CVE WATCH / VULNERABILITY DETAIL
CVE-2026-109266
MEDIUMCVSS 5.3NVD feed
Published 12 October 2026 · tracked since 13 October 2026
Description
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an XML injection vulnerability in the CIP encoder, which does not properly escape input-derived data when writing Cisco IP Phone XML output. Attackers can supply a crafted file that, when converted to CIP format, injects arbitrary markup
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-109313 HIGH 8.1
- CVE-2026-109314 HIGH 7.3
- CVE-2026-109309 MEDIUM 6.5
- CVE-2026-109312 HIGH 8.1
- CVE-2026-109305 HIGH 8.8
- CVE-2026-109293 MEDIUM 6.5
- CVE-2026-109237 HIGH 8.1
- CVE-2026-109238 HIGH 8.6
- CVE-2026-109239 MEDIUM 5.3
- CVE-2026-105274