Threats affecting pkg:generic/libultrahdr

Scribus versions prior to 1.6.7 contain an out-of-bounds read vulnerability in the Mac PICT image loader and import plugin. This flaw occurs when decoding planar pixel data from crafted PICT files with manipulated dimensions, potentially causing heap over-reads. Exploitation can lead to application crashes or disclosure of heap memory contents.

Scribus versions prior to 1.6.7 contain an out-of-bounds write vulnerability in the importdrw Micrografx Draw plugin. This flaw arises from using an unvalidated y offset to select image scanlines, allowing crafted DRW files to write decoded bitmap data outside the intended heap buffer. This can lead to application crashes or potential code execution when a user imports a malicious file.

A path traversal vulnerability exists in the FeaturedImage component of astro-notion-blog version 0.13.0. This flaw allows attackers to escape the intended directory and read or overwrite files on the server by using a crafted URL.

Scribus versions prior to 1.6.7 have a heap out-of-bounds write vulnerability in the scimgdataloader_psd loader. This flaw arises from using unchecked PSD file values as array indexes, which can lead to heap memory corruption. An attacker can exploit this by convincing a user to open or import a specially crafted PSD file, potentially causing application crashes or arbitrary code execution with the user's privileges.

An authenticated cross-site scripting (XSS) vulnerability exists in the /spina/embeddable.rb component of Spina CMS version 2.21.0. This flaw allows authenticated attackers to inject crafted URLs that execute arbitrary web scripts or HTML within the context of the application.

A missing authorization vulnerability exists in Webba Plugins Webba Booking (webba-booking-lite) up to version 6.5.4. This flaw allows exploitation of incorrectly configured access control security levels, potentially leading to unauthorized information disclosure and modification. The vulnerability has a CVSS 3.1 base score of 5.4, indicating a medium severity level.

RT (Request Tracker) versions prior to 5.0.11 and 6.0.4 have a vulnerability where automatic link creation for URLs in HTML ticket content does not properly HTML-escape the URLs. This allows an attacker who can add HTML content to a ticket, including unauthenticated senders of HTML email to certain queues, to inject scripts that execute when the ticket history is viewed. The script runs with the privileges of the viewing user, potentially allowing unauthorized actions within RT.

A vulnerability in Shirt Pocket's SuperDuper! version 4.0.9 and earlier allows a local attacker to obtain sensitive information without requiring privileges or user interaction.

CVE-2026-62264 is a vulnerability in SylphxAI's pdf-reader-mcp affecting versions 2.2.0 through before 3.0.1. When the HTTP server is enabled via MCP_TRANSPORT=http, the server logs that API key authentication is enabled but does not actually validate the X-API-Key header. This allows unauthenticated clients to access the /mcp endpoint and use PDF reading tools with the permissions of the server process. The default bind address 0.0.0.0 exposes this to any reachable client. URL-based sources can also trigger limited server-side request forgery if private IP allowance is enabled. The issue is fixed in version 3.0.1.

Subscriber PHP Object Injection in MasterStudy LMS <= 3.7.55 versions.

Shop manager PHP Object Injection in Product Feed Manager <= 7.14.1 versions.

CVE-2026-118086 is a high-severity vulnerability in WP BASE Booking plugin versions up to 6.5.2. It involves incorrect privilege assignment that allows subscriber-level users to escalate their privileges. This flaw can lead to full compromise of confidentiality, integrity, and availability of the affected system.

Unauthenticated Broken Access Control in WP REST Cache <= 2026.3.1 versions.

Unauthenticated Sensitive Data Exposure in Flexible Chat <= 1.1.0 versions.

Subscriber Cross Site Scripting (XSS) in WP Customer Area <= 8.4.0 versions.

Unauthenticated Broken Access Control in GiveWP <= 4.19.0.1 versions.

CVE-2026-116852 is a critical code injection vulnerability (CWE-94) affecting Marketing Fire's Widget Options product versions up to 4.2.5. It allows an author with high privileges to execute remote code, potentially leading to full system compromise. The vulnerability has a CVSS score of 9.1, indicating severe impact on confidentiality, integrity, and availability. No public exploits or vendor patches are currently documented.

Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog <= 3.6.5 versions.

Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.6 versions.

Unauthenticated Arbitrary Content Deletion in Masteriyo - LMS <= 3.4.3 versions.