NuGet Advisories.

ImageMagick has an Infinite Loop in subimage-search with crafted image

• Denial of service

<14.14.0 · fixed in 14.14.0

ImageMagick has a Heap Buffer Underwrite in the Floyd-Steinberg depth dithering method

• Memory corruption

<14.14.0 · fixed in 14.14.0

MessagePack-CSharp: Typeless deserialization type restrictions do not recurse into arrays or generic arguments

• Code injection
• Insecure deserialization

<2.5.301 || >=3.0, <3.1.7 · fixed in 2.5.301, 3.1.7

MessagePack-CSharp: InterfaceLookupFormatter bypasses collision-resistant comparer settings

• Denial of service

<2.5.301 || >=3.0, <3.1.7 · fixed in 2.5.301, 3.1.7

MessagePack-CSharp: Multi-dimensional array formatters allocate from unchecked dimensions

• Denial of service

<2.5.301 || >=3.0, <3.1.7 · fixed in 2.5.301, 3.1.7

MessagePack-CSharp: Unity unsafe blit formatter allocates from unbounded byte length

• Denial of service

<2.5.301 || >=3.0, <3.1.7 · fixed in 2.5.301, 3.1.7

MessagePack-CSharp: DynamicUnionResolver-generated deserializers miss depth enforcement

• Denial of service

<2.5.301 || >=3.0, <3.1.7 · fixed in 2.5.301, 3.1.7

MessagePack-CSharp: JSON conversion APIs can recurse without consistent depth enforcement

• Denial of service

<2.5.301 || >=3.0, <3.1.7 · fixed in 2.5.301, 3.1.7

MessagePack-CSharp: ExpandoObject formatter can perform quadratic insertion work on untrusted maps

• Denial of service

<2.5.301 || >=3.0, <3.1.7 · fixed in 2.5.301, 3.1.7

MessagePack-CSharp: LZ4 decompression allocates from unbounded declared output lengths

• Denial of service
• CWE-409

<2.5.301 || >=3.0, <3.1.7 · fixed in 2.5.301, 3.1.7

MessagePack-CSharp: ASP.NET Core MessagePackInputFormatter defaults to TrustedData for HTTP request bodies

• CWE-1188

<2.5.301 || >=3.0, <3.1.7 · fixed in 2.5.301, 3.1.7

MessagePack-CSharp: MessagePackReader.Skip can recurse without enforcing maximum object graph depth

• Denial of service

<2.5.301 || >=3.0, <3.1.7 · fixed in 2.5.301, 3.1.7

MessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflows

• Memory corruption
• Denial of service

>=3.0, <3.1.7 · fixed in 3.1.7

Duplicate Advisory: ImageMagick: SVG-to-MVG Command Injection via coders/svg.c

• Command injection
• CWE-116

<14.10.3 · fixed in 14.10.3

Duplicate Advisory: ImageMagick: Memory leak in coders/txt.c without freetype

• Denial of service

<14.10.3 · fixed in 14.10.3

Duplicate Advisory: ImageMagick has a possible heap Use After Free vulnerability in its meta coder

• Memory corruption

<14.10.3 · fixed in 14.10.3

Duplicate Advisory: ImageMagick: Integer Overflow in PSB (PSD v2) RLE decoding path causes heap Out of Bounds reads for 32-bit builds

• Memory corruption

<14.10.3 · fixed in 14.10.3

Duplicate Advisory: ImageMagick: Malicious PCD files trigger 1‑byte heap Out-of-bounds Read and DoS

• Memory corruption

<14.10.3 · fixed in 14.10.3

CoreWCF: SPNEGO SecurityContextToken proof key wrapped without confidentiality

• Weak cryptography or TLS
• CWE-523

>=1.9.0, <1.9.1 · fixed in 1.9.1

CoreWCF: XML Signature Wrapping in WS-Security endorsing/supporting signature verification allows replay of captured signed messages

