# NuGet Advisories. Every NuGet Advisory we hold (.NET), newest first. ## Records, newest first (an older page) - [ImageMagick: Memory Leak in JNG encoder when a blob could not be opened](https://agentprime.io/advisories/GHSA-99w9-hv66-rfv7.md) `GHSA-99w9-hv66-rfv7`, `CVE-2026-61866` · NuGet `Magick.NET-Q16-AnyCPU` and 16 more: affected `<14.15.0`, fixed in `14.15.0` · CVSS 2.1 Low · Not analysed yet · Published 24 Jul 2026 · Tags: Denial of service - [ImageMagick: Memory Leak in hough lines operation when an operation fails](https://agentprime.io/advisories/GHSA-j8rh-v2r8-v94x.md) `GHSA-j8rh-v2r8-v94x`, `CVE-2026-61865` · NuGet `Magick.NET-Q16-AnyCPU` and 16 more: affected `<14.15.0`, fixed in `14.15.0` · CVSS 2.1 Low · Not analysed yet · Published 24 Jul 2026 · Tags: Denial of service - [ImageMagick: Memory Leak in color transformation to log colorspace when operation fails](https://agentprime.io/advisories/GHSA-7c7m-fpjw-gwcq.md) `GHSA-7c7m-fpjw-gwcq`, `CVE-2026-61864` · NuGet `Magick.NET-Q16-AnyCPU` and 16 more: affected `<14.15.0`, fixed in `14.15.0` · CVSS 2.1 Low · Not analysed yet · Published 24 Jul 2026 · Tags: Denial of service - [ImageMagick: Memory Leak in TIFF encoder when a temporary file could not be created.](https://agentprime.io/advisories/GHSA-6vxp-gfwf-hcr9.md) `GHSA-6vxp-gfwf-hcr9`, `CVE-2026-61863` · NuGet `Magick.NET-Q16-AnyCPU` and 16 more: affected `<14.15.0`, fixed in `14.15.0` · CVSS 2.1 Low · Not analysed yet · Published 24 Jul 2026 · Tags: Denial of service - [ImageMagick: Information Disclosure when printing profiles with debug enabled](https://agentprime.io/advisories/GHSA-hwf3-r46v-5ggx.md) `GHSA-hwf3-r46v-5ggx`, `CVE-2026-61862` · NuGet `Magick.NET-Q16-AnyCPU` and 16 more: affected `<14.15.0`, fixed in `14.15.0` · CVSS 2.1 Low · Not analysed yet · Published 24 Jul 2026 · Tags: Memory corruption, CWE-193 - [ImageMagick: Use-After-Free in FormatMagickCaption when memory allocation fails](https://agentprime.io/advisories/GHSA-qvxh-prvr-85w2.md) `GHSA-qvxh-prvr-85w2`, `CVE-2026-61861` · NuGet `Magick.NET-Q16-AnyCPU` and 16 more: affected `<14.15.0`, fixed in `14.15.0` · CVSS 6.3 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: Memory corruption - [ImageMagick: Use-After-Free when freetype initialization fails](https://agentprime.io/advisories/GHSA-6jwg-7q3p-5fqm.md) `GHSA-6jwg-7q3p-5fqm`, `CVE-2026-61860` · NuGet `Magick.NET-Q16-AnyCPU` and 16 more: affected `<14.15.0`, fixed in `14.15.0` · CVSS 6.3 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: Memory corruption - [ImageMagick: Policy Bypass in script operation due to missing checks](https://agentprime.io/advisories/GHSA-vghg-5jrg-2398.md) `GHSA-vghg-5jrg-2398`, `CVE-2026-61859` · NuGet `Magick.NET-Q16-AnyCPU` and 16 more: affected `<14.15.0`, fixed in `14.15.0` · CVSS 4.8 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: Path traversal, Broken access control - [ImageMagick: Policy Bypass in APNG encoder and delegates due to