I
Vendor security profile3 actively exploited CVEs
imagemagick
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs107
Critical2
CISA KEV3
Public exploit6
Patch rate%8
Avg. CVSS5.6
12-month vulnerability rate
0
1
1
3
2
2
0
36
25
0
12
22
CVE KEV
CVE severity distribution
107toplam CVE
Critical2 (2%)
High24 (22%)
Medium68 (64%)
Low11 (10%)
Uncertain2 (2%)
Patch and exploitation view
%8
Verified patch
%3
CISA KEV
%6
Public exploit
8Patch available
1Partial
2Workaround
0Vendor: no patch
96Unknown
Latest vulnerabilities
7.3
CVE-2026-108693
ImageMagick through 7.1.2-33 and 6.9.13-58 Uncontrolled Search Path via Ghostscript Delegate
I
Patch status unknownEPSS %0
5.3
CVE-2026-107210
ImageMagick: Policy Bypass in MAT decoder when reading highly compressed data
I
Patch status unknownEPSS %0
5.9
CVE-2026-107209
ImageMagick: Use-After-Free in RSVG decoder that is build without cairo support
I
Patch status unknownEPSS %0
5.3
CVE-2026-107208
ImageMagick: Denial of service with crafted XMP profile
I
Patch status unknownEPSS %0
4.0
CVE-2026-106580
ImageMagick: Policy Bypass in CUT encoder
I
Patch status unknownEPSS %0
6.2
CVE-2026-106579
ImageMagick: Policy Bypass when using coder as the domain.
I
Patch status unknownEPSS %0
5.9
CVE-2026-106578
ImageMagick: Invalid Memory Free in MVG decoder
I
Patch status unknownEPSS %0
5.3
CVE-2026-106577
ImageMagick: Code Injection in the postscript coders
I
Patch status unknownEPSS %0
5.3
CVE-2026-106576
ImageMagick: Denial of service possible when parsing an XMP profile.
I
Patch status unknownEPSS %0
5.3
CVE-2026-106575
ImageMagick: Unclosed file pointer in magick script
I
Patch status unknownEPSS %0