.1.2-15 and 6.9.13-40 contains a memory leak in coders/txt.c when processing...

JLSEC-2026-1240: JLSEC-2026-1240

Mon, 22 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1240: JLSEC-2026-1240

JLSEC-2026-1228: JLSEC-2026-1228

Sun, 21 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1228: JLSEC-2026-1228

JLSEC-2026-1048: ImageMagick before 7.1.2-15 and 6.9.x before 6.9.13-40 contains an integer overflow in the PSB ...

Sun, 21 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1048: ImageMagick before 7.1.2-15 and 6.9.x before 6.9.13-40 contains an integer overflow in the PSB ...

JLSEC-2026-1059: ImageMagick before 7.1.2-15 (and 6.x before 6.9.13-40) contains a heap out-of-bounds read in the...

Sun, 21 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1059: ImageMagick before 7.1.2-15 (and 6.x before 6.9.13-40) contains a heap out-of-bounds read in the...

JLSEC-2026-1236: JLSEC-2026-1236

Sun, 21 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1236: JLSEC-2026-1236

JLSEC-2026-1234: JLSEC-2026-1234

Sun, 21 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1234: JLSEC-2026-1234

JLSEC-2026-1231: JLSEC-2026-1231

Sun, 21 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1231: JLSEC-2026-1231

JLSEC-2026-1229: JLSEC-2026-1229

Sun, 21 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1229: JLSEC-2026-1229

JLSEC-2026-1230: JLSEC-2026-1230

Sun, 21 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1230: JLSEC-2026-1230

JLSEC-2026-1235: JLSEC-2026-1235

Sun, 21 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1235: JLSEC-2026-1235

JLSEC-2026-1227: JLSEC-2026-1227

Sun, 21 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1227: JLSEC-2026-1227

JLSEC-2026-1233: JLSEC-2026-1233

Sun, 21 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1233: JLSEC-2026-1233

JLSEC-2026-1232: JLSEC-2026-1232

Sun, 21 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1232: JLSEC-2026-1232

JLSEC-2026-790: A malicious h.265 bitstream can cause integer overflow and out of bounds writes in libde265

Fri, 19 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-790: A malicious h.265 bitstream can cause integer overflow and out of bounds writes in libde265

JLSEC-2026-789: A malicious h.265 bitstream can cause an out-of-bounds write in libde265

Fri, 19 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-789: A malicious h.265 bitstream can cause an out-of-bounds write in libde265

JLSEC-2026-1101: JLSEC-2026-1101

Fri, 19 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1101: JLSEC-2026-1101

JLSEC-2026-1225: JLSEC-2026-1225

Fri, 19 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1225: JLSEC-2026-1225

JLSEC-2026-1226: JLSEC-2026-1226

Fri, 19 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1226: JLSEC-2026-1226

JLSEC-2026-659: libssh2 through 1.11.1, fixed in commit 2dae302, contains an out-of-bounds heap read vulnerability...

Thu, 18 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-659: libssh2 through 1.11.1, fixed in commit 2dae302, contains an out-of-bounds heap read vulnerability...

JLSEC-2026-653: An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV...

Thu, 18 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-653: An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV...

JLSEC-2026-812: Heap buffer overflow when decoding a malicious HTJ2K-compressed EXR file

Thu, 18 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-812: Heap buffer overflow when decoding a malicious HTJ2K-compressed EXR file

JLSEC-2026-813: Crafted HTJ2K compressed EXR files can trigger out of bounds reads in OpenEXR

Thu, 18 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-813: Crafted HTJ2K compressed EXR files can trigger out of bounds reads in OpenEXR

JLSEC-2026-661: libssh2 through 1.11.1, fixed in commit 7acf3df contains an out-of-bounds write vulnerability in...

Wed, 17 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-661: libssh2 through 1.11.1, fixed in commit 7acf3df contains an out-of-bounds write vulnerability in...

JLSEC-2026-660: libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service...

Wed, 17 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-660: libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service...

JLSEC-2026-1366: wasmtime-wasi: WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restriction

Mon, 15 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1366: wasmtime-wasi: WASI path_open(TRUNCATE) bypasses FilePerms::WRITE host restriction

JLSEC-2026-1017: ImageMagick: Heap Buffer Over-Write of a single byte in the JP2 encoder.

Wed, 10 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1017: ImageMagick: Heap Buffer Over-Write of a single byte in the JP2 encoder.

JLSEC-2026-1019: ImageMagick: Race Condition in distributed pixel cache server can result in file descriptor hijacking

Wed, 10 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1019: ImageMagick: Race Condition in distributed pixel cache server can result in file descriptor hijacking

JLSEC-2026-1020: ImageMagick: Information Disclosure in distributed pixel cache server because it is not using a challenge–response authentication model

Wed, 10 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1020: ImageMagick: Information Disclosure in distributed pixel cache server because it is not using a challenge–response authentication model

JLSEC-2026-1016: ImageMagick: Stack overflow in fx operation

Wed, 10 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1016: ImageMagick: Stack overflow in fx operation

JLSEC-2026-1010: ImageMagick: Heap Buffer Over-Read of a 4 bytes in distort operation.

Wed, 10 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1010: ImageMagick: Heap Buffer Over-Read of a 4 bytes in distort operation.

JLSEC-2026-1015: ImageMagick: Use-After-Free in MSL decoder.

Wed, 10 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1015: ImageMagick: Use-After-Free in MSL decoder.

JLSEC-2026-1012: ImageMagick: Heap Buffer Over-Write in IPL decoder when reading multiple images of different dimensions

Wed, 10 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1012: ImageMagick: Heap Buffer Over-Write in IPL decoder when reading multiple images of different dimensions

JLSEC-2026-1026: ImageMagick: Policy Bypass in DCM decoder could result in image with invalid dimensions

Wed, 10 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1026: ImageMagick: Policy Bypass in DCM decoder could result in image with invalid dimensions

JLSEC-2026-1030: ImageMagick has a Use-After-Free when allocation in CheckPrimitiveExtent fails

Wed, 10 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1030: ImageMagick has a Use-After-Free when allocation in CheckPrimitiveExtent fails

JLSEC-2026-1013: ImageMagick: Heap Buffer Over-Write in MIFF encoder when using LZMA compression

Wed, 10 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1013: ImageMagick: Heap Buffer Over-Write in MIFF encoder when using LZMA compression

JLSEC-2026-1025: ImageMagick has a Heap Buffer Over-Write in MAT decoder on 32-bit systems

Wed, 10 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1025: ImageMagick has a Heap Buffer Over-Write in MAT decoder on 32-bit systems

JLSEC-2026-1024: ImageMagick Vulnerable to Stack Overflow in its MVG Decoder

Wed, 10 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1024: ImageMagick Vulnerable to Stack Overflow in its MVG Decoder

JLSEC-2026-1029: ImageMagick has out-of-bounds write in ICON decoder due to incorrect loop

Wed, 10 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1029: ImageMagick has out-of-bounds write in ICON decoder due to incorrect loop

JLSEC-2026-1008: ImageMagick: Out-of-Bounds Read of a single byte in meta encoder

