NuGet Advisories.

ImageMagick has a heap overflow caused by integer overflow/wraparound in viff encoder on 32-bit builds

• Memory corruption

<14.12.0 · fixed in 14.12.0

DNN: Same HostGUID for all new installs

• Weak cryptography or TLS

>=10.0.0, <10.2.2 · fixed in 10.2.2

DNN: Force Friend Request Acceptance

• Broken access control

>=6.0.0, <10.2.2 · fixed in 10.2.2

DotNetNuke.Core has stored cross-site-scripting (XSS) via SVG upload

• Cross-site scripting (XSS)

<10.2.2 · fixed in 10.2.2

Apache Log4net: Silent log event loss in XmlLayout and XmlLayoutSchemaLog4J due to unescaped XML 1.0 forbidden characters

• CWE-116

<3.3.0 · fixed in 3.3.0

Tmds.DBus: malicious D-Bus peers can spoof signals, exhaust file descriptor resources, and cause denial of service

• Authentication bypass
• Denial of service

<0.92.0 · fixed in 0.92.0

EnhancedLinq.Async is Vulnerable to Denial of Service via Transitive Dependency Microsoft.Bcl.Memory

• CWE-129
• CWE-1395

>=1.0.0-beta.1, <1.0.0-beta.3 · fixed in 1.0.0-beta.3

AWS SDK for .NET: Improper escaping of special characters in CloudFront policy document construction

• CWE-20
• CWE-116

<3.7.510.7 · fixed in 3.7.510.7

ImageMagick: META reader memory leak in the APP1JPEG input path

• Denial of service

<14.11.1 · fixed in 14.11.1

ImageMagick has possible memory leak in ASHLAR coder when action fails

• Denial of service

<14.11.1 · fixed in 14.11.1

ImageMagick has an Out-of-bounds Write via InterpretImageFilename

• Memory corruption

<14.11.1 · fixed in 14.11.1

ImageMagick has an Out-of-Bounds write of a zero byte in its X11 display interaction

• Memory corruption

<14.11.1 · fixed in 14.11.1

Scriban has Multiple Denial-of-Service Vectors via Unbounded Resource Consumption During Expression Evaluation

• Denial of service

<7.0.0 · fixed in 7.0.0

Scriban: Denial of Service via Unbounded Cumulative Template Output Bypassing LimitToString

• Denial of service

<7.0.0 · fixed in 7.0.0

Scriban has Uncontrolled Recursion in `object.to_json` Causing Unrecoverable Process Crash via StackOverflowException

• Denial of service

<7.0.0 · fixed in 7.0.0

Scriban: Uncontrolled Memory Allocation via string.pad_left/pad_right Allows Remote Denial of Service

• Denial of service

<7.0.0 · fixed in 7.0.0

Scriban: Built-in operations bypass LoopLimit and delay cancellation, enabling Denial of Service

• Denial of service

<7.0.0 · fixed in 7.0.0

Scriban: Sandbox escape due to TypedObjectAccessorcache bypassing MemberFilter after TemplateContext reuse

• CWE-693

<7.0.0 · fixed in 7.0.0

Scriban has an authorization bypass due to stale include cache surviving TemplateContext.Reset()

• CWE-226

<7.0.0 · fixed in 7.0.0

Scriban has a Stack Overflow via Nested Array Initializers That Bypass the ExpressionDepthLimit Fix

• Denial of service

<7.0.0 · fixed in 7.0.0

Duplicate Advisory: OpenClaw has cross-account DM pairing authorization bypass via unscoped pairing store access

• Broken access control

<=2026.2.25 · no fixed version yet

Scriban Affected by Memory Exhaustion (OOM) via Unbounded String Generation (Denial of Service)

• Denial of service

<6.6.0 · fixed in 6.6.0

Scriban has an Infinite Recursion during Object Rendering Leads to Stack Overflow and Process Crash (Denial of Service)

• Denial of service

<6.6.0 · fixed in 6.6.0

Scriban has Uncontrolled Recursion in Parser Leads to Stack Overflow and Process Crash (Denial of Service)

• Denial of service

<6.6.0 · fixed in 6.6.0

ImageMagick has a heap-buffer-overflow in NewXMLTree which could result in crash

• Memory corruption

<14.11.0 · fixed in 14.11.0

AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion

• Denial of service

<15.1.1 || >=16.0.0, <16.1.1 · fixed in 15.1.1, 16.1.1

idunno.Bluesky, idunno.AtProto and idunno.AtProto.OAuthCallback Denial of Service Vulnerability

• CWE-129

<1.7.0 · fixed in 1.7.0

ImageMagick: Specially crafted SVG leads to segmentation fault and generate trash files in "/tmp", possible to leverage DoS

• Denial of service
• CWE-20

<13.0.0 · fixed in 13.0.0

ImageMagick has heap buffer overflow in WriteXWDImage due to CARD32 arithmetic overflow in bytes_per_line calculation