a missing check](https://agentprime.io/advisories/GHSA-v3j6-27vc-7pw2.md) `GHSA-v3j6-27vc-7pw2`, `CVE-2026-61858` · NuGet `Magick.NET-Q16-AnyCPU` and 16 more: affected `<14.15.0`, fixed in `14.15.0` · CVSS 4.8 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: Path traversal, Broken access control - [ImageMagick: Heap-use-after-free via XMP profile could result in a crash](https://agentprime.io/advisories/GHSA-qh5g-q395-cx4j.md) `GHSA-qh5g-q395-cx4j`, `CVE-2026-61857` · NuGet `Magick.NET-Q16-AnyCPU` and 16 more: affected `<14.15.0`, fixed in `14.15.0` · CVSS 6.3 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: Denial of service, Memory corruption, CWE-252, CWE-703 - [ImageMagick: Code injection in HTML encoder due to incomplete fix of CVE-2026-25797](https://agentprime.io/advisories/GHSA-hc76-7mpc-qjqh.md) `GHSA-hc76-7mpc-qjqh` · NuGet `Magick.NET-Q16-AnyCPU` and 16 more: affected `<14.10.3`, fixed in `14.10.3` · CVSS 5.7 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: Cross-site scripting (XSS), CWE-116 - [ImageMagick: Policy Bypass due to an incomplete fix of CVE-2026-49219](https://agentprime.io/advisories/GHSA-56m6-8q75-f2rw.md) `GHSA-56m6-8q75-f2rw` · NuGet `Magick.NET-Q16-AnyCPU` and 16 more: affected `<14.15.0`, fixed in `14.15.0` · CVSS 4.7 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: Path traversal, Race condition, Broken access control - [ImageMagick: Policy Bypass possible with matrix-backed operations](https://agentprime.io/advisories/GHSA-rvhp-75f6-9jqh.md) `GHSA-rvhp-75f6-9jqh`, `CVE-2026-61465` · NuGet `Magick.NET-Q16-AnyCPU` and 16 more: affected `<14.15.0`, fixed in `14.15.0` · CVSS 4.8 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: Broken access control, Denial of service - [ImageMagick: Policy Bypass in concatenate operation due to missing checks](https://agentprime.io/advisories/GHSA-82mp-vp5c-9pf7.md) `GHSA-82mp-vp5c-9pf7`, `CVE-2026-55628` · NuGet `Magick.NET-Q16-AnyCPU` and 16 more: affected `<14.15.0`, fixed in `14.15.0` · CVSS 5.5 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: Path traversal, Broken access control - [ImageMagick: Heap Buffer Over-Write in JP2 encoder when due to incorrect handling of arguments](https://agentprime.io/advisories/GHSA-c4v7-w88g-m6c4.md) `GHSA-c4v7-w88g-m6c4`, `CVE-2026-55597` · NuGet `Magick.NET-Q16-AnyCPU` and 16 more: affected `<14.15.0`, fixed in `14.15.0` · CVSS 5.5 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: Memory corruption, CWE-682 - [ImageMagick: Infinite Loop in connected-components when providing invalid arguments](https://agentprime.io/advisories/GHSA-qhmf-7fc4-8q3h.md) `GHSA-qhmf-7fc4-8q3h`, `CVE-2026-55595` · NuGet `Magick.NET-Q16-AnyCPU` and 16 more: affected `<14.15.0`, fixed in `14.15.0` · CVSS 4.7 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: Denial of service - [ImageMagick: Stack Overflow in MVG decoder due to missing depth check.](https://agentprime.io/advisories/GHSA-mx48-2qq3-23hf.md) `GHSA-mx48-2qq3-23hf`, `CVE-2026-55594` · NuGet `Magick.NET-Q16-AnyCPU` and 16 more: affected `<14.15.0`, fixed in `14.15.0` · CVSS 5.3 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: Denial of service - [ImageMagick: Use-After-Free in crafted 8BIM when identifying an image](https://agentprime.io/advisories/GHSA-ff5c-8x9r-8qcw.md) `GHSA-ff5c-8x9r-8qcw`, `CVE-2026-55510` · NuGet `Magick.NET-Q16-AnyCPU` and 16 more: affected `<14.15.0`, fixed in `14.15.0` · CVSS 5.5 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: Memory corruption - [ImageMagick: Information Disclosure in MNG decoder because allocated memory is left unchanged](https://agentprime.io/advisories/GHSA-8g53-9m3c-69xg.md) `GHSA-8g53-9m3c-69xg`, `CVE-2026-53467` · NuGet `Magick.NET-Q16-AnyCPU` and 16 more: affected `<14.15.0`, fixed in `14.15.0` · CVSS 5.3 Medium · Not analysed yet · Published 23 Jul 2026 · Tags: Information disclosure, Memory corruption - [Microsoft Security Advisory CVE-2026-56170 – .NET Denial of Service Vulnerability](https://agentprime.io/advisories/GHSA-j8gr-8fp3-5q5h.md) `GHSA-j8gr-8fp3-5q5h`, `BIT-dotnet-2026-56170`, `BIT-dotnet-sdk-2026-56170`, `CVE-2026-56170` · NuGet `Microsoft.AspNetCore.App.Runtime.linux-arm` and 11 more: affected `>=8.0.0, <8.0.26 || >=9.0.0, <9.0.15 || >=10.0.0, <10.0.6`, fixed in `8.0.26`, `9.0.15`, `10.0.6` · CVSS 7.5 High · Not analysed yet · Published 21 Jul 2026 · Tags: Denial of service - [Microsoft Security Advisory CVE-2026-50526 – .NET Tampering Vulnerability](https://agentprime.io/advisories/GHSA-55jh-fwmh-39m4.md) `GHSA-55jh-fwmh-39m4`, `BIT-dotnet-2026-50526`, `BIT-dotnet-sdk-2026-50526`, `CVE-2026-50526` · NuGet `Microsoft.NET.Build.Containers`: affected `>=8.0.0, <8.0.29 || >=9.0.0, <9.0.18 || >=10.0.0, <10.0.10`, fixed in `8.0.29`, `9.0.18`, `10.0.10` · CVSS 7.0 High · Not analysed yet · Published 21 Jul 2026 · Tags: Path traversal, CWE-345 - [Microsoft Security Advisory CVE-2026-47300 – .NET Elevation of Privilege Vulnerability](https://agentprime.io/advisories/GHSA-8prm-248r-h957.md) `GHSA-8prm-248r-h957`, `BIT-dotnet-2026-47300`, `BIT-dotnet-sdk-2026-47300`, `CVE-2026-47300` · NuGet `Microsoft.AspNetCore.Authentication.Negotiate`: affected `>=8.0.0, <8.0.29 || >=9.0.0, <9.0.18 || >=10.0.0, <10.0.10`, fixed in `8.0.29`, `9.0.18`, `10.0.10` · CVSS 8.8 High · Not analysed yet · Published 21 Jul 2026 · Tags: Authentication bypass - [Microsoft Security Advisory CVE-2026-47303 – .NET Elevation of Privilege Vulnerability](https://agentprime.io/advisories/GHSA-2p3q-h3hg-jcqq.md) `GHSA-2p3q-h3hg-jcqq`, `BIT-dotnet-2026-47303`, `BIT-dotnet-sdk-2026-47303`, `CVE-2026-47303` · NuGet `Microsoft.AspNetCore.Authentication.Negotiate`: affected `>=8.0.0, <8.0.29 || >=9.0.0, <9.0.18 || >=10.0.0, <10.0.10`, fixed in `8.0.29`, `9.0.18`, `10.0.10` · CVSS 8.8 High · Not analysed yet · Published 21 Jul 2026 · Tags: Other injection, Broken access control, CWE-302 - [Microsoft Security Advisory CVE-2026-50527 – .NET Denial of Service Vulnerability](https://agentprime.io/advisories/GHSA-mmjf-rqrv-855v.md) `GHSA-mmjf-rqrv-855v`, `BIT-dotnet-2026-50527`, `BIT-dotnet-sdk-2026-50527`, `CVE-2026-50527` · NuGet `System.Security.Cryptography.Xml`: affected `>=8.0.0, <8.0.4 || >=9.0.0, <9.0.18 || >=10.0.0, <10.0.10`, fixed in `8.0.4`, `9.0.18`, `10.0.10` · CVSS 7.5 High · Not analysed yet · Published 21 Jul 2026 · Tags: Memory corruption - [Microsoft Security Advisory CVE-2026-50650 – .NET Elevation of Privilege Vulnerability](https://agentprime.io/advisories/GHSA-2969-4q4w-w5h3.md) `GHSA-2969-4q4w-w5h3`, `BIT-dotnet-2026-50650`, `BIT-dotnet-sdk-2026-50650`, `CVE-2026-50650` · NuGet `Microsoft.WindowsDesktop.App.Runtime.win-x64` and 2 more: affected `>=8.0.0, <8.0.29 || >=9.0.0, <9.0.18 || >=10.0.0, <10.0.10`, fixed in `8.0.29`, `9.0.18`, `10.0.10` · CVSS 7.8 High · Not analysed yet · Published 21 Jul 2026 · Tags: Code injection - [Microsoft Security Advisory CVE-2026-50651 – .NET Denial of Service Vulnerability](https://agentprime.io/advisories/GHSA-wp74-jgxh-gv4q.md) `GHSA-wp74-jgxh-gv4q`, `BIT-dotnet-2026-50651`, `BIT-dotnet-sdk-2026-50651`, `CVE-2026-50651` · NuGet `Microsoft.NetCore.App.Runtime.linux-arm` and 11 more: affected `>=8.0.0, <8.0.29 || >=9.0.0, <9.0.18 || >=10.0.0, <10.0.10`, fixed in `8.0.29`, `9.0.18`, `10.0.10` · CVSS 7.5 High · Not analysed yet · Published 20 Jul 2026 · Tags: Denial of service - [Microsoft Security Advisory CVE-2026-50659 – .NET Spoofing Vulnerability](https://agentprime.io/advisories/GHSA-74jp-vm22-8q8x.md) `GHSA-74jp-vm22-8q8x`, `BIT-dotnet-2026-50659`, `BIT-dotnet-sdk-2026-50659`, `CVE-2026-50659` · NuGet `Microsoft.NetCore.App.Runtime.linux-arm` and 11 more: affected `>=8.0.0, <8.0.29 || >=9.0.0, <9.0.18 || >=10.0.0, <10.0.10`, fixed in `8.0.29`, `9.0.18`, `10.0.10` · CVSS 6.5 Medium · Not analysed yet · Published 20 Jul 2026 · Tags: CWE-116 - [Microsoft Security Advisory CVE-2026-50525 – .NET Denial of Service Vulnerability](https://agentprime.io/advisories/GHSA-8q5v-6pqq-x66h.md) `GHSA-8q5v-6pqq-x66h`, `BIT-dotnet-2026-50525`, `BIT-dotnet-sdk-2026-50525`, `CVE-2026-50525` · NuGet `System.Security.Cryptography.Xml`: affected `>=8.0.0, <8.0.4 || >=9.0.0, <9.0.18 || >=10.0.0, <10.0.10`, fixed in `8.0.4`, `9.0.18`, `10.0.10` · CVSS 7.5 High · Not analysed yet · Published 20 Jul 2026 · Tags: Denial of service - [Microsoft Security Advisory CVE-2026-50528 – .NET Security Feature Bypass Vulnerability](https://agentprime.io/advisories/GHSA-qvw7-jm5c-6hqw.md) `GHSA-qvw7-jm5c-6hqw`, `BIT-dotnet-2026-50528`, `BIT-dotnet-sdk-2026-50528`, `CVE-2026-50528` · NuGet `Microsoft.NetCore.App.Runtime.linux-arm` and 11 more: affected `>=8.0.0, <8.0.29 || >=9.0.0, <9.0.18 || >=10.0.0, <10.0.10`, fixed in `8.0.29`, `9.0.18`, `10.0.10` · CVSS 8.2 High · Not analysed yet · Published 20 Jul 2026 · Tags: Broken access control, CWE-302, CWE-636 - [Microsoft Security Advisory CVE-2026-50648 – .NET Denial of Service