# NuGet Advisories. Every NuGet Advisory we hold (.NET), newest first. ## Records, newest first (an older page) - [Duplicate Advisory: Microsoft Security Advisory CVE-2026-26131 – .NET Elevation of Privilege Vulnerability](https://agentprime.io/advisories/GHSA-387c-qmrw-59qv.md) `GHSA-387c-qmrw-59qv` · NuGet `Microsoft.NetCore.App.Runtime.linux-arm` and 5 more: affected `>=10.0.0, <10.0.4`, fixed in `10.0.4` · CVSS 7.8 High · Withdrawn · Not analysed yet · Published 10 Mar 2026 · Tags: Broken access control - [MimeKit has CRLF Injection in Quoted Local-Part that Enables SMTP Command Injection and Email Forgery](https://agentprime.io/advisories/GHSA-g7hc-96xr-gvvx.md) `GHSA-g7hc-96xr-gvvx`, `CVE-2026-30227` · NuGet `MimeKit`: affected `<4.15.1`, fixed in `4.15.1` · CVSS 6.9 Medium · Not analysed yet · Published 5 Mar 2026 · Tags: Other injection - [Umbraco.Engage.Forms Allows Unauthorized Access to Multiple API Endpoints](https://agentprime.io/advisories/GHSA-86vq-ccwf-rm62.md) `GHSA-86vq-ccwf-rm62`, `CVE-2026-27449` · NuGet `Umbraco.Engage.Forms`: affected `>=16.0.0, <16.2.1 || >=17.0.0, <17.1.1`, fixed in `16.2.1`, `17.1.1` · CVSS 7.5 High · Not analysed yet · Published 27 Feb 2026 · Tags: Broken access control, Authentication bypass - [ImageMagick has a heap Buffer Over-read in its DJVU image format handler](https://agentprime.io/advisories/GHSA-r99p-5442-q2x2.md) `GHSA-r99p-5442-q2x2`, `CVE-2026-27799` · NuGet `Magick.NET-Q16-AnyCPU` and 18 more: affected `<14.10.3`, fixed in `14.10.3` · CVSS 4.0 Medium · Not analysed yet · Published 25 Feb 2026 · Tags: Memory corruption, CWE-126 - [ImageMagick: Heap Buffer Over-read in WaveletDenoise when processing small images](https://agentprime.io/advisories/GHSA-qpgx-jfcq-r59f.md) `GHSA-qpgx-jfcq-r59f`, `CVE-2026-27798` · NuGet `Magick.NET-Q16-AnyCPU` and 18 more: affected `<14.10.3`, fixed in `14.10.3` · CVSS 4.0 Medium · Not analysed yet · Published 25 Feb 2026 · Tags: Memory corruption, CWE-126 - [ImageMagick: Heap-based Buffer Overflow in GetPixelIndex due to metadata-cache desynchronization](https://agentprime.io/advisories/GHSA-gq5v-qf8q-fp77.md) `GHSA-gq5v-qf8q-fp77`, `CVE-2026-56362` · NuGet `Magick.NET-Q16-AnyCPU` and 18 more: affected `<14.10.3`, fixed in `14.10.3` · CVSS 2.1 Low · Not analysed yet · Published 25 Feb 2026 · Tags: Memory corruption - [ImageMagick: Memory Leak in multiple coders that write raw pixel data](https://agentprime.io/advisories/GHSA-wfx3-6g53-9fgc.md) `GHSA-wfx3-6g53-9fgc`, `CVE-2026-56368` · NuGet `Magick.NET-Q16-AnyCPU` and 18 more: affected `<14.10.3`, fixed in `14.10.3` · CVSS 6.3 Medium · Not analysed yet · Published 25 Feb 2026 · Tags: Denial of service - [ImageMagick: Memory leak in coders/txt.c without freetype](https://agentprime.io/advisories/GHSA-3q5f-gmjc-38r8.md) `GHSA-3q5f-gmjc-38r8`, `CVE-2026-56371` · NuGet `Magick.NET-Q16-AnyCPU` and 18 more: affected `<14.10.3`, fixed in `14.10.3` · CVSS 6.9 Medium · Not analysed yet · Published 25 Feb 2026 · Tags: Denial of service - [ImageMagick: SVG-to-MVG Command Injection via