Threats affecting pkg:generic/lucene

CVE-2026-126545 is a missing authorization vulnerability in WWBN AVideo up to version 29.7.1. It affects the API::get_api_tags() function in the plugin/API/API.php file, allowing registered users to access restricted video data by querying the tags API. Exploiting this flaw, attackers can subscribe to a tag and retrieve filenames, titles, and stored video_password values of unlisted, group-restricted, and password-protected videos, potentially enabling unauthorized viewing.

WWBN AVideo versions 6.5 through 29.7.1 have an email verification bypass vulnerability due to PHP loose comparison in the User::verifyCode() function. This flaw allows registered users to reuse a global salt from their own verification link to craft a code that can verify other users' email addresses, potentially unlocking features like live streaming on those accounts.

CVE-2026-126543 is a high-severity vulnerability in WWBN AVideo up to version 29.7.1. It involves improper verification of payment authenticity in the PayPal IPN handling script (plugin/PayPalYPT/ipnV2.php). Attackers can exploit this flaw by forwarding legitimate verified recurring payment notifications from their own PayPal accounts with arbitrary user IDs, resulting in unauthorized crediting of wallet balances on the affected site.

WWBN AVideo versions 6.5 through 29.7.1 have an authentication bypass vulnerability via Hybridauth social login display names. Attackers can impersonate any user, including administrators, by setting their social login display name to a victim's username and omitting the email, allowing login without a password.

CVE-2026-126541 is a high-severity authorization bypass vulnerability in WWBN AVideo versions up to 29.7.1. It affects the Live plugin's restream endpoints, allowing authenticated streamers to supply arbitrary live_transmitions_history_id values to obtain other users' stream keys and HLS URLs. This enables attackers to impersonate victims by publishing streams as them or restreaming private or pay-per-view content without authorization.

Directus versions before 12.1.0 have an authorization bypass vulnerability that allows unauthenticated attackers to bypass permission checks on public-mode WebSocket connections. By sending an invalid token, attackers can cause the system to set accountability to null, enabling them to read, create, update, or delete records in any user-defined collection without proper authorization. This vulnerability is fixed in version 12.1.0.

Jellyfin versions prior to 12.0 contain a path traversal vulnerability in the DELETE /Library/VirtualFolders and POST /Library/VirtualFolders/Name endpoints. This flaw allows unauthenticated attackers to delete or move directories by supplying specially crafted library names such as '..' or absolute paths before setup completes, potentially leading to recursive deletion of the data directory and the jellyfin.db database file.

WriteFreely versions before 0.17.3 contain a stored cross-site scripting (XSS) vulnerability. Authenticated authors can inject malicious HTML via the post slug in the CreatePost API. This injected script executes in RSS/Atom feed readers, newsletter recipients, and ActivityPub viewers. The vulnerability is fixed in version 0.17.3.

LibreCAD versions up to 2.2.1.6 have a heap-based out-of-bounds write vulnerability in the libdxfrw dwgReader18::parseDataPage() function. This flaw arises from unchecked buffer sizes and page offsets when processing AC1018 (R2004) DWG files. Maliciously crafted DWG files with manipulated startOffset values can trigger writes beyond the allocated heap buffer, potentially causing application crashes or code execution.

CVE-2026-126496 is an authorization bypass vulnerability in 1Panel-dev CordysCRM versions before 1.9.6. It allows authenticated users with ordinary contact or customer read permissions to access other users' contact information without proper organization, owner, or data-scope checks. Exploitation involves sending a GET request to /account/contact/get/{id} with another contact's ID to retrieve sensitive details such as names, phone numbers, owners, departments, linked customers, and custom fields.

MQTTX desktop versions up to 1.13.3 have a stored cross-site scripting (XSS) vulnerability. This flaw allows attackers to inject malicious scripts via MQTT topic names or payloads that are rendered without proper escaping in tooltips. When a user hovers over affected Topic Tree or JSON tree nodes, the malicious script executes in the Electron renderer environment, which has nodeIntegration enabled, increasing potential impact.

The npm package rex-react-diag-tools-v1 contains malicious code that fully compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted computer. Removing the package alone does not guarantee removal of all malicious software introduced by it.

Red Hat has issued a security advisory for multiple vulnerabilities in the Linux kernel packages affecting Red Hat Enterprise Linux 9.4 and related variants. The update addresses a range of issues including out-of-bounds reads and writes, denial of service, privilege requirements, and memory disclosure across various kernel subsystems such as netfilter, Bluetooth RFCOMM, IP tunnels, NVMe TCP, libceph, and others. These vulnerabilities have been assigned CVE identifiers and are rated with an overall security impact of Important. The advisory recommends applying the update and rebooting the system to mitigate these issues.

A heap out-of-bounds write vulnerability exists in Microsoft.DiaSymReader.Native on Windows platforms when reading crafted native PDB files. This affects multiple .NET runtime versions on Windows x86, x64, and Arm64 architectures. The flaw is due to crafted PDB line metadata exceeding the caller-provided buffer. Microsoft has released patches for affected .NET runtime and SDK versions to address this issue.

A high-severity vulnerability exists in Microsoft .NET on Windows platforms affecting multiple architectures (x86, x64, Arm64). The flaw involves attacker-controlled COFF relocation offsets causing an out-of-bounds stack write in the DiaObjectFile::ApplyFixup function. This vulnerability affects various .NET runtime and SDK versions prior to specific patched releases. Updating to the listed fixed versions mitigates the issue.

CVE-2026-97045 is a medium severity vulnerability affecting multiple versions of the external-dns package. The issue involves the function childTextNodesAreLiteral, where tree traversal incorrectly stopped at the nearest foreign ancestor upon encountering an HTML integration point. This flaw could lead to partial compromise of confidentiality and integrity without affecting availability. Multiple affected versions have been identified and fixed in subsequent releases.

CVE-2026-78661 is a high-severity vulnerability affecting multiple versions of the external-dns package. It involves improper handling when coalescing adjacent text nodes in the addText and fosterParent functions, specifically through appending to an existing TextNode's Data via string concatenation. This flaw can lead to a confidentiality impact without affecting integrity or availability. Multiple versions prior to fixed releases are affected, and patches are available.

A security vulnerability in the argo-workflows package involves the Serialize JavaScript component, which serializes JavaScript values to a superset of JSON including regular expressions and functions. This flaw affects versions prior to 4.1.6-r1 and 4.0.15-r2. The vulnerability has a low severity score and does not involve confidentiality, integrity, or availability impacts. A patch is available in versions 4.1.6-r1 and 4.0.15-r2.

A security vulnerability in the argo-workflows package involves a user-configured proxy on webpack-dev-server with a broad context. This issue affects versions prior to 4.1.6-r1 and 4.0.15-r2. The vulnerability has a CVSS score of 4.3, indicating medium severity, and results in availability impact without compromising confidentiality or integrity.

A high-severity security vulnerability (CVE-2026-93752) affects the argo-workflows package versions prior to 4.0.15-r2. The vulnerability is identified as CSSOM through 0 and has an impact on availability. A fix is available in version 4.0.15-r2.