• Authentication bypass
• Weak cryptography or TLS

<1.8.1 || >=1.9.0, <1.9.1 · fixed in 1.8.1, 1.9.1

CoreWCF: Authentication bypass in CoreWCF SAML 1.1 / 2.0 token signature validation

• Authentication bypass
• Weak cryptography or TLS

<1.8.1 || >=1.9.0, <1.9.1 · fixed in 1.8.1, 1.9.1

CoreWCF: SAML SubjectConfirmation methods and holder-of-key proof keys are not enforced

• Authentication bypass
• CWE-345

<1.8.1 || >=1.9.0, <1.9.1 · fixed in 1.8.1, 1.9.1

CoreWCF: WS-Security Reference DigestMethod Algorithm-Suite Bypass

• Weak cryptography or TLS
• CWE-757

<1.8.1 || >=1.9.0, <1.9.1 · fixed in 1.8.1, 1.9.1

CoreWCF: SAML token replay protection is inoperative

• Authentication bypass

<1.8.1 || >=1.9.0, <1.9.1 · fixed in 1.8.1, 1.9.1

CoreWCF: UnixDomainSocket Non-Reentrant POSIX Identity Resolution

• Race condition
• Memory corruption

<1.8.1 || >=1.9.0, <1.9.1 · fixed in 1.8.1, 1.9.1

CoreWCF NetNamedPipe transport accepts attach to a pre-existing named pipe instance

• Race condition
• CWE-665

<1.8.1 || >=1.9.0, <1.9.1 · fixed in 1.8.1, 1.9.1

CoreWCF: Unix Domain Socket PosixIdentity transport accepts connections that skip the security upgrade

• Authentication bypass

<1.8.1 || >=1.9.0, <1.9.1 · fixed in 1.8.1, 1.9.1

CoreWCF: Kafka consume pump halts permanently on a Kafka tombstone (null-value record), causing persistent endpoint denial of service.

• CWE-248
• CWE-754

<1.8.1 || >=1.9.0, <1.9.1 · fixed in 1.8.1, 1.9.1

CoreWCF: SamlSerializer skips SignatureValue verification when SAML signing token is not an X.509 certificate

• Weak cryptography or TLS
• CWE-345

<1.8.1 || >=1.9.0, <1.9.1 · fixed in 1.8.1, 1.9.1

CoreWCF: WS-Security signature substitution via document-wide Signature lookup

• Weak cryptography or TLS

<1.8.1 || >=1.9.0, <1.9.1 · fixed in 1.8.1, 1.9.1

CoreWCF: Pre-authentication infinite-loop CPU exhaustion in CoreWCF net.tcp / net.pipe / net.uds framing handshake

• Denial of service

<1.8.1 || >=1.9.0, <1.9.1 · fixed in 1.8.1, 1.9.1

NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation

• Memory corruption
• Denial of service

<6.1.1 · fixed in 6.1.1

Microsoft Security Advisory CVE-2026-45491 – .NET Tampering Vulnerability

• Path traversal

>=8.0.0, <8.0.28 || >=9.0.0, <9.0.17 || >=10.0.0, <10.0.9 · fixed in 8.0.28, 9.0.17, 10.0.9

Microsoft Security Advisory CVE-2026-45591 – ASP.NET Core Denial of Service Vulnerability

• Denial of service
• Memory corruption

>=8.0.0, <8.0.28 || >=9.0.0, <9.0.17 || >=10.0.0, <10.0.9 · fixed in 8.0.28, 9.0.17, 10.0.9

MessagePack's LZ4 decompression may fail with AccessViolationException after dereferencing memory from bad input

• CWE-20

<2.5.301 || >=3.0.214-rc.1, <3.1.7 · fixed in 2.5.301, 3.1.7

TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection

• Cross-site scripting (XSS)

<=5.10.9 || >=6.0.0, <7.9.3 || >=8.0.0, <8.5.1 · fixed in 7.9.3, 8.5.1

TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments

• Cross-site scripting (XSS)