coders/svg.c](https://agentprime.io/advisories/GHSA-xpg8-7m6m-jf56.md) `GHSA-xpg8-7m6m-jf56`, `CVE-2026-56379` · NuGet `Magick.NET-Q16-HDRI-AnyCPU` and 18 more: affected `<14.10.3`, fixed in `14.10.3` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Feb 2026 · Tags: Command injection, CWE-116 - [ImageMagick: Malicious PCD files trigger 1‑byte heap Out-of-bounds Read and DoS](https://agentprime.io/advisories/GHSA-wgxp-q8xq-wpp9.md) `GHSA-wgxp-q8xq-wpp9`, `CVE-2026-56378` · NuGet `Magick.NET-Q16-AnyCPU` and 18 more: affected `<14.10.3`, fixed in `14.10.3` · CVSS 6.3 Medium · Not analysed yet · Published 25 Feb 2026 · Tags: Memory corruption - [mageMagick has a possible use-after-free write in its PDB decoder](https://agentprime.io/advisories/GHSA-3j4x-rwrx-xxj9.md) `GHSA-3j4x-rwrx-xxj9`, `CVE-2026-56373` · NuGet `Magick.NET-Q16-AnyCPU` and 18 more: affected `<14.10.3`, fixed in `14.10.3` · CVSS 6.3 Medium · Not analysed yet · Published 25 Feb 2026 · Tags: Memory corruption - [ImageMagick has a possible heap Use After Free vulnerability in its meta coder](https://agentprime.io/advisories/GHSA-2gq3-ww97-wfjm.md) `GHSA-2gq3-ww97-wfjm`, `CVE-2026-56376` · NuGet `Magick.NET-Q16-AnyCPU` and 16 more: affected `<14.10.3`, fixed in `14.10.3` · CVSS 6.3 Medium · Not analysed yet · Published 25 Feb 2026 · Tags: Memory corruption - [ImageMagick: Integer Overflow in PSB (PSD v2) RLE decoding path causes heap Out of Bounds reads for 32-bit builds](https://agentprime.io/advisories/GHSA-273h-m46v-96q4.md) `GHSA-273h-m46v-96q4`, `CVE-2026-25984`, `CVE-2026-56367` · NuGet `Magick.NET-Q8-x64` and 18 more: affected `<14.10.3`, fixed in `14.10.3` · CVSS 6.3 Medium · Not analysed yet · Published 25 Feb 2026 · Tags: Memory corruption - [ImageMagick: Invalid MSL \ can result in a use after free](https://agentprime.io/advisories/GHSA-w8mw-frc6-r7m8.md) `GHSA-w8mw-frc6-r7m8`, `CVE-2026-26983` · NuGet `Magick.NET-Q16-AnyCPU` and 18 more: affected `<14.10.3`, fixed in `14.10.3` · CVSS 5.3 Medium · Not analysed yet · Published 24 Feb 2026 · Tags: Memory corruption - [ImageMagick has a possible infinite loop in its JPEG encoder when using \`jpeg:extent\`](https://agentprime.io/advisories/GHSA-gwr3-x37h-h84v.md) `GHSA-gwr3-x37h-h84v`, `CVE-2026-26283` · NuGet `Magick.NET-Q16-AnyCPU` and 18 more: affected `<14.10.3`, fixed in `14.10.3` · CVSS 6.2 Medium · Not analysed yet · Published 24 Feb 2026 · Tags: Denial of service - [ImageMagick has infinite loop when writing IPTCTEXT leads to denial of service via crafted profile](https://agentprime.io/advisories/GHSA-v994-63cg-9wj3.md) `GHSA-v994-63cg-9wj3`, `CVE-2026-26066` · NuGet `Magick.NET-Q16-AnyCPU` and 18 more: affected `<14.10.3`, fixed in `14.10.3` · CVSS 6.2 Medium · Not analysed yet · Published 24 Feb 2026 · Tags: Denial of service - [ImageMagick: Integer overflow or wraparound and incorrect conversion between numeric types in the internal SVG decoder](https://agentprime.io/advisories/GHSA-7355-pwx2-pm84.md) `GHSA-7355-pwx2-pm84`, `CVE-2026-25989` · NuGet `Magick.NET-Q16-AnyCPU` and 18 more: affected `<14.10.3`, fixed in `14.10.3` · CVSS 