What you need to know today.
Ncurses, ImageMagick, Redis, GPAC, and Linux kernel vulnerabilities disclosed; XSS found in XMLRPC-C Library.
The ncurses library, specifically versions before 6.1-20191012, contains two heap-based buffer over-read vulnerabilities in the fmt_entry and _nc_find_entry functions within tinfo/comp_hash.c. These flaws could allow an attacker to trigger memory corruption, potentially leading to denial-of-service or other unintended behavior. While these vulnerabilities have low exploitability scores, they affect a widely used library for terminal handling. CVE-2019-17595 and CVE-2019-17594 are the affected CVEs.
ImageMagick versions prior to 7.1.2-27 are susceptible to a memory leak vulnerability in the magick command-line interface. This issue arises when invalid command-line options are provided, allowing an attacker to repeatedly supply malformed arguments to exhaust system memory, leading to a denial-of-service condition. CVE-2026-66011 details this vulnerability.
A critical remote code execution vulnerability exists in Redis versions before 8.8.0. In a specific scenario where an authenticated attacker can execute the RESTORE command, a crafted RESTORE payload can lead to RCE. This occurs when the same pending entry is referenced by multiple consumers, and the system attempts to delete it, causing a flaw in the handling of these NACKs. CVE-2026-66373 is associated with this flaw.
GPAC, a multimedia framework, has disclosed two vulnerabilities in versions up to 2.5-DEV and commit b40ce70f5 respectively. The first, CVE-2025-15667, affects the gf_isom_nalu_sample_rewrite function in src/isomedia/avc_ext.c within the MP4Box component. Manipulation of the nalu_out_bs argument can lead to a double free vulnerability. The second, CVE-2025-15668, impacts the sgpd_del_entry function in src/isomedia/box_code_base.c, also within MP4Box, where manipulation of the data argument can result in a heap-based buffer overflow.
The Linux kernel has seen several vulnerabilities resolved. CVE-2026-64530 addresses an issue in net/sched: cls_api where TC_ACT_CONSUMED was not properly handled in tcf_qevent_handle, potentially leading to issues when the skb is held by the defragmentation engine. Additionally, CVE-2024-14040 resolves a vulnerability in the net: nexthop component, where the weight was not increased to u16, impacting ECMP weight adjustments in CLOS networks during link failures. The remaining unnumbered CVEs in this batch also appear to be related to Linux kernel fixes.
A reflected cross-site scripting (XSS) vulnerability has been identified in the error page component of the XMLRPC-C Library, affecting versions 1.07 through 1.67.01. This flaw allows attackers to inject malicious scripts into the error pages, which are then reflected back to the user's browser, potentially leading to session hijacking or other client-side attacks. CVE-2026-15928 is the identifier for this vulnerability.