<=5.10.9 || >=6.0.0, <7.9.3 || >=8.0.0, <8.5.1 · fixed in 7.9.3, 8.5.1

TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes

• Cross-site scripting (XSS)

<=5.10.9 || >=6.0.0, <7.9.3 || >=8.0.0, <8.5.1 · fixed in 7.9.3, 8.5.1

TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs

• Cross-site scripting (XSS)

>=6.8.0, <7.1.0 · fixed in 7.1.0

Nerdbank.MessagePack has Inefficient CPU Computation

• CWE-1176

<1.2.4 · fixed in 1.2.4

Nerdbank.MessagePack has a memory amplification DoS in collection deserialization

• CWE-405

<1.1.78 · fixed in 1.1.78

ImageMagick: Heap Buffer Over-Read in distributed pixel cache server

• Memory corruption
• Authentication bypass

<14.12.0 · fixed in 14.12.0

ImageMagick: Information Disclosure in distributed pixel cache server because it is not using a challenge–response authentication model

• Information disclosure

<14.12.0 · fixed in 14.12.0

ImageMagick: Race Condition in distributed pixel cache server can result in file descriptor hijacking

• Race condition
• CWE-567

<14.12.0 · fixed in 14.12.0

ImageMagick: Heap Buffer Over-Write in distributed pixel cache server

• Memory corruption

<14.12.0 · fixed in 14.12.0

ImageMagick: Information Disclosure in PasskeyEncipherImage via AES-CTR nonce reuse

• Weak cryptography or TLS
• CWE-323

<14.12.0 · fixed in 14.12.0

ImageMagick: Division by Zero in binomial kernel

• Memory corruption
• Denial of service

<14.12.0 · fixed in 14.12.0

ImageMagick: Heap Buffer Over-Write in json and yaml encoder of a single byte due to incorrect fix

• CWE-193

<14.12.0 · fixed in 14.12.0

Umbraco.Cms: XSS/HTML Injection in Umbraco Backoffice confirmation dialog

• Cross-site scripting (XSS)

>=14.0.0, <17.4.0 · fixed in 17.4.0

Umbraco.Cms: Open Redirect Vulnerability in Surface Controllers

• Open redirect

<13.14.0 || >=17.3.0-rc, <17.4.0 · fixed in 13.14.0, 17.4.0

OpenMcdf: Uncatchable infinite loop in DirectoryTree.TryGetDirectoryEntry on crafted CFB directory cycle

• Denial of service

<3.1.4 · fixed in 3.1.4

Scriban: array.insert_at index parameter DoS bypasses LoopLimit and LimitToString

• Denial of service

<7.2.0 · fixed in 7.2.0

ImageMagick: Heap Buffer Over-Write of a single byte in the JP2 encoder.

• Memory corruption
• CWE-193

<14.13.1 · fixed in 14.13.1

ImageMagick: Stack overflow in fx operation

• Denial of service

<14.13.1 · fixed in 14.13.1

ImageMagick: Use-After-Free in MSL decoder.

• Memory corruption

<14.13.1 · fixed in 14.13.1

ImageMagick: Infinite Loop in the MIFF decoder can lead to CPU exhaustion

• Denial of service

<14.13.1 · fixed in 14.13.1

ImageMagick: Heap Buffer Over-Write in MIFF encoder when using LZMA compression

• Memory corruption
• Denial of service

<14.13.1 · fixed in 14.13.1

ImageMagick: Heap Buffer Over-Write in IPL decoder when reading multiple images of different dimensions

• Memory corruption

<14.13.1 · fixed in 14.13.1

ImageMagick: Policy Bypass in MNG coder could

• Denial of service

<14.13.1 · fixed in 14.13.1

ImageMagick: Heap Buffer Over-Read of a 4 bytes in distort operation.

• Memory corruption
• CWE-129

<14.13.1 · fixed in 14.13.1