Vulnerability](https://agentprime.io/advisories/GHSA-23rf-6693-g89p.md) `GHSA-23rf-6693-g89p`, `BIT-dotnet-2026-50648`, `BIT-dotnet-sdk-2026-50648`, `CVE-2026-50648` · NuGet `System.Security.Cryptography.Xml`: affected `>=8.0.0, <8.0.4 || >=9.0.0, <9.0.18 || >=10.0.0, <10.0.10`, fixed in `8.0.4`, `9.0.18`, `10.0.10` · CVSS 7.5 High · Not analysed yet · Published 20 Jul 2026 · Tags: Denial of service - [Microsoft Security Advisory CVE-2026-50524 – .NET Denial of Service Vulnerability](https://agentprime.io/advisories/GHSA-w7cw-xp7h-6j5j.md) `GHSA-w7cw-xp7h-6j5j`, `BIT-dotnet-2026-50524`, `BIT-dotnet-sdk-2026-50524`, `CVE-2026-50524` · NuGet `Microsoft.NetCore.App.Runtime.linux-arm` and 11 more: affected `>=8.0.0, <8.0.29 || >=9.0.0, <9.0.18 || >=10.0.0, <10.0.10`, fixed in `8.0.29`, `9.0.18`, `10.0.10` · CVSS 7.5 High · Not analysed yet · Published 20 Jul 2026 · Tags: CWE-1287 - [Microsoft Security Advisory CVE-2026-47304 – .NET Security Feature Bypass Vulnerability](https://agentprime.io/advisories/GHSA-g8r8-53c2-pm3f.md) `GHSA-g8r8-53c2-pm3f`, `BIT-dotnet-2026-47304`, `BIT-dotnet-sdk-2026-47304`, `CVE-2026-47304` · NuGet `System.Security.Cryptography.Xml`: affected `>=8.0.0, <8.0.4 || >=9.0.0, <9.0.18 || >=10.0.0, <10.0.10`, fixed in `8.0.4`, `9.0.18`, `10.0.10` · CVSS 8.1 High · Not analysed yet · Published 20 Jul 2026 · Tags: Weak cryptography or TLS, CWE-345 - [Microsoft Security Advisory CVE-2026-47302 – .NET Denial of Service Vulnerability](https://agentprime.io/advisories/GHSA-cvvh-rhrc-wg4q.md) `GHSA-cvvh-rhrc-wg4q`, `BIT-dotnet-2026-47302`, `BIT-dotnet-sdk-2026-47302`, `CVE-2026-47302` · NuGet `System.Security.Cryptography.Xml` and 12 more: affected `>=8.0.0, <8.0.4 || >=9.0.0, <9.0.18 || >=10.0.0, <10.0.10`, fixed in `8.0.4`, `9.0.18`, `10.0.10` · CVSS 7.5 High · Not analysed yet · Published 20 Jul 2026 · Tags: Denial of service - [Microsoft Security Advisory CVE-2026-57108 – .NET Denial of Service Vulnerability](https://agentprime.io/advisories/GHSA-rp2p-6cmp-jxj9.md) `GHSA-rp2p-6cmp-jxj9`, `BIT-dotnet-2026-57108`, `BIT-dotnet-sdk-2026-57108`, `CVE-2026-57108` · NuGet `Microsoft.NetCore.App.Runtime.linux-arm` and 7 more: affected `>=8.0.0, <8.0.29 || >=9.0.0, <9.0.18 || >=10.0.0, <10.0.10`, fixed in `8.0.29`, `9.0.18`, `10.0.10` · CVSS 7.5 High · Not analysed yet · Published 20 Jul 2026 · Tags: Memory corruption - [AngleSharp HTML5 Spec Compliance: mXSS via annotation-xml HTML Integration Point Bypass](https://agentprime.io/advisories/GHSA-pgww-w46g-26qg.md) `GHSA-pgww-w46g-26qg`, `CVE-2026-54570` · NuGet `AngleSharp`: affected `<1.5.0`, fixed in `1.5.0` · CVSS 6.9 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: Cross-site scripting (XSS) - [Prompty: Arbitrary file read via file reference expansion](https://agentprime.io/advisories/GHSA-wxhm-2mq7-7697.md) `GHSA-wxhm-2mq7-7697`, `CVE-2026-53598`, `PYSEC-2026-3538` · PyPI `prompty` and 3 more: affected `<2.0.0b2`, fixed in `2.0.0b2` · CVSS 7.5 High · Not analysed yet · Published 17 Jul 2026 · Tags: Path traversal, Information disclosure - [dd-trace-dotnet: Improper parsing of W3C baggage headers may lead to DoS](https://agentprime.io/advisories/GHSA-38wr-vpc7-2mp4.md) `GHSA-38wr-vpc7-2mp4`, `CVE-2026-50273` · NuGet `Datadog.Trace` and 1 more: affected `<3.43.0`, fixed in `3.43.0` · CVSS 7.5 High · Not analysed yet · Published 15 Jul 2026 · Tags: Denial of service - [Umbraco.AI discloses sensitive application configuration values](https://agentprime.io/advisories/GHSA-q3v2-xj35-9grx.md) `GHSA-q3v2-xj35-9grx` · NuGet `Umbraco.AI`: affected `<1.14.0`, fixed in `1.14.0` · CVSS 4.9 Medium · Not analysed yet · Published 14 Jul 2026 · Tags: Information disclosure - [Scriban: Template Writes to Arbitrary CLR Properties via \`TypedObjectAccessor\` (Mass Assignment + \`private\` / \`init\` / \`internal\` Setter Bypass)](https://agentprime.io/advisories/GHSA-7jvp-hj45-2f2m.md) `GHSA-7jvp-hj45-2f2m`, `CVE-2026-73061` · NuGet `Scriban`: affected `<7.2.2`, fixed in `7.2.2` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Jul 2026 · Tags: Broken access control - [Steeltoe: OAEP setting silently selects PKCS#1 v1.5 padding](https://agentprime.io/advisories/GHSA-4j9m-h44m-2hv8.md) `GHSA-4j9m-h44m-2hv8`, `CVE-2026-50268` · NuGet `Steeltoe.Configuration.Encryption`: affected `>=4.0.0, <4.2.0`, fixed in `4.2.0` · CVSS 1.9 Low · Not analysed yet · Published 2 Jul 2026 · Tags: Weak cryptography or TLS, CWE-256 - [Steeltoe: TLS private keys written to /tmp with default permissions, never deleted](https://agentprime.io/advisories/GHSA-rxrh-4j9h-xgg9.md) `GHSA-rxrh-4j9h-xgg9`, `CVE-2026-50267` · NuGet `Steeltoe.Configuration.Abstractions`: affected `>=4.0.0, <4.2.0`, fixed in `4.2.0` · CVSS 4.7 Medium · Not analysed yet · Published 2 Jul 2026 · Tags: Information disclosure, Broken access control - [Steeltoe's static JWKS cache shared across schemes and never invalidated](https://agentprime.io/advisories/GHSA-7fqc-p256-7pwj.md) `GHSA-7fqc-p256-7pwj`, `CVE-2026-50202` · NuGet `Steeltoe.Security.Authentication.JwtBearer` and 2 more: affected `<4.2.0`, fixed in `4.2.0` · CVSS 5.9 Medium · Not analysed yet · Published 2 Jul 2026 · Tags: Information disclosure - [Steeltoe's sensitive actuators (heapdump/env) only require Restricted permission](https://agentprime.io/advisories/GHSA-227r-jm2g-7cp4.md) `GHSA-227r-jm2g-7cp4`, `CVE-2026-50201` · NuGet `Steeltoe.Management.Endpoint` and 1 more: affected `<4.2.0`, fixed in `4.2.0` · CVSS 6.5 Medium · Not analysed yet · Published 2 Jul 2026 · Tags: Privilege escalation, Broken access control - [Steeltoe's env sanitizer misses connection strings — leaks embedded DB passwords](https://agentprime.io/advisories/GHSA-q62h-354g-5r85.md) `GHSA-q62h-354g-5r85`, `CVE-2026-50200` · NuGet `Steeltoe.Management.Endpoint` and 1 more: affected `<4.2.0`, fixed in `4.2.0` · CVSS 7.5 High · Not analysed yet · Published 2 Jul 2026 · Tags: Information disclosure, Weak cryptography or TLS - [Steeltoe.Discovery.Eureka: Unrecognized DataCenterInfo.Name poisons entire registry fetch](https://agentprime.io/advisories/GHSA-j8ph-6fxj-g533.md) `GHSA-j8ph-6fxj-g533`, `CVE-2026-50196` · NuGet `Steeltoe.Discovery.Eureka`: affected `<3.4.0 || >=4.0.0, <4.2.0`, fixed in `3.4.0`, `4.2.0` · CVSS 7.5 High · Not analysed yet · Published 2 Jul 2026 · Tags: Denial of service, CWE-20 - [Steeltoe vulnerable to management-port isolation bypass via spoofed Host header](https://agentprime.io/advisories/GHSA-58f6-6rj2-3v8r.md) `GHSA-58f6-6rj2-3v8r`, `CVE-2026-50194` · NuGet `Steeltoe.Management.Endpoint` and 1 more: affected `<4.2.0`, fixed in `4.2.0` · CVSS 8.2 High · Not analysed yet · Published 2 Jul 2026 · Tags: Authentication bypass, Broken access control - [CefSharp.Common: \`FolderSchemeHandlerFactory\` path boundary check can expose files outside the configured root folder](https://agentprime.io/advisories/GHSA-85jm-cwp2-mvpv.md) `GHSA-85jm-cwp2-mvpv`, `CVE-2026-48796` · NuGet `CefSharp.Common`: affected `<148.0.90`, fixed in `148.0.90` · CVSS 5.3 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: Path traversal - [Microsoft.OpenAPI: Circular schema references may terminate OpenAPI parsing](https://agentprime.io/advisories/GHSA-v5pm-xwqc-g5wc.md) `GHSA-v5pm-xwqc-g5wc`, `CVE-2026-49451` · NuGet `Microsoft.OpenApi`: affected `>=2.0.0-preview.11, <2.7.5 || >=3.0.0, <3.5.4`, fixed in `2.7.5`, `3.5.4` · CVSS 7.5 High · Not analysed yet · Published 30 Jun 2026 · Tags: Denial of service - [ImageMagick has a Heap Buffer Over-Write in SF3 encoder when writing multi-frame image](https://agentprime.io/advisories/GHSA-44cp-c3ww-9rv5.md) `GHSA-44cp-c3ww-9rv5`, `CVE-2026-53465` · NuGet `Magick.NET-Q16-AnyCPU` and 16 more: affected `<14.14.0`, fixed in `14.14.0` · CVSS 6.2 Medium · Not analysed yet · Published 26 Jun 2026 · Tags: Memory corruption - [ImageMagick: Memory Leak in wand option parser when providing invalid arguments](https://agentprime.io/advisories/GHSA-j989-f892-2335.md) `GHSA-j989-f892-2335`, `CVE-2026-53464` · NuGet `Magick.NET-Q16-AnyCPU` and 16 more: affected `<14.14.0`, fixed in `14.14.0` · CVSS 4.0 Medium · Not analysed yet · Published 26 Jun 2026 · Tags: Denial of service - [Scriban: ExpressionDepthLimit guard is non-enforcing — parser-recursion DoS in 6.6.0–7.2.0 (incomplete fix for GHSA-wgh7-7m3c-fx25 / GHSA-p6q4-fgr8-vx4p)](https://agentprime.io/advisories/GHSA-6q7j-xr26-3h2c.md) `GHSA-6q7j-xr26-3h2c`, `CVE-2026-74783` · NuGet `Scriban` and 1 more: affected `>=6.6.0, <7.2.1`, fixed in `7.2.1` · CVSS 8.7 High · Not analysed yet · Published 26 Jun 2026 · Tags: Denial of service - [Scriban: array \* int (ScriptArray\.TryEvaluate) bypasses LoopLimit — incomplete fix for GHSA-c875-h985-hvrc, missed sibling of GHSA-24c8-4792-22hx](https://agentprime.io/advisories/GHSA-q6rr-fm2g-g5x8.md) `GHSA-q6rr-fm2g-g5x8`, `CVE-2026-73062` · NuGet `Scriban` and 1 more: affected `>=3.0.0, <7.2.1`, fixed in `7.2.1` · CVSS 8.7 High · Not analysed yet · Published 26 Jun 2026 · Tags: Denial of service - [ImageMagick has Null Pointer Dereference caused by the distort operation when passing incorrect arguments](https://agentprime.io/advisories/GHSA-p9rq-q46c-g4x6.md) `GHSA-p9rq-q46c-g4x6`, `CVE-2026-53463` · NuGet `Magick.NET-Q16-AnyCPU` and 16 more: affected `<14.14.0`, fixed in `14.14.0` · CVSS 4.3 Medium · Not analysed yet · Published 26 Jun 2026 · Tags: Memory corruption - [ImageMagick has a Use-After-Free when allocation in CheckPrimitiveExtent fails](https://agentprime.io/advisories/GHSA-px7q-ggqj-hcf2.md) `GHSA-px7q-ggqj-hcf2`, `CVE-2026-53462` · NuGet `Magick.NET-Q16-AnyCPU` and 16 more: affected `<14.14.0`, fixed in `14.14.0` · CVSS 5.9 Medium · Not analysed yet · Published 26 Jun 2026 · Tags: Memory corruption - [ImageMagick has out-of-bounds write in ICON decoder due to incorrect loop](https://agentprime.io/advisories/GHSA-g22q-f7gc-5jhr.md) `GHSA-g22q-f7gc-5jhr`, `CVE-2026-53461` · NuGet `Magick.NET-Q16-AnyCPU` and 16 more: affected `<14.14.0`, fixed in `14.14.0` · CVSS 7.5 High · Not analysed yet · Published 25 Jun 2026 · Tags: Memory corruption - [ImageMagick: Policy Bypass can Trigger an Out-of-Memory condition](https://agentprime.io/advisories/GHSA-q62c-h75r-2xhc.md) `GHSA-q62c-h75r-2xhc`, `CVE-2026-53460` · NuGet `Magick.NET-Q16-AnyCPU` and 16 more: affected `<14.14.0`, fixed in `14.14.0` · CVSS 7.5 High · Not analysed yet · Published 25 Jun 2026 · Tags: Denial of service - [ImageMagick: Policy Bypass can read disallowed files via symlink](https://agentprime.io/advisories/GHSA-xcjm-wqff-m669.md) `GHSA-xcjm-wqff-m669`, `CVE-2026-49219` · NuGet `Magick.NET-Q16-AnyCPU` and 16 more: affected `<14.14.0`, fixed in `14.14.0` · CVSS 5.5 Medium · Not analysed yet · Published 25 Jun 2026 · Tags: Path traversal, Command injection, Information disclosure, Broken access control - [ImageMagick: Policy Bypass in DCM decoder could result in image with invalid dimensions](https://agentprime.io/advisories/GHSA-8pj9-6897-74xc.md) `GHSA-8pj9-6897-74xc`, `CVE-2026-49218` · NuGet `Magick.NET-Q16-AnyCPU` and 16 more: affected `<14.14.0`, fixed in `14.14.0` · CVSS 7.5 High · Not analysed yet · Published 25 Jun 2026 · Tags: CWE-20, CWE-1284 - [ImageMagick has a Heap Buffer Over-Write in MAT decoder on 32-bit systems](https://agentprime.io/advisories/GHSA-4v89-6mgq-6rgc.md) `GHSA-4v89-6mgq-6rgc`, `CVE-2026-48994` · NuGet `Magick.NET-Q16-AnyCPU` and 16 more: affected `<14.14.0`, fixed in `14.14.0` · CVSS 5.9 Medium · Not analysed yet · Published 25 Jun 2026 · Tags: Memory corruption - [ImageMagick Vulnerable to Stack Overflow in its MVG Decoder](https://agentprime.io/advisories/GHSA-h36c-3666-h489.md) `GHSA-h36c-3666-h489`, `CVE-2026-48734` · NuGet `Magick.NET-Q16-AnyCPU` and 16 more: affected `<14.14.0`, fixed in `14.14.0` · CVSS 5.5 Medium · Not analysed yet · Published 25 Jun 2026 · Tags: Denial of service Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .