Veille CVE

Jeudi 2 juillet 2026

10 CVE

Critique 0 Élevée 2 Moyenne 8 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Coder coder » ✕
  1. CVE-2026-9002 6.5 Moyenne

    IBM WebSphere Extreme Scale

    IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 could allow an adjacent attacker to cause a denial of service due to improper validation in the XDF decoder. The application processes deeply nested Protocol Buffers messages and attacker-controlled length prefixes without sufficient bounds checking, which may allow an attacker on the same network to trigger a StackOverflowError or OutOfMemoryError, resulting in a crash of the WebSphere Application Server JVM.

  2. CVE-2026-53466 6.5 Moyenne

    ImageMagick · Imagemagick imagemagick

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, an integer overflow in the XCF decoder can result in an out of bounds read when a crafted image is read, potentially resulting in a crash. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26.

  3. CVE-2026-53467 5.3 Moyenne

    ImageMagick · Imagemagick imagemagick

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, the MNG decoder contains a possible heap information disclosure vulnerability because part of the pixels are left unchanged. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26.

  4. CVE-2026-55577 5.9 Moyenne

    ImageMagick · Imagemagick imagemagick

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, a heap buffer overflow occurs in the MVG decoder that could result in an out of bounds write when processing a crafted image. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26.

  5. CVE-2026-55594 5.3 Moyenne

    ImageMagick · Imagemagick imagemagick

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, a missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26.

  6. CVE-2026-55597 5.5 Moyenne

    ImageMagick · Imagemagick imagemagick

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-26, an incorrect handling of arguments can cause a heap buffer over-write in the JP2 encoder. This issue has been fixed in version7.1.2-26.

  7. CVE-2026-56365 5.3 Moyenne

    ImageMagick · Imagemagick imagemagick

    ImageMagick before 7.1.2-19 contains a memory leak vulnerability in the PNG encoder when writing MNG images. Attackers can trigger the encoder failure condition to exhaust memory resources and cause denial of service.

  8. CVE-2026-56371 5.3 Moyenne

    ImageMagick · Imagemagick imagemagick

    ImageMagick before 7.1.2-15 and 6.9.13-40 contains a memory leak in coders/txt.c when processing TXT files with texture attributes: the texture object allocated via ReadImage is not released when GetTypeMetrics fails, leaking memory each time a crafted TXT file with a texture attribute is processed.

  9. CVE-2026-39448 7.5 Élevée

    CoderPress NOWPayments for WooCommerce

    Unauthenticated Broken Access Control in NOWPayments for WooCommerce <= 1.4.0 versions.

  10. CVE-2026-14181 7.5 Élevée

    @fastify/middie · Fastify fastify\/middie

    @fastify/middie versions 9.1.0 through 9.3.2 fail to guard the URL normalization step used by the standalone engine when incoming request paths contain malformed percent-encoded sequences. Inputs such as an incomplete percent escape or a truncated multibyte sequence cause the underlying decoder to throw synchronously, and the exception escapes the middie normalize step and terminates the Node.js process. The bypass affects applications that call middie.run directly on the standalone engine API, causing an immediate denial of service for all connected clients until restart. Applications using the Fastify plugin path are not affected because Fastifys error handler catches the exception. Patches: upgrade to @fastify/middie 9.3.3. Workarounds: migrate from the standalone engine API to the Fastify plugin path, where the framework error handler catches the exception.