Threats affecting pkg:generic/libjxl

SOEM version 2.0.0 and earlier contains vulnerabilities where a malicious device can send messages that cause the master to read data from memory locations beyond the intended buffer. The software uses length values from device responses without validating them against actual buffer sizes. An attacker can exploit this to extract up to 64KB of data from the master's memory.

CVE-2026-95664 is an Expression Language Injection vulnerability in the Apache Camel AWS2-s3 component affecting versions from 4.8.0 before 4.18.5 and from 4.19.0 before 4.22.2. The issue arises because the key used by the aws2-s3 producer is taken from a message header and evaluated as a Simple language expression if it contains certain markers, allowing untrusted input to be executed. This can lead to unauthorized access to JVM system properties, environment variables, and invocation of methods on beans, potentially exposing sensitive information. The vulnerability is fixed in versions 4.18.5 and 4.22.2. Users are advised to upgrade to these versions or 4.23.0 or later. Workarounds include removing or validating the CamelAwsS3Key header to prevent untrusted expressions from being evaluated.

CVE-2026-101259 is a vulnerability in the Apache Camel CoAP component affecting versions from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.2. It allows generation of error messages containing sensitive internal information such as class names, file paths, host names, and connection details. This occurs when the CoAP consumer fails to build its response after route completion and returns detailed exception messages in a 5.00 Internal Server Error response. The issue is fixed in Apache Camel versions 4.18.5, 4.22.2, and later 4.23.0. Users are advised to upgrade to these fixed versions to prevent sensitive information disclosure.

CVE-2026-116372 is an improper input validation vulnerability in the MISP misp-guard security filtering proxy. The vulnerability arises because misp-guard only explicitly filters HTTP 200 responses, allowing other 2xx status codes like 201, 203, and 206 to bypass filtering. This enables a malicious or compromised feed endpoint to deliver unfiltered, potentially malicious content to the MISP instance. Exploitation requires control over a configured feed endpoint, with no additional authentication or user interaction needed.

CVE-2026-70388 is an integer underflow vulnerability in RT-Labs AB SOEM affecting versions before 2.0.1. A malicious device on the network can send crafted messages that cause the master to write outside allocated memory boundaries due to improper validation of message length arithmetic. This memory corruption can potentially lead to arbitrary code execution on the master system. The issue is fixed in version 2.0.1.

CVE-2026-116234 is a critical CRLF injection vulnerability in Oray Pugongying X5 Pro version 7.6.1. It affects an unknown function related to the IPsec Policy Handler component via manipulation of the 'secproto' argument in the /etc/ipsec.conf file. The vulnerability can be exploited remotely, and public exploit code is available. The vendor has not responded to the disclosure, and no patch information is provided.

CVE-2026-116233 is a critical security vulnerability in Oray Pugongying X5 Pro version 7.6.1 involving CRLF injection through manipulation of the rent_time argument in the Dnsmasq component. This vulnerability can be exploited remotely and has publicly disclosed exploit code. The vendor has not responded to the disclosure and no patch information is available.

Multiple cross site scripting (XSS) vulnerabilities affect OPNsense firewall vesrion 26.7.1_1 and earlier allows low privileged attacker to execute Javascript in the context of another user visiting a specific page or clicking on a specifically crafted link.

CVE-2026-116232 is a critical vulnerability in Oray Pugongying X5 Pro version 7.6.1 affecting the SNMP Handler component. It allows remote CRLF injection via manipulation of the info.community argument in the snmp_set function. Public exploit code is available, but the vendor has not responded or issued a fix.

CVE-2026-116231 is a critical CRLF injection vulnerability in Oray Pugongying X5 Pro version 7.6.1. The flaw exists in an unknown function of the Ser2net component, where manipulation of the regmsg argument allows injection. The vulnerability can be exploited remotely and public exploit code is available. The vendor has not responded to disclosure requests and no patch information is provided.

CVE-2026-116230 is a deserialization vulnerability in Ndemic Creations Plague Inc Evolved affecting versions 1.24.0.0 through 1.24.0.3. The flaw exists in an unknown function within the Workshop Scenario Loader component and can be exploited remotely. The vulnerability is fixed in version 1.24.0.4. The CVSS 4.0 base score is 5.3, indicating medium severity.

Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash allows a user of one tenant to read, overwrite and take over another tenant's records via an upserting create action. Under attribute multitenancy, Ash.Actions.Create (lib/ash/actions/create/create.ex) and Ash.Actions.Create.Bulk (lib/ash/actions/create/bulk.ex) upserted on the primary key, or on an all_tenants? identity, without scoping the conflicting record to the request's tenant. A caller of a create action with upsert? true that accepts the primary key, supplying a record id from another tenant, updated that record's upsert fields and received all of its attributes in the result. With the default upsert fields the tenant attribute was written too, moving the record into the caller's tenant. Read and update policies do not run for upserts, and tenant-scoped create policies pass because the tenant is the caller's own. This issue affects ash: from 1.22.0 before 3.37.2.

CVE-2026-116229 is a cross-site scripting (XSS) vulnerability in the ffxiv-teamcraft FFXIV Teamcraft application affecting versions 11.4.0 through 11.4.19. The flaw exists in the clipboard.readText function within the Renderer-Process IPC Bridge component. This vulnerability can be exploited remotely and has been publicly disclosed. A fix is available in version 11.4.32.

The Eurobank WooCommerce Payment Gateway WordPress plugin through 2.1.1 does not verify that a payment-confirmation request genuinely originates from the payment provider, and ships with the secret that would authenticate it empty by default, allowing unauthenticated attackers to mark any pending order as paid, and to force any order into a failed status without any secret at all.

The GiveWP WordPress plugin before 4.19.0.1 does not restrict the currency of a donation to the one the site or form accepts, while comparing its amount limits as bare numbers, allowing unauthenticated users to make donations below a form's configured minimum or fixed amount.

CVE-2026-116228 is a medium-severity vulnerability in 777genius agent-teams-ai up to version 2.17.10. It involves missing authentication in the Local HTTP Service component, specifically in the doStart function of src/main/services/infrastructure/HttpServer.ts. Exploitation requires local access. Public exploit code exists, but no vendor response or patch has been provided.

CVE-2026-116227 is a cross-site scripting (XSS) vulnerability in the Virtual Server Page component of Edimax BR-6208AC firmware version 1.32. This vulnerability allows remote attackers with high privileges to execute reflected XSS attacks. The vulnerability has been publicly disclosed, but the vendor has not responded or issued a fix.

CVE-2026-116224 is a server-side request forgery (SSRF) vulnerability in fr0tt benotes affecting versions 2.8.0 and 2.8.1. The flaw exists in the getUrlInfo function of the Bookmark Metadata Endpoint, allowing remote attackers to manipulate the url argument to induce SSRF. The vulnerability has been publicly disclosed, but no vendor response or patch is currently available.

V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6ComFile!CCheck::ItemCheck. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.

V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6EditData!CDataRomErrorCheck::CheckSymbolMacroParam. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.