Threats affecting pkg:bitnami/pgbouncer

Invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6.

Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.

Sandbox escape in the DOM: Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.

Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.

Privilege escalation due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.

Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6.

Sandbox escape in the Form Manager component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6.

Information disclosure due to uninitialized memory in the Audio/Video component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.

Privilege escalation due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.

Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6.

Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6.

A vulnerability was identified in a2aproject a2a-go up to 2.4.0. The affected element is the function Cancel of the file internal/taskexec/distributed_manager.go of the component Distributed Manager. Such manipulation leads to denial of service. It is possible to launch the attack remotely. Upgrading to version 2.5.0 is sufficient to fix this issue. The name of the patch is 14e41a978b31e134ffa1170d8657f9dd98529aa3. Upgrading the affected component is advised.

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and several LTS releases contain a stack-based buffer overflow vulnerability (CWE-121). This flaw could be exploited by a high privileged attacker with remote access to cause a denial of service condition. The vulnerability does not impact confidentiality or integrity but affects availability. Fixed versions are available starting from 8.9.0.0 and corresponding LTS releases.

CVE-2026-117503 is a resource consumption vulnerability in the a2aproject a2a-go software affecting versions 2.0 through 2.4.0. The flaw exists in an unknown function within the REST SSE handler component (a2asrv/rest.go). This vulnerability can be exploited remotely to cause excessive resource usage. Upgrading to version 2.5.0 addresses the issue.

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7 and specific LTS releases contain a relative path traversal vulnerability in the certificate handling component. This flaw allows a highly privileged remote attacker to potentially cause a denial of service. The vulnerability has a CVSS score of 6.5, indicating a medium severity impact. Fixed versions are available starting from 7.13.1.80, 8.3.1.40, 8.6.1.20, and 8.9.0.0 or later.

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and several LTS releases contain a path traversal vulnerability (CWE-28). This flaw allows a high privileged local attacker to potentially cause a denial of service. The vulnerability is fixed in versions 8.9.0.0 or later and corresponding later LTS releases.

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and certain LTS releases contain a relative path traversal vulnerability (CWE-23). This flaw allows a high privileged remote attacker to potentially tamper with information. The vulnerability has a low CVSS score of 3.8 and does not impact confidentiality but affects integrity and availability. Fixed versions are available starting from 8.9.0.0 and specific LTS patch levels.

Agno versions prior to 2.3.24 contain a critical arbitrary code execution vulnerability due to unsafe use of Python's eval() on the field_type parameter in FunctionCall inputs. This flaw allows attackers who can influence field_type to execute arbitrary Python code within the Agno process, impacting confidentiality, integrity, and availability. The vulnerability is fixed in version 2.3.24 and later. No safe workaround exists other than upgrading or ensuring no untrusted input reaches the vulnerable parameter.

A leaked SquareML access key potentially exposed personal and health information of 238,000 Denver Health Medical Plan members. The key was publicly accessible from June 27, 2025, until it was revoked on August 18, 2026. The compromised account was read-only, limiting the ability to alter or export data. The exposed data includes names, dates of birth, demographic details, health metrics, and hospital admission information, but excludes Social Security numbers and financial data. There is no evidence that the data was accessed or misused, only that it may have been.