7.5 High · Not analysed yet · Published 24 Feb 2026 · Tags: Memory corruption, CWE-681 - [ImageMagick: MSL image stack index may fail to refresh, leading to leaked images](https://agentprime.io/advisories/GHSA-782x-jh29-9mf7.md) `GHSA-782x-jh29-9mf7`, `CVE-2026-25988` · NuGet `Magick.NET-Q16-AnyCPU` and 17 more: affected `<14.10.3`, fixed in `14.10.3` · CVSS 5.3 Medium · Not analysed yet · Published 24 Feb 2026 · Tags: Denial of service - [ImageMagick has a heap buffer over-read in its MAP image decoder](https://agentprime.io/advisories/GHSA-42p5-62qq-mmh7.md) `GHSA-42p5-62qq-mmh7`, `CVE-2026-25987` · NuGet `Magick.NET-Q16-AnyCPU` and 18 more: affected `<14.10.3`, fixed in `14.10.3` · CVSS 5.3 Medium · Not analysed yet · Published 24 Feb 2026 · Tags: Memory corruption - [ImageMagick: Memory allocation with excessive without limits in the internal SVG decoder](https://agentprime.io/advisories/GHSA-v7g2-m8c5-mf84.md) `GHSA-v7g2-m8c5-mf84`, `CVE-2026-25985` · NuGet `Magick.NET-Q16-AnyCPU` and 18 more: affected `<14.10.3`, fixed in `14.10.3` · CVSS 7.5 High · Not analysed yet · Published 24 Feb 2026 · Tags: Denial of service - [ImageMagick has Use After Free in MSLStartElement in "coders/msl.c"](https://agentprime.io/advisories/GHSA-fwqw-2x5x-w566.md) `GHSA-fwqw-2x5x-w566`, `CVE-2026-25983` · NuGet `Magick.NET-Q16-AnyCPU` and 18 more: affected `<14.10.3`, fixed in `14.10.3` · CVSS 5.3 Medium · Not analysed yet · Published 24 Feb 2026 · Tags: Memory corruption - [Image Magick has a Memory Leak in coders/ashlar.c](https://agentprime.io/advisories/GHSA-xgm3-v4r9-wfgm.md) `GHSA-xgm3-v4r9-wfgm`, `CVE-2026-25969` · NuGet `Magick.NET-Q16-AnyCPU` and 17 more: affected `<14.10.3`, fixed in `14.10.3` · CVSS 5.3 Medium · Not analysed yet · Published 24 Feb 2026 · Tags: Denial of service - [ImageMagick: Stack buffer overflow in FTXT reader via oversized integer field](https://agentprime.io/advisories/GHSA-72hf-fj62-w6j4.md) `GHSA-72hf-fj62-w6j4`, `CVE-2026-25967` · NuGet `Magick.NET-Q16-AnyCPU` and 17 more: affected `<14.10.3`, fixed in `14.10.3` · CVSS 7.4 High · Not analysed yet · Published 24 Feb 2026 · Tags: Memory corruption - [ImageMagick's Security Policy Bypass through config/policy-secure.xml via "fd handler" leads to stdin/stdout access](https://agentprime.io/advisories/GHSA-xwc6-v6g8-pw2h.md) `GHSA-xwc6-v6g8-pw2h`, `CVE-2026-25966` · NuGet `Magick.NET-Q16-AnyCPU` and 16 more: affected `<14.10.3`, fixed in `14.10.3` · CVSS 5.9 Medium · Not analysed yet · Published 24 Feb 2026 · Tags: Broken access control - [ImageMagick: Policy bypass through path traversal allows reading restricted content despite secured policy](https://agentprime.io/advisories/GHSA-8jvj-p28h-9gm7.md) `GHSA-8jvj-p28h-9gm7`, `CVE-2026-25965` · NuGet `Magick.NET-Q16-AnyCPU` and 18 more: affected `<14.10.3`, fixed in `14.10.3` · CVSS 8.6 High · Not analysed yet · Published 24 Feb 2026 · Tags: Path traversal - [ImageMagick has Global Buffer Overflow (OOB Read) via Negative Pixel Index in UIL and XPM Writer](https://agentprime.io/advisories/GHSA-vpxv-r9pg-7gpr.md) `GHSA-vpxv-r9pg-7gpr`, `CVE-2026-25898` · NuGet `Magick.NET-Q16-AnyCPU` and 16 more: affected `<14.10.3`, fixed in `14.10.3` · CVSS 6.5 Medium · Not analysed yet · Published 24 Feb 2026 · Tags: Memory corruption - [ImageMagick: Heap overflow in sun decoder on 32-bit systems may result in out of bounds write](https://agentprime.io/advisories/GHSA-6j5f-24fw-pqp4.md) `GHSA-6j5f-24fw-pqp4`, `CVE-2026-25897` · NuGet `Magick.NET-Q16-AnyCPU` and 18 more: affected `<14.10.3`, fixed in `14.10.3` · CVSS 6.5 Medium · Not analysed yet · Published 24 Feb 2026 · Tags: Memory corruption - [ImageMagick has Division-by-Zero in YUV sampling factor validation, which leads to crash](https://agentprime.io/advisories/GHSA-543g-8grm-9cw6.md) `GHSA-543g-8grm-9cw6`, `CVE-2026-25799` · NuGet `Magick.NET-Q16-AnyCPU` and 18 more: affected `<14.10.3`, fixed in `14.10.3` · CVSS 5.3 Medium · Not analysed yet · Published 24 Feb 2026 · Tags: Denial of service - [ImageMagick has NULL Pointer Dereference in ClonePixelCacheRepository via crafted image](https://agentprime.io/advisories/GHSA-p863-5fgm-rgq4.md) `GHSA-p863-5fgm-rgq4`, `CVE-2026-25798` · NuGet `Magick.NET-Q16-AnyCPU` and 17 more: affected `<14.10.3`, fixed in `14.10.3` · CVSS 5.3 Medium · Not analysed yet · Published 24 Feb 2026 · Tags: Memory corruption - [ImageMagick: Code Injection via PostScript header in ps coders](https://agentprime.io/advisories/GHSA-rw6c-xp26-225v.md) `GHSA-rw6c-xp26-225v`, `CVE-2026-25797` · NuGet `Magick.NET-Q16-AnyCPU` and 17 more: affected `<14.10.3`, fixed in `14.10.3` · CVSS 5.7 Medium · Not analysed yet · Published 24 Feb 2026 · Tags: Code injection - [ImageMagick has memory leak of watermark Image object in ReadSTEGANOImage on multiple error/early-return paths](https://agentprime.io/advisories/GHSA-g2pr-qxjg-7r2w.md) `GHSA-g2pr-qxjg-7r2w`, `CVE-2026-25796` · NuGet `Magick.NET-Q16-AnyCPU` and 17 more: affected `<14.10.3`, fixed in `14.10.3` · CVSS 5.3 Medium · Not analysed yet · Published 24 Feb 2026 · Tags: Denial of service - [ImageMagick has NULL pointer dereference in ReadSFWImage after DestroyImageInfo (sfw.c)](https://agentprime.io/advisories/GHSA-p33r-fqw2-rqmm.md) `GHSA-p33r-fqw2-rqmm`, `CVE-2026-25795` · NuGet `Magick.NET-Q16-AnyCPU` and 17 more: affected `<14.10.3`, fixed in `14.10.3` · CVSS 5.3 Medium · Not analysed yet · Published 24 Feb 2026 · Tags: Memory corruption - [ImageMagick has heap-buffer-overflow via signed integer overflow in WriteUHDRImage when writing UHDR images with large dimensions](https://agentprime.io/advisories/GHSA-vhqj-f5cj-9x8h.md) `GHSA-vhqj-f5cj-9x8h`, `CVE-2026-25794` · NuGet `Magick.NET-Q16-AnyCPU` and 18 more: affected `<14.10.3`, fixed in `14.10.3` · CVSS 8.2 High · Not analysed yet · Published 24 Feb 2026 · Tags: Memory corruption - [ImageMagick has memory leak in msl encoder](https://agentprime.io/advisories/GHSA-gxcx-qjqp-8vjw.md) `GHSA-gxcx-qjqp-8vjw`, `CVE-2026-25638` · NuGet `Magick.NET-Q16-AnyCPU` and 18 more: affected `<14.10.3`, fixed in `14.10.3` · CVSS 5.3 Medium · Not analysed yet · Published 24 Feb 2026 · Tags: Denial of service - [ImageMagick: Possible memory leak in ASHLAR encoder](https://agentprime.io/advisories/GHSA-gm37-qx7w-p258.md) `GHSA-gm37-qx7w-p258`, `CVE-2026-25637` · NuGet `Magick.NET-Q8-x64` and 18 more: affected `<14.10.3`, fixed in `14.10.3` · CVSS 5.3 Medium · Not analysed yet · Published 24 Feb 2026 · Tags: Denial of service - [ImageMagick: Out of bounds read in multiple coders read raw pixel data](https://agentprime.io/advisories/GHSA-jv4p-gjwq-9r2j.md) `GHSA-jv4p-gjwq-9r2j`, `CVE-2026-25576` · NuGet `Magick.NET-Q16-AnyCPU` and 15 more: affected `<14.10.3`, fixed in `14.10.3` · CVSS 5.1 Medium · Not analysed yet · Published 24 Feb 2026 · Tags: Memory corruption - [ImageMagick: Infinite loop vulnerability when parsing a PCD file](https://agentprime.io/advisories/GHSA-pqgj-2p96-rx85.md) `GHSA-pqgj-2p96-rx85`, `CVE-2026-24485` · NuGet `Magick.NET-Q16-AnyCPU` and 18 more: affected `<14.10.3`, fixed in `14.10.3` · CVSS 7.5 High · Not analysed yet · Published 24 Feb 2026 · Tags: Denial of service - [ImageMagick: Converting multi-layer nested MVG to SVG can cause DoS](https://agentprime.io/advisories/GHSA-wg3g-gvx5-2pmv.md) `GHSA-wg3g-gvx5-2pmv`, `CVE-2026-24484` · NuGet `Magick.NET-Q16-AnyCPU` and 18 more: affected `<14.10.3`, fixed in `14.10.3` · CVSS 5.3 Medium · Not analysed yet · Published 24 Feb 2026 · Tags: Denial of service - [ImageMagick has Possible Heap Information Disclosure in PSD ZIP Decompression](https://agentprime.io/advisories/GHSA-96pc-27rx-pr36.md) `GHSA-96pc-27rx-pr36`, `CVE-2026-24481` · NuGet `Magick.NET-Q16-AnyCPU` and 16 more: affected `<14.10.3`, fixed in `14.10.3` · CVSS 7.5 High · Not analysed yet · Published 24 Feb 2026 · Tags: Memory corruption - [Microsoft Security Advisory CVE-2026-21218 | .NET Security Feature Bypass Vulnerability](https://agentprime.io/advisories/GHSA-qvhc-9v3j-5rfw.md) `GHSA-qvhc-9v3j-5rfw`, `BIT-dotnet-2026-21218`, `BIT-dotnet-sdk-2026-21218`, `CVE-2026-21218` · NuGet `System.Security.Cryptography.Cose`: affected `>=8.0.0, <8.0.2 || >=9.0.0, <9.0.13 || >=10.0.0, <10.0.3`, fixed in `8.0.2`, `9.0.13`, `10.0.3` · CVSS 7.5 High · Not analysed yet · Published 10 Feb 2026 · Tags: CWE-166 - [HtmlSanitizer has a bypass via template tag](https://agentprime.io/advisories/GHSA-j92c-7v7g-gj3f.md) `GHSA-j92c-7v7g-gj3f`, `CVE-2026-25543` · NuGet `HtmlSanitizer`: affected `<9.0.892 || >=9.1.878-beta, <9.1.893-beta`, fixed in `9.0.892`, `9.1.893-beta` · CVSS 6.3 Medium · Not analysed yet · Published 3 Feb 2026 · Tags: Cross-site scripting (XSS), CWE-116 - [Umbraco.Forms has Path Traversal and File Enumeration Vulnerabilities in Linux/Mac](https://agentprime.io/advisories/GHSA-hm5p-82g6-m3xh.md) `GHSA-hm5p-82g6-m3xh`, `CVE-2026-24687` · NuGet `Umbraco.Forms`: affected `>=16.0.0, <16.4.1 || >=17.0.0, <17.1.1`, fixed in `16.4.1`, `17.1.1` · CVSS 6.0 Medium · Not analysed yet · Published 30 Jan 2026 · Tags: Path traversal - [DotNetNuke.Core Vulnerable to Stored XSS via Module Title](https://agentprime.io/advisories/GHSA-w9pf-h6m6-v89h.md) `GHSA-w9pf-h6m6-v89h`, `CVE-2026-24838` · NuGet `DotNetNuke.Core`: affected `<9.13.10 || >=10.0.0, <10.2.0`, fixed in `9.13.10`, `10.2.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Jan 2026 · Tags: Cross-site scripting (XSS) - [DotNetNuke.Core Vulnerable to Stored XSS in Module Deletion Confirmation Modal](https://agentprime.io/advisories/GHSA-vm5q-8qww-h238.md) `GHSA-vm5q-8qww-h238`, `CVE-2026-24837` · NuGet `DotNetNuke.Core`: affected `>=9.0.0, <=9.13.9 || >=10.0.0, <10.2.0`, fixed in `10.2.0` · CVSS 7.7 High · Not analysed yet · Published 28 Jan 2026 · Tags: Cross-site scripting (XSS) - [DotNetNuke.Core Vulnerable to Stored XSS in Scheduler LogNotes](https://agentprime.io/advisories/GHSA-2g5g-hcgh-q3rp.md) `GHSA-2g5g-hcgh-q3rp`, `CVE-2026-24836` · NuGet `DotNetNuke.Core`: affected `>=9.0.0, <=9.13.9 || >=10.0.0, <10.02.0`, fixed in `10.02.0` · CVSS 7.7 High · Not analysed yet · Published 28 Jan 2026 · Tags: Cross-site scripting (XSS) - [DotNetNuke.Core has a potential XSS vulnerability in modules' header and footer](https://agentprime.io/advisories/GHSA-jjwg-4948-6wxp.md) `GHSA-jjwg-4948-6wxp`, `CVE-2026-24784` · NuGet `DotNetNuke.Core`: affected `>=9.0.0, <9.13.10 || >=10.0.0, <10.2.0`, fixed in `9.13.10`, `10.2.0` · CVSS 6.8 Medium · Not analysed yet · Published 28 Jan 2026 · Tags: Cross-site scripting (XSS) - [Umbraco.Forms CDN may cache sensitive form uploads when processed by ImageSharp](https://agentprime.io/advisories/GHSA-7jxj-rpx7-ph2c.md) `GHSA-7jxj-rpx7-ph2c` · NuGet `Umbraco.Forms`: affected `<13.9.0 || >=14.0.0-beta001, <16.4.0 || >=17.0.0-rc1, <17.1.0`, fixed in `13.9.0`, `16.4.0`, `17.1.0` · CVSS 3.1 Low · Not analysed yet · Published 22 Jan 2026 · Tags: CWE-524 - [ImageMagick has a NULL pointer dereference in MSL parser via \ tag before image load](https://agentprime.io/advisories/GHSA-5vx3-wx4q-6cj8.md) `GHSA-5vx3-wx4q-6cj8`, `CVE-2026-23952` · NuGet `Magick.NET-Q8-x64` and 18 more: affected `<14.10.2`, fixed in `14.10.2` · CVSS 6.5 Medium · Not analysed yet · Published 21 Jan 2026 · Tags: Memory corruption - [ImageMagick has a Memory Leak in LoadOpenCLDeviceBenchmark() when parsing malformed XML](https://agentprime.io/advisories/GHSA-qp59-x883-77qv.md) `GHSA-qp59-x883-77qv`, `CVE-2026-56364` · NuGet `Magick.NET-Q8-x64` and 18 more: affected `<14.10.2`, fixed in `14.10.2` · CVSS 1.8 Low · Not analysed yet · Published 21 Jan 2026 · Tags: Denial of service, Memory corruption - [ImageMagick MSL: Stack overflow via infinite recursion in ProcessMSLScript](https://agentprime.io/advisories/GHSA-9vj4-wc7r-p844.md) `GHSA-9vj4-wc7r-p844`, `CVE-2026-23874` · NuGet `Magick.NET-Q8-x64` and 17 more: affected `<14.10.2`, fixed in `14.10.2` · CVSS 5.5 Medium · Not analysed yet · Published 21 Jan 2026 · Tags: Denial of service - [ImageMagick releases an invalid pointer in BilateralBlur when memory allocation fails](https://agentprime.io/advisories/GHSA-39h3-g67r-7g3c.md) `GHSA-39h3-g67r-7g3c`, `CVE-2026-22770` · NuGet `Magick.NET-Q8-x64` and 18 more: affected `<14.10.2`, fixed in `14.10.2` · CVSS 6.5 Medium · Not analysed yet · Published 20 Jan 2026 · Tags: Memory corruption - [Umbraco CMS contains a server-side