Wed, 10 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1008: ImageMagick: Out-of-Bounds Read of a single byte in meta encoder

JLSEC-2026-1031: ImageMagick has Null Pointer Dereference caused by the distort operation when passing incorrect arguments

Wed, 10 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1031: ImageMagick has Null Pointer Dereference caused by the distort operation when passing incorrect arguments

JLSEC-2026-1028: ImageMagick: Policy Bypass can Trigger an Out-of-Memory condition

Wed, 10 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1028: ImageMagick: Policy Bypass can Trigger an Out-of-Memory condition

JLSEC-2026-1011: ImageMagick: Policy Bypass in MNG coder could

Wed, 10 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1011: ImageMagick: Policy Bypass in MNG coder could

JLSEC-2026-1006: ImageMagick: Heap Buffer Over-Read in IPTC encoder

Wed, 10 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1006: ImageMagick: Heap Buffer Over-Read in IPTC encoder

JLSEC-2026-1033: ImageMagick has a Heap Buffer Over-Write in SF3 encoder when writing multi-frame image

Wed, 10 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1033: ImageMagick has a Heap Buffer Over-Write in SF3 encoder when writing multi-frame image

JLSEC-2026-1023: ImageMagick has an Infinite Loop in subimage-search with crafted image

Wed, 10 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1023: ImageMagick has an Infinite Loop in subimage-search with crafted image

JLSEC-2026-1018: ImageMagick: Heap Buffer Over-Write in distributed pixel cache server

Wed, 10 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1018: ImageMagick: Heap Buffer Over-Write in distributed pixel cache server

JLSEC-2026-1007: ImageMagick: Policy Bypass in PSD decoder

Wed, 10 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1007: ImageMagick: Policy Bypass in PSD decoder

JLSEC-2026-1032: ImageMagick: Memory Leak in wand option parser when providing invalid arguments

Wed, 10 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1032: ImageMagick: Memory Leak in wand option parser when providing invalid arguments

JLSEC-2026-1014: ImageMagick: Infinite Loop in the MIFF decoder can lead to CPU exhaustion

Wed, 10 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1014: ImageMagick: Infinite Loop in the MIFF decoder can lead to CPU exhaustion

JLSEC-2026-1022: ImageMagick has a Heap Buffer Underwrite in the Floyd-Steinberg depth dithering method

Wed, 10 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1022: ImageMagick has a Heap Buffer Underwrite in the Floyd-Steinberg depth dithering method

JLSEC-2026-1009: ImageMagick: Out-of-Bounds Read in connected components when the user supplies an invalid keep-top define

Wed, 10 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1009: ImageMagick: Out-of-Bounds Read in connected components when the user supplies an invalid keep-top define

JLSEC-2026-1021: ImageMagick: Heap Buffer Over-Read in distributed pixel cache server

Wed, 10 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1021: ImageMagick: Heap Buffer Over-Read in distributed pixel cache server

JLSEC-2026-1027: ImageMagick: Policy Bypass can read disallowed files via symlink

Wed, 10 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1027: ImageMagick: Policy Bypass can read disallowed files via symlink

JLSEC-2026-1140: Issue summary: The CMSdecrypt and PKCS7decrypt functions are vulnerable to Bleichenbacher-style...

Tue, 09 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1140: Issue summary: The CMSdecrypt and PKCS7decrypt functions are vulnerable to Bleichenbacher-style...

JLSEC-2026-1134: Issue Summary: The PKCS#12 file processing fails to perform sufficient input validation for files...

Tue, 09 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1134: Issue Summary: The PKCS#12 file processing fails to perform sufficient input validation for files...

JLSEC-2026-1139: Issue summary: An attacker-controlled CMP (Certificate Management Protocol) server could trigger...

Tue, 09 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1139: Issue summary: An attacker-controlled CMP (Certificate Management Protocol) server could trigger...

JLSEC-2026-1138: Issue summary: A specially crafted password-encrypted CMS message can trigger a NULL pointer...

Tue, 09 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1138: Issue summary: A specially crafted password-encrypted CMS message can trigger a NULL pointer...

JLSEC-2026-1137: Issue summary: Receiving a QUIC initial packet with an invalid token may trigger a NULL pointer...

Tue, 09 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1137: Issue summary: Receiving a QUIC initial packet with an invalid token may trigger a NULL pointer...

JLSEC-2026-1133: Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive element whose...

Tue, 09 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1133: Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive element whose...

JLSEC-2026-1142: Issue summary: When EVPPKEYderivesetpeer() is called with a DHX (X9.42) peer key, the peer...

Tue, 09 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1142: Issue summary: When EVPPKEYderivesetpeer() is called with a DHX (X9.42) peer key, the peer...

JLSEC-2026-1143: Issue summary: When an application drives an AES-OCB context through the public EVP_Cipher() one...

Tue, 09 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1143: Issue summary: When an application drives an AES-OCB context through the public EVP_Cipher() one...

JLSEC-2026-1141: Issue Summary: An error in the callback used to verify the certificate provided in a Root CA key...

Tue, 09 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1141: Issue Summary: An error in the callback used to verify the certificate provided in a Root CA key...

JLSEC-2026-1135: Issue Summary: Cryptographic Message Services (CMS) processing fails to perform sufficient input...

Tue, 09 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1135: Issue Summary: Cryptographic Message Services (CMS) processing fails to perform sufficient input...

JLSEC-2026-1156: Issue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap) processes attacker...

Tue, 09 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1156: Issue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap) processes attacker...

JLSEC-2026-1144: Issue summary: The implementations of AES-SIV (RFC 5297) and AES-GCM-SIV (RFC 8452) mishandle the...

Tue, 09 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1144: Issue summary: The implementations of AES-SIV (RFC 5297) and AES-GCM-SIV (RFC 8452) mishandle the...

JLSEC-2026-1155: Issue summary: A signed integer overflow when sizing the destination buffer for Unicode output in...

Tue, 09 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1155: Issue summary: A signed integer overflow when sizing the destination buffer for Unicode output in...

JLSEC-2026-1145: Issue summary: A specially crafted PKCS#7 or S/MIME signed message could trigger a use-after-free...

Tue, 09 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1145: Issue summary: A specially crafted PKCS#7 or S/MIME signed message could trigger a use-after-free...

JLSEC-2026-1136: Issue summary: Remote peer may exhaust heap memory of the QUIC server or client by flooding it...

Tue, 09 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1136: Issue summary: Remote peer may exhaust heap memory of the QUIC server or client by flooding it...

JLSEC-2026-1224: JLSEC-2026-1224

Thu, 04 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1224: JLSEC-2026-1224

JLSEC-2026-1301: JLSEC-2026-1301

Wed, 03 Jun 2026 00:00:00 +0000

Security advisory JLSEC-2026-1301: JLSEC-2026-1301

JLSEC-2026-666: libusb before version 1.0.30 contains a one-byte out-of-bounds read vulnerability in...

Wed, 27 May 2026 00:00:00 +0000

Security advisory JLSEC-2026-666: libusb before version 1.0.30 contains a one-byte out-of-bounds read vulnerability in...

JLSEC-2026-766: GDAL: scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow

Wed, 27 May 2026 00:00:00 +0000

Security advisory JLSEC-2026-766: GDAL: scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow

JLSEC-2026-665: libusb before version 1.0.30 contains a NULL pointer dereference vulnerability that allows attackers...

Wed, 27 May 2026 00:00:00 +0000

Security advisory JLSEC-2026-665: libusb before version 1.0.30 contains a NULL pointer dereference vulnerability that allows attackers...

JLSEC-2026-573: JLSEC-2026-573

Fri, 22 May 2026 00:00:00 +0000

Security advisory JLSEC-2026-573: JLSEC-2026-573

JLSEC-2026-574: JLSEC-2026-574

Fri, 22 May 2026 00:00:00 +0000

Security advisory JLSEC-2026-574: JLSEC-2026-574

JLSEC-2026-629: Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token...

Wed, 20 May 2026 00:00:00 +0000

Security advisory JLSEC-2026-629: Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token...

JLSEC-2026-630: Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in path-based system...

Wed, 20 May 2026 00:00:00 +0000

Security advisory JLSEC-2026-630: Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in path-based system...

JLSEC-2026-631: Rsync version 3.4.2 and prior contain a receiver-side out-of-bounds array read vulnerability in...

Wed, 20 May 2026 00:00:00 +0000

Security advisory JLSEC-2026-631: Rsync version 3.4.2 and prior contain a receiver-side out-of-bounds array read vulnerability in...

JLSEC-2026-626: Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon...

Wed, 20 May 2026 00:00:00 +0000

Security advisory JLSEC-2026-626: Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon...

JLSEC-2026-632: JLSEC-2026-632

Wed, 20 May 2026 00:00:00 +0000

Security advisory JLSEC-2026-632: JLSEC-2026-632

JLSEC-2026-628: Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's...

Wed, 20 May 2026 00:00:00 +0000

Security advisory JLSEC-2026-628: Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's...

JLSEC-2026-570: JLSEC-2026-570

Tue, 19 May 2026 00:00:00 +0000

Security advisory JLSEC-2026-570: JLSEC-2026-570

JLSEC-2026-572: JLSEC-2026-572

Tue, 19 May 2026 00:00:00 +0000

Security advisory JLSEC-2026-572: JLSEC-2026-572

JLSEC-2026-571: JLSEC-2026-571

Tue, 19 May 2026 00:00:00 +0000

Security advisory JLSEC-2026-571: JLSEC-2026-571

JLSEC-2026-608: JLSEC-2026-608

Thu, 14 May 2026 00:00:00 +0000

Security advisory JLSEC-2026-608: JLSEC-2026-608

JLSEC-2026-605: JLSEC-2026-605

Thu, 14 May 2026 00:00:00 +0000

Security advisory JLSEC-2026-605: JLSEC-2026-605

JLSEC-2026-1365: wasmtime has a panic when allocating a table exceeding the size of the host's address space

Thu, 14 May 2026 00:00:00 +0000

Security advisory JLSEC-2026-1365: wasmtime has a panic when allocating a table exceeding the size of the host's address space

JLSEC-2026-606: JLSEC-2026-606

Thu, 14 May 2026 00:00:00 +0000

Security advisory JLSEC-2026-606: JLSEC-2026-606

JLSEC-2026-601: JLSEC-2026-601

Thu, 14 May 2026 00:00:00 +0000

Security advisory JLSEC-2026-601: JLSEC-2026-601

JLSEC-2026-604: JLSEC-2026-604

Thu, 14 May 2026 00:00:00 +0000

Security advisory JLSEC-2026-604: JLSEC-2026-604

JLSEC-2026-607: JLSEC-2026-607

Thu, 14 May 2026 00:00:00 +0000

Security advisory JLSEC-2026-607: JLSEC-2026-607

JLSEC-2026-602: JLSEC-2026-602

Thu, 14 May 2026 00:00:00 +0000

Security advisory JLSEC-2026-602: JLSEC-2026-602

JLSEC-2026-603: JLSEC-2026-603

Thu, 14 May 2026 00:00:00 +0000

Security advisory JLSEC-2026-603: JLSEC-2026-603

JLSEC-2026-600: JLSEC-2026-600

Thu, 14 May 2026 00:00:00 +0000

Security advisory JLSEC-2026-600: JLSEC-2026-600

JLSEC-2026-1208: When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, libcurl...

Wed, 13 May 2026 00:00:00 +0000

Security advisory JLSEC-2026-1208: When asked to both use a .netrc file for credentials and to follow HTTP redirects, libcurl...

JLSEC-2026-1347: aria2c accepts a server certificate with incorrect Extended Key Usage (EKU). If the attackers...

Wed, 13 May 2026 00:00:00 +0000

Security advisory JLSEC-2026-1347: aria2c accepts a server certificate with incorrect Extended Key Usage (EKU). If the attackers...

JLSEC-2026-1203: A vulnerability exists where a connection requiring TLS incorrectly reuses an existing...

Wed, 13 May 2026 00:00:00 +0000

Security advisory JLSEC-2026-1203: A vulnerability exists where a connection requiring TLS incorrectly reuses an existing...

JLSEC-2026-1209: When curl is told to use the Certificate Status Request TLS extension, often referred to as *OCSP...

Wed, 13 May 2026 00:00:00 +0000

Security advisory JLSEC-2026-1209: When curl is told to use the Certificate Status Request TLS extension, often referred to as *OCSP...

JLSEC-2026-1206: JLSEC-2026-1206

Wed, 13 May 2026 00:00:00 +0000

Security advisory JLSEC-2026-1206: JLSEC-2026-1206

JLSEC-2026-1210: Successfully using libcurl to do a transfer over a specific HTTP proxy (`proxyA`) with Digest...

Wed, 13 May 2026 00:00:00 +0000

Security advisory JLSEC-2026-1210: Successfully using libcurl to do a transfer over a specific HTTP proxy (proxyA) with Digest...

JLSEC-2026-1204: libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated...

Wed, 13 May 2026 00:00:00 +0000

Security advisory JLSEC-2026-1204: libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated...

JLSEC-2026-1207: Using libcurl, when a custom `Host:` header is first set for an HTTP request and a second request...

Wed, 13 May 2026 00:00:00 +0000

Security advisory JLSEC-2026-1207: Using libcurl, when a custom Host: header is first set for an HTTP request and a second request...

JLSEC-2026-1205: libcurl might in some circumstances reuse the wrong connection for SMB(S) transfers. libcurl...

Wed, 13 May 2026 00:00:00 +0000

Security advisory JLSEC-2026-1205: libcurl might in some circumstances reuse the wrong connection for SMB(S) transfers. libcurl...

JLSEC-2026-793: Hugo's Node tool execution allows file system access outside the project directory

Tue, 12 May 2026 00:00:00 +0000

Security advisory JLSEC-2026-793: Hugo's Node tool execution allows file system access outside the project directory

JLSEC-2026-1094: A vulnerability was detected in WebAssembly Binaryen up to 117. This issue affects the function...