• Memory corruption

<14.10.4 · fixed in 14.10.4

ImageMagick has Heap Buffer Overflow in WaveletDenoiseImage

• Memory corruption

<14.10.4 · fixed in 14.10.4

ImageMagick has Heap Buffer Over-Read in BilateralBlurImage

• Memory corruption

<14.10.4 · fixed in 14.10.4

ImageMagick has heap-based buffer overflow in UHDR encoder

• Memory corruption

<14.10.4 · fixed in 14.10.4

ImageMagick has stack buffer overflow in MagnifyImage

• Memory corruption

<14.10.4 · fixed in 14.10.4

ImageMagick: Integer overflow in DIB coder can result in out of bounds read or write

• Memory corruption

<14.10.4 · fixed in 14.10.4

ImageMagick has uninitialized pointer dereference in JBIG decoder

• Memory corruption
• CWE-252

<14.10.4 · fixed in 14.10.4

ImageMagick has stack write buffer overflow in MNG encoder

• Memory corruption

<14.10.4 · fixed in 14.10.4

ImageMagick has heap use-after-free in the MSL encoder

• Memory corruption

<14.10.4 · fixed in 14.10.4

ImageMagick has Heap Use-After-Free in ImageMagick MSL decoder

• Memory corruption

<14.10.4 · fixed in 14.10.4

ImageMagick: Write heap-buffer-overflow in PCL encoder via undersized output buffer

• Memory corruption

<14.10.4 · fixed in 14.10.4

ImageMagick vulnerable to stack corruption through long morphology kernel names or arrays

• Memory corruption

<14.10.4 · fixed in 14.10.4

ImageMagick has Integer Overflow leading to out of bounds write in SIXEL decoder

• Memory corruption

<14.10.4 · fixed in 14.10.4

ImageMagick: Heap overflow in pcd decoder leads to out of bounds read.

• Memory corruption

<14.10.3 · fixed in 14.10.3

ImageMagick has heap buffer overflow in YUV 4:2:2 decoder

• Memory corruption

<14.10.3 · fixed in 14.10.3

ImageMagick has Heap Out-of-Bounds Read in DCM Decoder (ReadDCMImage)

• Memory corruption

<14.10.3 · fixed in 14.10.3

ImageMagick: MSL - Stack overflow in ProcessMSLScript

• Denial of service
• Memory corruption

<14.10.3 · fixed in 14.10.3

ImageMagick Has Signed Integer Overflow in SIXEL Decoder, Leading to Memory Corruption

• Memory corruption

<14.10.3 · fixed in 14.10.3

ImageMagick: MSL attribute stack buffer overflow leads to out of bounds write.

• Memory corruption

<14.10.3 · fixed in 14.10.3

.NET Denial of Service Vulnerability

• Memory corruption

>=9.0.0, <9.0.14 || >=10.0.0, <10.0.4 · fixed in 9.0.14, 10.0.4

.NET Denial of Service Vulnerability

• Denial of service

>=8.0.0, <8.0.25 || >=9.0.0, <9.0.14 || >=10.0.0, <10.0.4 · fixed in 8.0.25, 9.0.14, 10.0.4

.NET Elevation of Privilege Vulnerability

• Broken access control

>=10.0.0, <10.0.4 · fixed in 10.0.4

Umbraco Affected by Vertical Privilege Escalation via Missing Authorization Checks

• Privilege escalation
• Broken access control

>=15.3.1, <16.5.1 || >=17.0.0, <17.2.2 · fixed in 16.5.1, 17.2.2

Umbraco has Stored XSS in UFM Rendering Pipeline via Permissive DOMPurify Attribute Filtering

• Cross-site scripting (XSS)

>=16.2.0, <16.5.1 || >=17.0.0, <17.2.2 · fixed in 16.5.1, 17.2.2

Umbraco Backoffice API Allows Unauthorized Modification of Domain Data

• Broken access control

>=14.0.0, <16.5.1 || >=17.0.0, <17.2.2 · fixed in 16.5.1, 17.2.2

ImageMagick is vulnerable to heap buffer over-write on 32-bit systems in SFW decoder

• Memory corruption

<14.10.4 · fixed in 14.10.4

ImageMagick is vulnerable to Heap Overflow when writing extremely large image profile in the PNG encoder

• Memory corruption

<14.10.4 · fixed in 14.10.4

ImageMagick has a heap buffer over-read via 32-bit integer overflow in MAT decoder

• Memory corruption

<14.10.4 · fixed in 14.10.4

ImageMagick has a Path Policy TOCTOU symlink race bypass

• Path traversal
• Race condition

<14.10.4 · fixed in 14.10.4

Duplicate Advisory: .NET Denial of Service Vulnerability

• Denial of service

>=8.0.0, <8.0.25 · fixed in 8.0.25

Azure MCP Server has Server-Side Request Forgery issue that allows authorized attacker to elevate privileges over a network

• Server-side request forgery (SSRF)

>=1.0.0, <1.0.2 || >=2.0.0-beta.1, <2.0.0-beta.17 · fixed in 1.0.2, 2.0.0-beta.17

Duplicate Advisory: .NET Denial of Service Vulnerability

• Memory corruption

>=9.0.0, <=9.0.13 · no fixed version yet