request forgery vulnerability](https://agentprime.io/advisories/GHSA-h66j-xm43-47pp.md) `GHSA-h66j-xm43-47pp`, `CVE-2021-47776` · NuGet `UmbracoCms`: affected `=8.14.1`, no fixed version yet · CVSS 6.9 Medium · Not analysed yet · Published 15 Jan 2026 · Tags: Server-side request forgery (SSRF) - [UmbracoForms Vulnerable to Remote Code Execution via Untrusted WSDL Compilation in Dynamic SOAP Client Generation](https://agentprime.io/advisories/GHSA-vrgw-pc9c-qrrc.md) `GHSA-vrgw-pc9c-qrrc`, `CVE-2025-68924` · NuGet `UmbracoForms`: affected `<=8.13.16`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 13 Jan 2026 · Tags: Code injection, Insecure deserialization, Broken access control, CWE-829 - [AWS SDK for .NET V4 adopted defense in depth enhancement for region parameter value](https://agentprime.io/advisories/GHSA-9cvc-h2w8-phrp.md) `GHSA-9cvc-h2w8-phrp`, `CVE-2026-22611` · NuGet `AWSSDK.Core`: affected `>=4.0.0, <4.0.3.3`, fixed in `4.0.3.3` · CVSS 3.7 Low · Not analysed yet · Published 9 Jan 2026 · Tags: CWE-20 - [ImageMagick's failure to limit MVG mutual causes Stack Overflow](https://agentprime.io/advisories/GHSA-7rvh-xqp3-pr8j.md) `GHSA-7rvh-xqp3-pr8j`, `CVE-2025-68950` · NuGet `Magick.NET-Q16-AnyCPU` and 16 more: affected `<14.10.1`, fixed in `14.10.1` · CVSS 4.0 Medium · Not analysed yet · Published 30 Dec 2025 · Tags: Denial of service - [ImageMagick's failure to limit the depth of SVG file reads caused a DoS attack](https://agentprime.io/advisories/GHSA-p27m-hp98-6637.md) `GHSA-p27m-hp98-6637`, `CVE-2025-68618` · NuGet `Magick.NET-Q16-AnyCPU` and 16 more: affected `<14.10.1`, fixed in `14.10.1` · CVSS 5.3 Medium · Not analysed yet · Published 30 Dec 2025 · Tags: Denial of service - [Piranha has stored cross-site scripting (XSS) vulnerability](https://agentprime.io/advisories/GHSA-fw48-7qf9-455m.md) `GHSA-fw48-7qf9-455m`, `CVE-2025-67290` · NuGet `Piranha`: affected `<=12.0.0`, no fixed version yet · CVSS 6.1 Medium · Not analysed yet · Published 22 Dec 2025 · Tags: Cross-site scripting (XSS) - [Piranha has stored cross-site scripting (XSS) vulnerability](https://agentprime.io/advisories/GHSA-83fp-hh9m-c2jq.md) `GHSA-83fp-hh9m-c2jq`, `CVE-2025-67291` · NuGet `Piranha`: affected `<=12.0.0`, no fixed version yet · CVSS 6.1 Medium · Not analysed yet · Published 22 Dec 2025 · Tags: Cross-site scripting (XSS) - [Umbraco CMS has an arbitrary file upload vulnerability](https://agentprime.io/advisories/GHSA-54mj-vcvj-q3v5.md) `GHSA-54mj-vcvj-q3v5`, `CVE-2025-67288` · NuGet `Umbraco.Cms`: affected `<=16.3.3`, no fixed version yet · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Dec 2025 · Tags: Cross-site scripting (XSS), Unrestricted file upload - [Amazon S3 Encryption Client for .NET has a Key Commitment Issue](https://agentprime.io/advisories/GHSA-4v42-65r3-3gjx.md) `GHSA-4v42-65r3-3gjx`, `CVE-2025-14759` · NuGet `Amazon.Extensions.S3.Encryption`: affected `<3.2.0`, fixed in `3.2.0` · CVSS 6.0 Medium · Not analysed yet · Published 18 Dec 2025 · Tags: Weak cryptography or TLS Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .