Threats affecting pkg:generic/zxc

CVE-2026-92072 is a vulnerability in the Safe Browsing component of Microsoft software version 4.0 involving incorrect boundary conditions. The description and details are minimal, with no CVSS score or detailed impact information provided.

CVE-2026-8954 is a vulnerability in a Microsoft Audio/Video component involving incorrect boundary conditions and an integer overflow. The flaw affects version 4.0 of the product. No CVSS score or detailed impact information is provided. There are no known exploits in the wild and no patch information is available.

Memory safety bugs were fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2, and Thunderbird 149.0.2. The advisory references Microsoft Security Response Center but does not provide specific details about the vulnerabilities or their impact. No CVSS score or exploit information is available.

A use-after-free vulnerability exists in the Disability Access APIs component of Microsoft software version 4.0, which could allow a sandbox escape. This vulnerability was published on November 14, 2026. No CVSS score or detailed impact metrics are provided, and there is no information about active exploitation or available patches.

A sandbox escape vulnerability exists in the Widget: Win32 component of Microsoft software version 4.0 due to incorrect boundary conditions. This flaw could allow an attacker to break out of the sandbox environment. No CVSS score or detailed impact information is provided.

CVE-2026-5733 is a vulnerability in the Graphics: WebGPU component of Microsoft software version 4.0 caused by incorrect boundary conditions. The issue relates to improper handling of memory boundaries, categorized under CWE-119. No CVSS score or detailed impact information is provided. No known exploits or patches are currently documented.

A privilege escalation vulnerability exists in the Application Update component of Microsoft software version 4.0. This vulnerability could allow an attacker to gain elevated privileges. No CVSS score or detailed technical information is provided. There is no indication of active exploitation in the wild, and no patch or remediation details are available in the provided data.

A use-after-free vulnerability has been identified in the Widget component of the Gtk library within Microsoft product version 4.0. This type of flaw involves accessing memory after it has been freed, which can lead to undefined behavior or potential security risks.

A Just-In-Time (JIT) miscompilation vulnerability exists in the JavaScript WebAssembly component of Microsoft software version 4.0. The vulnerability is identified as CVE-2026-100792 and relates to improper compilation that could affect execution correctness. No CVSS score or detailed impact information is provided.

CVE-2026-5732 is a vulnerability in the Microsoft Graphics: Text component involving incorrect boundary conditions and an integer overflow. The issue affects version 4.0 of the product. No CVSS score or detailed impact information is provided.

CVE-2026-8950 is a vulnerability in Microsoft’s Networking: HTTP component that allows bypassing the same-origin policy. The same-origin policy is a critical security mechanism that restricts how documents or scripts loaded from one origin can interact with resources from another origin. This vulnerability could potentially allow unauthorized cross-origin interactions. The affected version is Microsoft version 4.0. No CVSS score or detailed impact information is provided, and no known exploits are reported in the wild. No patch or remediation details are currently available.

CVE-2026-92066 is a sandbox escape vulnerability in the Profile Backup component of Microsoft software version 4.0. The vulnerability has been published but lacks detailed technical information and a CVSS score. No known exploits in the wild or patch information are currently available.

A use-after-free vulnerability exists in the DOM Core & HTML component of Microsoft software version 4.0. This type of flaw involves accessing memory after it has been freed, which can lead to undefined behavior or potential security issues. No CVSS score or detailed impact information is provided.

An integer overflow vulnerability has been identified in the Widget: Win32 component of Microsoft software version 4.0. The vulnerability is cataloged as CVE-2026-8949 and is associated with CWE-190. No CVSS score or detailed impact information is provided, and there is no indication of known exploitation in the wild. No patch or remediation details are available at this time.

A sandbox escape vulnerability exists in the Widget: Win32 component of Microsoft software version 4.0 due to incorrect boundary conditions. This flaw could potentially allow an attacker to break out of the sandbox environment. No CVSS score or detailed impact information is provided.

A use-after-free vulnerability exists in the XSLT component of Microsoft software version 4.0. This vulnerability involves improper handling of memory, which could potentially lead to undefined behavior or security issues. No CVSS score or detailed impact information is provided.

CVE-2026-8948 is a vulnerability in Microsoft software version 4.0 involving a same-origin policy bypass in the DOM networking component. The same-origin policy is a critical security mechanism that restricts how documents or scripts loaded from one origin can interact with resources from another origin. This bypass could potentially allow unauthorized access to resources across origins. No CVSS score or detailed impact information is provided, and there is no indication of active exploitation in the wild. No patch or remediation details are available at this time.

CVE-2026-123595 is a vulnerability in Hickory DNS version 4.0 that allows DNSSEC validation bypass via ancestor-delegation NSEC3 records. This flaw could undermine the integrity of DNSSEC validation, potentially allowing attackers to bypass security checks. No CVSS score or detailed impact information is provided.

A sandbox escape vulnerability exists in the Widget: Win32 component of Microsoft software version 4.0 due to incorrect boundary conditions. This flaw could allow an attacker to break out of the sandbox environment. No CVSS score or detailed impact information is provided.

CVE-2026-123580 is a vulnerability in Hickory-DNS versions before 0.26.2 that allows DNSSEC nonexistence proof forgery via NSEC3. This flaw affects version 4.0 of the Microsoft product referenced. No CVSS score or detailed impact information is provided. No patch or remediation details are available in the provided data.