Mon, 11 May 2026 00:00:00 +0000

Security advisory JLSEC-2026-1094: A vulnerability was detected in WebAssembly Binaryen up to 117. This issue affects the function...

JLSEC-2026-1005: JLSEC-2026-1005

Mon, 11 May 2026 00:00:00 +0000

Security advisory JLSEC-2026-1005: JLSEC-2026-1005

JLSEC-2026-1223: JLSEC-2026-1223

Sun, 10 May 2026 00:00:00 +0000

Security advisory JLSEC-2026-1223: JLSEC-2026-1223

JLSEC-2026-772: A vulnerability has been found in OSGeo gdal up to 3.13.0dev-4

Sat, 09 May 2026 00:00:00 +0000

Security advisory JLSEC-2026-772: A vulnerability has been found in OSGeo gdal up to 3.13.0dev-4

JLSEC-2026-771: OSGeo gdal has a heap-based buffer overflow

Sat, 09 May 2026 00:00:00 +0000

Security advisory JLSEC-2026-771: OSGeo gdal has a heap-based buffer overflow

JLSEC-2026-768: A vulnerability was identified in OSGeo gdal up to 3.13.0dev-4

Thu, 07 May 2026 00:00:00 +0000

Security advisory JLSEC-2026-768: A vulnerability was identified in OSGeo gdal up to 3.13.0dev-4

JLSEC-2026-811: A malicious EXR file can trigger undefined behavior in OpenEXR

Thu, 07 May 2026 00:00:00 +0000

Security advisory JLSEC-2026-811: A malicious EXR file can trigger undefined behavior in OpenEXR

JLSEC-2026-810: Possible out-of-bounds access in OpenEXR's `IDManifest::init()`

Thu, 07 May 2026 00:00:00 +0000

Security advisory JLSEC-2026-810: Possible out-of-bounds access in OpenEXR's IDManifest::init()

JLSEC-2026-767: A vulnerability was determined in OSGeo gdal up to 3.13.0dev-4

Thu, 07 May 2026 00:00:00 +0000

Security advisory JLSEC-2026-767: A vulnerability was determined in OSGeo gdal up to 3.13.0dev-4

JLSEC-2026-769: OSGeo GDAL vulnerable to heap-based buffer overflow

Thu, 07 May 2026 00:00:00 +0000

Security advisory JLSEC-2026-769: OSGeo GDAL vulnerable to heap-based buffer overflow

JLSEC-2026-770: OSGeo GDAL vulnerable to out-of-bounds read

Thu, 07 May 2026 00:00:00 +0000

Security advisory JLSEC-2026-770: OSGeo GDAL vulnerable to out-of-bounds read

JLSEC-2026-809: Integer overflow in OpenEXR's `ImageChannel:resize`

Thu, 07 May 2026 00:00:00 +0000

Security advisory JLSEC-2026-809: Integer overflow in OpenEXR's ImageChannel:resize

JLSEC-2026-492: JLSEC-2026-492

Fri, 01 May 2026 00:00:00 +0000

Security advisory JLSEC-2026-492: JLSEC-2026-492

JLSEC-2026-1259: In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of...

Tue, 28 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-1259: In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of...

JLSEC-2026-1258: In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application...

Tue, 28 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-1258: In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application...

JLSEC-2026-372: JLSEC-2026-372

Sat, 25 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-372: JLSEC-2026-372

JLSEC-2026-373: JLSEC-2026-373

Sat, 25 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-373: JLSEC-2026-373

JLSEC-2026-1241: JLSEC-2026-1241

Thu, 23 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-1241: JLSEC-2026-1241

JLSEC-2026-281: RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution

Thu, 23 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-281: RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution

JLSEC-2026-496: Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via...

Thu, 23 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-496: Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via...

JLSEC-2026-497: Libgcrypt before 1.12.2 mishandles Dilithium signing

Thu, 23 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-497: Libgcrypt before 1.12.2 mishandles Dilithium signing

JLSEC-2026-280: Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution

Thu, 23 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-280: Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution

JLSEC-2026-806: Reading malicious EXR files can cause out-of-bounds writes

Tue, 21 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-806: Reading malicious EXR files can cause out-of-bounds writes

JLSEC-2026-808: Integer overflow in OpenEXR's `internal_dwa_compressor`

Tue, 21 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-808: Integer overflow in OpenEXR's internal_dwa_compressor

JLSEC-2026-807: Integer overflow in OpenEXR's `internal_dwa_compressor`

Tue, 21 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-807: Integer overflow in OpenEXR's internal_dwa_compressor

JLSEC-2026-213: When sed is invoked with both -i (in-place edit) and –follow-symlinks, the function...

Mon, 20 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-213: When sed is invoked with both -i (in-place edit) and –follow-symlinks, the function...

JLSEC-2026-491: JLSEC-2026-491

Sat, 18 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-491: JLSEC-2026-491

JLSEC-2026-652: FFmpeg before 8.1 has an integer overflow and resultant out-of-bounds write via CENC (Common...

Thu, 16 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-652: FFmpeg before 8.1 has an integer overflow and resultant out-of-bounds write via CENC (Common...

JLSEC-2026-627: In rsync 3.0.1 through 3.4.1, `receive_xattr` relies on an untrusted length value during a qsort...

Thu, 16 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-627: In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort...

JLSEC-2026-384: JLSEC-2026-384

Thu, 16 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-384: JLSEC-2026-384

JLSEC-2026-1004: ImageMagick has an off-by-one error in MSL decoder could result in crash

Mon, 13 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-1004: ImageMagick has an off-by-one error in MSL decoder could result in crash

JLSEC-2026-997: ImageMagick has an out-of-bounds read in sample operation

Mon, 13 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-997: ImageMagick has an out-of-bounds read in sample operation

JLSEC-2026-996: ImageMagick has a Stack Overflow via Recursive FX Expression Parsing

Mon, 13 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-996: ImageMagick has a Stack Overflow via Recursive FX Expression Parsing

JLSEC-2026-1267: A vulnerability was identified in uclouvain openjpeg up to 2.5.4. This impacts the function...

Mon, 13 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-1267: A vulnerability was identified in uclouvain openjpeg up to 2.5.4. This impacts the function...

JLSEC-2026-1000: ImageMagick has a heap buffer overflow (WRITE) in the YAML and JSON encoders.

Mon, 13 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-1000: ImageMagick has a heap buffer overflow (WRITE) in the YAML and JSON encoders.

JLSEC-2026-998: JLSEC-2026-998

Mon, 13 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-998: JLSEC-2026-998

JLSEC-2026-651: JLSEC-2026-651

Mon, 13 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-651: JLSEC-2026-651

JLSEC-2026-993: JLSEC-2026-993

Mon, 13 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-993: JLSEC-2026-993

JLSEC-2026-995: ImageMagick has a heap Buffer Overflow in ImageMagick MVG decoder

Mon, 13 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-995: ImageMagick has a heap Buffer Overflow in ImageMagick MVG decoder

JLSEC-2026-773: JLSEC-2026-773

Mon, 13 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-773: JLSEC-2026-773

JLSEC-2026-1002: JLSEC-2026-1002

Mon, 13 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-1002: JLSEC-2026-1002

JLSEC-2026-999: ImageMagick has an integer overflow in despeckle operation causing a heap buffer overflow on 32-bit builds

Mon, 13 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-999: ImageMagick has an integer overflow in despeckle operation causing a heap buffer overflow on 32-bit builds

JLSEC-2026-994: ImageMagick has a heap overflow caused by integer overflow/wraparound in viff encoder on 32-bit builds

Mon, 13 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-994: ImageMagick has a heap overflow caused by integer overflow/wraparound in viff encoder on 32-bit builds

JLSEC-2026-1001: JLSEC-2026-1001

Mon, 13 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-1001: JLSEC-2026-1001

JLSEC-2026-650: JLSEC-2026-650

Mon, 13 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-650: JLSEC-2026-650

JLSEC-2026-649: JLSEC-2026-649

Mon, 13 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-649: JLSEC-2026-649

JLSEC-2026-1003: JLSEC-2026-1003

Mon, 13 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-1003: JLSEC-2026-1003

JLSEC-2026-151: In libexif through 0.6.25, an unsigned 32bit integer overflow in Nikon MakerNote handling could be...

Sun, 12 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-151: In libexif through 0.6.25, an unsigned 32bit integer overflow in Nikon MakerNote handling could be...

JLSEC-2026-152: In libexif through 0.6.25, an integer underflow in size checking for Fuji and Olympus MakerNote...

Sun, 12 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-152: In libexif through 0.6.25, an integer underflow in size checking for Fuji and Olympus MakerNote...

JLSEC-2026-726: wolfSSL's ECCSI signature verifier `wc_VerifyEccsiHash` decodes the `r` and `s` scalars from the...

Fri, 10 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-726: wolfSSL's ECCSI signature verifier wc_VerifyEccsiHash decodes the r and s scalars from the...

JLSEC-2026-728: In wolfSSL's EVP layer, the ChaCha20-Poly1305 AEAD decryption path in `wolfSSL_EVP_CipherFinal` (and...

Fri, 10 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-728: In wolfSSL's EVP layer, the ChaCha20-Poly1305 AEAD decryption path in wolfSSL_EVP_CipherFinal (and...

JLSEC-2026-727: An integer overflow existed in the wolfCrypt CMAC implementation, that could be exploited to forge...

Fri, 10 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-727: An integer overflow existed in the wolfCrypt CMAC implementation, that could be exploited to forge...

JLSEC-2026-721: Dual-Algorithm CertificateVerify out-of-bounds read

Fri, 10 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-721: Dual-Algorithm CertificateVerify out-of-bounds read

JLSEC-2026-729: wolfSSL's `wc_PKCS7_DecodeAuthEnvelopedData()` does not properly sanitize the AES-GCM authentication...

Fri, 10 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-729: wolfSSL's wc_PKCS7_DecodeAuthEnvelopedData() does not properly sanitize the AES-GCM authentication...

JLSEC-2026-720: Heap out-of-bounds read in PKCS7 parsing

Fri, 10 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-720: Heap out-of-bounds read in PKCS7 parsing

JLSEC-2026-725: A heap use-after-free exists in wolfSSL's TLS 1.3 post-quantum cryptography (PQC) hybrid KeyShare...

Fri, 10 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-725: A heap use-after-free exists in wolfSSL's TLS 1.3 post-quantum cryptography (PQC) hybrid KeyShare...

JLSEC-2026-730: `wolfSSL_X509_verify_cert` in the OpenSSL compatibility layer accepts a certificate chain in which...

Fri, 10 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-730: wolfSSL_X509_verify_cert in the OpenSSL compatibility layer accepts a certificate chain in which...

JLSEC-2026-715: An integer underflow issue exists in wolfSSL when parsing the Subject Alternative Name (SAN)...

Fri, 10 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-715: An integer underflow issue exists in wolfSSL when parsing the Subject Alternative Name (SAN)...

JLSEC-2026-724: X.509 date buffer overflow in `wolfSSL_X509_notAfter` / `wolfSSL_X509_notBefore`

Fri, 10 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-724: X.509 date buffer overflow in wolfSSL_X509_notAfter / wolfSSL_X509_notBefore

JLSEC-2026-353: JLSEC-2026-353

Fri, 10 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-353: JLSEC-2026-353

JLSEC-2026-354: JLSEC-2026-354

Thu, 09 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-354: JLSEC-2026-354

JLSEC-2026-740: A 1-byte stack buffer over-read was identified in the MatchDomainName function (`src/internal.c`)...

Thu, 09 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-740: A 1-byte stack buffer over-read was identified in the MatchDomainName function (src/internal.c)...

JLSEC-2026-1358: Wasmtime has host data leakage with 64-bit tables and Winch

Thu, 09 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-1358: Wasmtime has host data leakage with 64-bit tables and Winch

JLSEC-2026-1357: Wasmtime segfault or unused out-of-sandbox load with `f64x2.splat` operator on x86-64

Thu, 09 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-1357: Wasmtime segfault or unused out-of-sandbox load with f64x2.splat operator on x86-64

JLSEC-2026-718: Heap buffer overflow in DTLS 1.3 ACK message processing

Thu, 09 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-718: Heap buffer overflow in DTLS 1.3 ACK message processing

JLSEC-2026-723: Heap buffer overflow in CertFromX509 via AuthorityKeyIdentifier size confusion

Thu, 09 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-723: Heap buffer overflow in CertFromX509 via AuthorityKeyIdentifier size confusion

JLSEC-2026-714: JLSEC-2026-714

Thu, 09 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-714: JLSEC-2026-714

JLSEC-2026-1361: Wasmtime with Winch compiler backend on aarch64 may allow a sandbox-escaping memory access

Thu, 09 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-1361: Wasmtime with Winch compiler backend on aarch64 may allow a sandbox-escaping memory access

JLSEC-2026-717: JLSEC-2026-717

Thu, 09 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-717: JLSEC-2026-717

JLSEC-2026-741: Integer underflow in wolfSSL packet sniffer <= 5.9.0 allows an attacker to cause a program crash in...

Thu, 09 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-741: Integer underflow in wolfSSL packet sniffer <= 5.9.0 allows an attacker to cause a program crash in...

JLSEC-2026-1354: Wasmtime: Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding

Thu, 09 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-1354: Wasmtime: Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding

JLSEC-2026-732: A padding oracle exists in wolfSSL's PKCS7 CBC decryption that could allow an attacker to recover...

Thu, 09 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-732: A padding oracle exists in wolfSSL's PKCS7 CBC decryption that could allow an attacker to recover...

JLSEC-2026-1359: Wasmtime has host panic when Winch compiler executes `table.fill`

Thu, 09 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-1359: Wasmtime has host panic when Winch compiler executes table.fill

JLSEC-2026-1356: Wasmtime has a possible panic when lifting `flags` component value

Thu, 09 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-1356: Wasmtime has a possible panic when lifting flags component value

JLSEC-2026-1355: Wasmtime: Panic when transcoding misaligned utf-16 strings

Thu, 09 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-1355: Wasmtime: Panic when transcoding misaligned utf-16 strings

JLSEC-2026-1362: Wasmtime has data leakage between pooling allocator instances

Thu, 09 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-1362: Wasmtime has data leakage between pooling allocator instances

JLSEC-2026-1363: Wasmtime has improperly masked return value from `table.grow` with Winch compiler backend

Thu, 09 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-1363: Wasmtime has improperly masked return value from table.grow with Winch compiler backend

JLSEC-2026-1360: Wasmtime: Miscompiled guest heap access enables sandbox escape on aarch64 Cranelift

Thu, 09 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-1360: Wasmtime: Miscompiled guest heap access enables sandbox escape on aarch64 Cranelift

JLSEC-2026-716: Missing hash/digest size and OID checks allow digests smaller than allowed when verifying ECDSA...

Thu, 09 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-716: Missing hash/digest size and OID checks allow digests smaller than allowed when verifying ECDSA...

JLSEC-2026-731: In `TLSX_EchChangeSNI`, the ctx->extensions branch set extensions unconditionally even when...

Thu, 09 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-731: In TLSX_EchChangeSNI, the ctx->extensions branch set extensions unconditionally even when...

JLSEC-2026-722: In wolfSSL, ARIA-GCM cipher suites used in TLS 1.2 and DTLS 1.2 reuse an identical 12-byte GCM nonce...

Thu, 09 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-722: In wolfSSL, ARIA-GCM cipher suites used in TLS 1.2 and DTLS 1.2 reuse an identical 12-byte GCM nonce...

JLSEC-2026-733: When restoring a session from cache, a pointer from the serialized session data is used in a free...

Thu, 09 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-733: When restoring a session from cache, a pointer from the serialized session data is used in a free...

JLSEC-2026-719: JLSEC-2026-719

Thu, 09 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-719: JLSEC-2026-719

JLSEC-2026-498: JLSEC-2026-498

Thu, 09 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-498: JLSEC-2026-498

JLSEC-2026-1364: Wasmtime has out-of-bounds write or crash when transcoding component model strings

Thu, 09 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-1364: Wasmtime has out-of-bounds write or crash when transcoding component model strings

JLSEC-2026-276: Issue summary: Converting an excessively large OCTET STRING value to a hexadecimal string leads to a...

Tue, 07 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-276: Issue summary: Converting an excessively large OCTET STRING value to a hexadecimal string leads to a...

JLSEC-2026-1114: A heap-based buffer overflow vulnerability exists in the HuffTable::initval functionality of...

Tue, 07 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-1114: A heap-based buffer overflow vulnerability exists in the HuffTable::initval functionality of...

JLSEC-2026-778: JLSEC-2026-778

Tue, 07 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-778: JLSEC-2026-778

JLSEC-2026-1113: JLSEC-2026-1113

Tue, 07 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-1113: JLSEC-2026-1113

JLSEC-2026-1116: An integer overflow vulnerability exists in the uncompressedfpdngloadraw functionality of...

Tue, 07 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-1116: An integer overflow vulnerability exists in the uncompressedfpdngloadraw functionality of...

JLSEC-2026-272: JLSEC-2026-272

Tue, 07 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-272: JLSEC-2026-272

JLSEC-2026-277: Issue summary: Applications using RSASVE key encapsulation to establish a secret encryption key can...

Tue, 07 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-277: Issue summary: Applications using RSASVE key encapsulation to establish a secret encryption key can...

JLSEC-2026-274: Issue summary: During processing of a crafted CMS EnvelopedData message with KeyAgreeRecipientInfo a...

Tue, 07 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-274: Issue summary: During processing of a crafted CMS EnvelopedData message with KeyAgreeRecipientInfo a...

JLSEC-2026-275: JLSEC-2026-275

Tue, 07 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-275: JLSEC-2026-275

JLSEC-2026-273: JLSEC-2026-273

Tue, 07 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-273: JLSEC-2026-273

JLSEC-2026-1115: A heap-based buffer overflow vulnerability exists in the losslessjpegload_raw functionality of...

Tue, 07 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-1115: A heap-based buffer overflow vulnerability exists in the losslessjpegload_raw functionality of...

JLSEC-2026-792: Hugo: Certain markdown links are not properly escaped

Mon, 06 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-792: Hugo: Certain markdown links are not properly escaped

JLSEC-2026-144: JLSEC-2026-144

Mon, 06 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-144: JLSEC-2026-144

JLSEC-2026-143: JLSEC-2026-143

Mon, 06 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-143: JLSEC-2026-143

JLSEC-2026-142: JLSEC-2026-142

Mon, 06 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-142: JLSEC-2026-142

JLSEC-2026-149: JLSEC-2026-149

Mon, 06 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-149: JLSEC-2026-149

JLSEC-2026-148: JLSEC-2026-148

Mon, 06 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-148: JLSEC-2026-148

JLSEC-2026-212: JLSEC-2026-212

Fri, 03 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-212: JLSEC-2026-212

JLSEC-2026-1118: JLSEC-2026-1118

Thu, 02 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-1118: JLSEC-2026-1118

JLSEC-2026-1117: JLSEC-2026-1117

Thu, 02 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-1117: JLSEC-2026-1117

JLSEC-2026-76: JLSEC-2026-76

Thu, 02 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-76: JLSEC-2026-76

JLSEC-2026-74: In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome...

Thu, 02 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-74: In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome...

JLSEC-2026-75: JLSEC-2026-75

Thu, 02 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-75: JLSEC-2026-75

JLSEC-2026-371: A vulnerability was determined in Cesanta Mongoose up to 7.20

Thu, 02 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-371: A vulnerability was determined in Cesanta Mongoose up to 7.20

JLSEC-2026-370: A vulnerability was found in Cesanta Mongoose up to 7.20

Thu, 02 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-370: A vulnerability was found in Cesanta Mongoose up to 7.20

JLSEC-2026-78: JLSEC-2026-78

Thu, 02 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-78: JLSEC-2026-78

JLSEC-2026-467: Mbed TLS serialized session data is not cryptographically protected

Thu, 02 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-467: Mbed TLS serialized session data is not cryptographically protected

JLSEC-2026-77: JLSEC-2026-77

Thu, 02 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-77: JLSEC-2026-77

JLSEC-2026-369: A vulnerability has been found in Cesanta Mongoose up to 7.20

Thu, 02 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-369: A vulnerability has been found in Cesanta Mongoose up to 7.20

JLSEC-2026-462: JLSEC-2026-462

Thu, 02 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-462: JLSEC-2026-462

JLSEC-2026-464: Mbed TLS might use cloned PSA random generator states

Wed, 01 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-464: Mbed TLS might use cloned PSA random generator states

JLSEC-2026-147: JLSEC-2026-147

Wed, 01 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-147: JLSEC-2026-147

JLSEC-2026-145: JLSEC-2026-145

Wed, 01 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-145: JLSEC-2026-145

JLSEC-2026-465: Mbed TLS may use a low entropy PRNG seed

Wed, 01 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-465: Mbed TLS may use a low entropy PRNG seed

JLSEC-2026-463: Mbed TLS timing side channel in RSA and CBC/ECB decryption

Wed, 01 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-463: Mbed TLS timing side channel in RSA and CBC/ECB decryption

JLSEC-2026-466: Mbed TLS peer can force the FFDH shared secret into a small set of values

Wed, 01 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-466: Mbed TLS peer can force the FFDH shared secret into a small set of values

JLSEC-2026-146: JLSEC-2026-146

Wed, 01 Apr 2026 00:00:00 +0000

Security advisory JLSEC-2026-146: JLSEC-2026-146

JLSEC-2026-991: ImageMagick has an Out-of-Bounds write of a zero byte in its X11 display interaction

Thu, 26 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-991: ImageMagick has an Out-of-Bounds write of a zero byte in its X11 display interaction

JLSEC-2026-782: JLSEC-2026-782

Thu, 26 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-782: JLSEC-2026-782

JLSEC-2026-781: JLSEC-2026-781

Thu, 26 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-781: JLSEC-2026-781

JLSEC-2026-96: JLSEC-2026-96

Thu, 26 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-96: JLSEC-2026-96

JLSEC-2026-780: JLSEC-2026-780

Thu, 26 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-780: JLSEC-2026-780

JLSEC-2026-779: JLSEC-2026-779

Thu, 26 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-779: JLSEC-2026-779

JLSEC-2026-95: JLSEC-2026-95

Thu, 26 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-95: JLSEC-2026-95

JLSEC-2026-783: JLSEC-2026-783

Thu, 26 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-783: JLSEC-2026-783

JLSEC-2026-992: ImageMagick has an Out-of-bounds Write via InterpretImageFilename

Thu, 26 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-992: ImageMagick has an Out-of-bounds Write via InterpretImageFilename

JLSEC-2026-1124: JLSEC-2026-1124

Wed, 25 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-1124: JLSEC-2026-1124

JLSEC-2026-1130: JLSEC-2026-1130

Wed, 25 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-1130: JLSEC-2026-1130

JLSEC-2026-1122: JLSEC-2026-1122

Wed, 25 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-1122: JLSEC-2026-1122

JLSEC-2026-1129: JLSEC-2026-1129

Wed, 25 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-1129: JLSEC-2026-1129

JLSEC-2026-1121: JLSEC-2026-1121

Wed, 25 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-1121: JLSEC-2026-1121

JLSEC-2026-1128: JLSEC-2026-1128

Wed, 25 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-1128: JLSEC-2026-1128

JLSEC-2026-79: JLSEC-2026-79

Wed, 25 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-79: JLSEC-2026-79

JLSEC-2026-1127: JLSEC-2026-1127

Wed, 25 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-1127: JLSEC-2026-1127

JLSEC-2026-1132: JLSEC-2026-1132

Wed, 25 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-1132: JLSEC-2026-1132

JLSEC-2026-1125: JLSEC-2026-1125

Wed, 25 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-1125: JLSEC-2026-1125

JLSEC-2026-1126: JLSEC-2026-1126

Wed, 25 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-1126: JLSEC-2026-1126

JLSEC-2026-1131: JLSEC-2026-1131

Wed, 25 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-1131: JLSEC-2026-1131

JLSEC-2026-288: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in OSGeo gdal...

Tue, 24 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-288: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in OSGeo gdal...

JLSEC-2026-1123: JLSEC-2026-1123

Tue, 24 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-1123: JLSEC-2026-1123

JLSEC-2026-159: JLSEC-2026-159

Fri, 20 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-159: JLSEC-2026-159

JLSEC-2026-158: JLSEC-2026-158

Fri, 20 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-158: JLSEC-2026-158

JLSEC-2026-708: JLSEC-2026-708

Thu, 19 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-708: JLSEC-2026-708

JLSEC-2026-691: A stack buffer overflow vulnerability exists in wolfSSL's PKCS7 SignedData encoding functionality

Thu, 19 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-691: A stack buffer overflow vulnerability exists in wolfSSL's PKCS7 SignedData encoding functionality

JLSEC-2026-706: Out-of-bounds read in ALPN parsing due to incomplete validation

Thu, 19 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-706: Out-of-bounds read in ALPN parsing due to incomplete validation

JLSEC-2026-702: A heap-buffer-overflow vulnerability exists in wolfSSL's `wolfSSL_d2i_SSL_SESSION()` function

Thu, 19 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-702: A heap-buffer-overflow vulnerability exists in wolfSSL's wolfSSL_d2i_SSL_SESSION() function

JLSEC-2026-710: JLSEC-2026-710

Thu, 19 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-710: JLSEC-2026-710

JLSEC-2026-703: JLSEC-2026-703

Thu, 19 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-703: JLSEC-2026-703

JLSEC-2026-701: JLSEC-2026-701

Thu, 19 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-701: JLSEC-2026-701

JLSEC-2026-705: Protection mechanism failure in wolfCrypt post-quantum implementations (ML-KEM and ML-DSA) in...

Thu, 19 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-705: Protection mechanism failure in wolfCrypt post-quantum implementations (ML-KEM and ML-DSA) in...

JLSEC-2026-1242: ncurses v6.5 and v6.4 are vulnerable to Buffer Overflow in progs/infocmp.c, function...

Thu, 19 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-1242: ncurses v6.5 and v6.4 are vulnerable to Buffer Overflow in progs/infocmp.c, function...

JLSEC-2026-692: Integer underflow in wolfSSL packet sniffer <= 5.8.4 allows an attacker to cause a buffer overflow...

Thu, 19 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-692: Integer underflow in wolfSSL packet sniffer <= 5.8.4 allows an attacker to cause a buffer overflow...

JLSEC-2026-712: JLSEC-2026-712

Thu, 19 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-712: JLSEC-2026-712

JLSEC-2026-711: Stack Buffer Overflow in `wc_HpkeLabeledExtract` via Oversized ECH Config

Thu, 19 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-711: Stack Buffer Overflow in wc_HpkeLabeledExtract via Oversized ECH Config

JLSEC-2026-704: Missing required cryptographic step in the TLS 1.3 client HelloRetryRequest handshake logic in...

Thu, 19 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-704: Missing required cryptographic step in the TLS 1.3 client HelloRetryRequest handshake logic in...

JLSEC-2026-709: JLSEC-2026-709

Thu, 19 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-709: JLSEC-2026-709

JLSEC-2026-707: Two buffer overflow vulnerabilities existed in the wolfSSL CRL parser when parsing CRL numbers: a...

Thu, 19 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-707: Two buffer overflow vulnerabilities existed in the wolfSSL CRL parser when parsing CRL numbers: a...

JLSEC-2026-713: JLSEC-2026-713

Thu, 19 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-713: JLSEC-2026-713

JLSEC-2026-822: JLSEC-2026-822

Wed, 18 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-822: JLSEC-2026-822

JLSEC-2026-990: ImageMagick has a heap-buffer-overflow in NewXMLTree which could result in crash

Wed, 18 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-990: ImageMagick has a heap-buffer-overflow in NewXMLTree which could result in crash

JLSEC-2026-5: nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C

Wed, 18 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-5: nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C

JLSEC-2026-182: JLSEC-2026-182

Tue, 17 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-182: JLSEC-2026-182

JLSEC-2026-381: JLSEC-2026-381

Mon, 16 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-381: JLSEC-2026-381

JLSEC-2026-383: JLSEC-2026-383

Mon, 16 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-383: JLSEC-2026-383

JLSEC-2026-150: JLSEC-2026-150

Mon, 16 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-150: JLSEC-2026-150

JLSEC-2026-1170: JLSEC-2026-1170

Mon, 16 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-1170: JLSEC-2026-1170

JLSEC-2026-382: JLSEC-2026-382

Mon, 16 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-382: JLSEC-2026-382

JLSEC-2026-271: Issue summary: An OpenSSL TLS 1.3 server may fail to negotiate the expected preferred key exchange...

Fri, 13 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-271: Issue summary: An OpenSSL TLS 1.3 server may fail to negotiate the expected preferred key exchange...

JLSEC-2026-989: JLSEC-2026-989

Thu, 12 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-989: JLSEC-2026-989

JLSEC-2026-1270: JLSEC-2026-1270

Thu, 12 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-1270: JLSEC-2026-1270

JLSEC-2026-1269: JLSEC-2026-1269

Thu, 12 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-1269: JLSEC-2026-1269

JLSEC-2026-988: ImageMagick is vulnerable to heap buffer over-write on 32-bit systems in SFW decoder

Wed, 11 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-988: ImageMagick is vulnerable to heap buffer over-write on 32-bit systems in SFW decoder

JLSEC-2026-436: JLSEC-2026-436

Wed, 11 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-436: JLSEC-2026-436

JLSEC-2026-439: When doing a second SMB request to the same host again, curl would wrongly use a data pointer...

Wed, 11 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-439: When doing a second SMB request to the same host again, curl would wrongly use a data pointer...

JLSEC-2026-438: curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a server, even if the...

Wed, 11 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-438: curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a server, even if the...

JLSEC-2026-437: When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a redirect...

Wed, 11 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-437: When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a redirect...

JLSEC-2026-980: JLSEC-2026-980

Tue, 10 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-980: JLSEC-2026-980

JLSEC-2026-978: ImageMagick has stack write buffer overflow in MNG encoder

Tue, 10 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-978: ImageMagick has stack write buffer overflow in MNG encoder

JLSEC-2026-984: ImageMagick has heap-based buffer overflow in UHDR encoder

Tue, 10 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-984: ImageMagick has heap-based buffer overflow in UHDR encoder

JLSEC-2026-986: ImageMagick has Heap Buffer Overflow in WaveletDenoiseImage

Tue, 10 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-986: ImageMagick has Heap Buffer Overflow in WaveletDenoiseImage

JLSEC-2026-985: ImageMagick has Heap Buffer Over-Read in BilateralBlurImage

Tue, 10 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-985: ImageMagick has Heap Buffer Over-Read in BilateralBlurImage

JLSEC-2026-977: ImageMagick has a Path Policy TOCTOU symlink race bypass

Tue, 10 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-977: ImageMagick has a Path Policy TOCTOU symlink race bypass

JLSEC-2026-979: JLSEC-2026-979

Tue, 10 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-979: JLSEC-2026-979

JLSEC-2026-972: ImageMagick has Integer Overflow leading to out of bounds write in SIXEL decoder

Tue, 10 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-972: ImageMagick has Integer Overflow leading to out of bounds write in SIXEL decoder

JLSEC-2026-983: ImageMagick has stack buffer overflow in MagnifyImage

Tue, 10 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-983: ImageMagick has stack buffer overflow in MagnifyImage

JLSEC-2026-976: ImageMagick has heap use-after-free in the MSL encoder

Tue, 10 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-976: ImageMagick has heap use-after-free in the MSL encoder

JLSEC-2026-981: ImageMagick: Integer overflow in DIB coder can result in out of bounds read or write

Tue, 10 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-981: ImageMagick: Integer overflow in DIB coder can result in out of bounds read or write

JLSEC-2026-975: ImageMagick has Heap Use-After-Free in ImageMagick MSL decoder

Tue, 10 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-975: ImageMagick has Heap Use-After-Free in ImageMagick MSL decoder

JLSEC-2026-821: JLSEC-2026-821

Tue, 10 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-821: JLSEC-2026-821

JLSEC-2026-987: ImageMagick has heap buffer overflow in WriteXWDImage due to CARD32 arithmetic overflow in bytesperline calculation

Tue, 10 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-987: ImageMagick has heap buffer overflow in WriteXWDImage due to CARD32 arithmetic overflow in bytesperline calculation

JLSEC-2026-973: ImageMagick vulnerable to stack corruption through long morphology kernel names or arrays

Tue, 10 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-973: ImageMagick vulnerable to stack corruption through long morphology kernel names or arrays

JLSEC-2026-982: ImageMagick is vulnerable to Heap Overflow when writing extremely large image profile in the PNG encoder

Tue, 10 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-982: ImageMagick is vulnerable to Heap Overflow when writing extremely large image profile in the PNG encoder

JLSEC-2026-974: ImageMagick: Write heap-buffer-overflow in PCL encoder via undersized output buffer

Tue, 10 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-974: ImageMagick: Write heap-buffer-overflow in PCL encoder via undersized output buffer

JLSEC-2026-784: JLSEC-2026-784

Sun, 08 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-784: JLSEC-2026-784

JLSEC-2026-141: JLSEC-2026-141

Tue, 03 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-141: JLSEC-2026-141

JLSEC-2026-1318: JLSEC-2026-1318

Mon, 02 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-1318: JLSEC-2026-1318

JLSEC-2026-1317: JLSEC-2026-1317

Mon, 02 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-1317: JLSEC-2026-1317

JLSEC-2026-1316: JLSEC-2026-1316

Mon, 02 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-1316: JLSEC-2026-1316

JLSEC-2026-461: An integer overflow in the `tt_var_load_item_variation_store` function of the Freetype library in...

Mon, 02 Mar 2026 00:00:00 +0000

Security advisory JLSEC-2026-461: An integer overflow in the tt_var_load_item_variation_store function of the Freetype library in...

JLSEC-2026-971: ImageMagick has a heap Buffer Over-read in its DJVU image format handler

Thu, 26 Feb 2026 00:00:00 +0000

Security advisory JLSEC-2026-971: ImageMagick has a heap Buffer Over-read in its DJVU image format handler

JLSEC-2026-970: ImageMagick: Heap Buffer Over-read in WaveletDenoise when processing small images

Thu, 26 Feb 2026 00:00:00 +0000

Security advisory JLSEC-2026-970: ImageMagick: Heap Buffer Over-read in WaveletDenoise when processing small images

JLSEC-2026-425: URLs containing percent-encoded slashes (`/` or `\`) can trick wcurl into saving the output file...

Wed, 25 Feb 2026 00:00:00 +0000

Security advisory JLSEC-2026-425: URLs containing percent-encoded slashes (/ or \) can trick wcurl into saving the output file...

JLSEC-2026-953: ImageMagick's Security Policy Bypass through config/policy-secure.xml via "fd handler" leads to stdin/stdout access