Threats affecting pkg:bitnami/powershell

lz233 Tarnhelm version 1.8.2 (versionCode 20250630) contains insecure permissions that allow unauthorized attackers to invoke an exported component. This vulnerability can lead to arbitrary data access and overwriting by unauthorized parties.

IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a server-side request forgery (SSRF) vulnerability that could allow a remote authenticated attacker to obtain sensitive information. The vulnerability does not impact integrity or availability but can lead to information disclosure. The CVSS score is 5.0 (medium severity). No patch or remediation details are provided in the available data.

IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a vulnerability that allows an authenticated attacker to create a server-generated ZIP archive with entry paths that traverse outside the intended extraction directory. If a victim extracts this archive using a tool that does not sanitize paths, it could lead to arbitrary file writes on the victim's system.

IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a vulnerability that allows remote attackers who can access the message broker to execute arbitrary code via deserialization of untrusted data. This flaw is identified as CWE-502 and has a high severity score of 8.1. The vulnerability requires network access with high attack complexity and no privileges or user interaction. No public exploits or patches are currently documented.

IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a vulnerability that allows a remote authenticated attacker to execute arbitrary code via deserialization of untrusted data. This flaw is identified as CWE-502 and has a high severity with a CVSS score of 8.8. The vulnerability requires authentication but no user interaction and impacts confidentiality, integrity, and availability.

An insecure permissions vulnerability in WikiAndPad alpha/beta version 0.2alpha03 (versionCode 200300) allows unauthorized attackers to export the application's data.

A malicious actor with local access and high privileges could exploit an Improper Access Control vulnerability found in WiFiman Desktop for macOS to escalate privileges on the host device.

CVE-2026-118773 is a medium severity vulnerability in the isaacs node-glob package affecting versions from 9.0.0 up to but not including 14.0.2. The flaw involves uncontrolled resource consumption due to improper handling of abort signals during file pattern matching and directory traversal. This can lead to excessive filesystem operations and CPU usage, potentially degrading service availability. The issue does not impact confidentiality or integrity. It is fixed in version 14.0.2.

A malicious actor with local access and low privileges could exploit an External Control of File Name or Path vulnerability found in WiFiman Desktop for macOS to execute arbitrary commands with root privileges on the host device.

A malicious actor with access to the network could exploit a Binding to an Unrestricted IP Address vulnerability found in WiFiman Desktop for macOS to obtain information about the host device.

CVE-2026-41216 is a high-severity vulnerability in vtk version 9.6 involving an expired pointer dereference in the vtkPNGReader::ExecuteInformation function. A specially crafted PNG file can trigger this flaw, causing a denial of service by crashing the application. No confidentiality or integrity impact is reported.

CVE-2026-42057 is a high-severity vulnerability in vtk version 9.6 involving an expired pointer dereference in the vtkPNGReader::vtkPNGReaderUpdate2 function. A specially crafted PNG file can trigger this flaw, causing a denial of service by crashing the application. No confidentiality or integrity impact is reported. There is no indication of public exploits or active exploitation in the wild. No patch information is provided in the available data.

CVE-2026-8822 is a high-severity memory corruption vulnerability in the vtkDEMReader ReadProfiles functionality of vtk version 9.6.1. It arises from an out-of-bounds write triggered by processing a specially crafted USGS DEM file, potentially causing a buffer overflow. This flaw allows an attacker to cause a denial of service by crashing the application. No public exploit or known active exploitation is reported. No patch or remediation information is currently available.

CVE-2026-8824 is a high-severity memory corruption vulnerability in vtk version 9.6.1. It affects the vtkBMPReader component's ExecuteDataWithInformation function, where processing a specially crafted BMP file can cause a buffer overflow. This vulnerability could lead to denial of service due to application crash or instability.

CVE-2026-9535 is an out-of-bounds read vulnerability in the vtkChacoReader InputGraph2 functionality of vtk version 9.6.1. This flaw can be triggered by processing a specially crafted chaco file, potentially leading to a read outside the intended memory bounds. The vulnerability has a high severity rating with a CVSS score of 8.2.

CVE-2026-9536 is a heap-based buffer overflow vulnerability in the vtkWindBladeReader FindVariableOffsets functionality of vtk version 9.6.1. This flaw can be triggered by processing a specially crafted .wind file, potentially causing a buffer overflow condition. The vulnerability has a high severity score of 7.5 and does not require user interaction or privileges to exploit.

A vulnerability in the hapijs joi JavaScript data validator affects versions from 16.0.0 up to 17.1.1 and 18.0.0 up to but not including 18.3.1. The Joi.string().email({ multiple: true }) rule uses a regular expression with inefficient complexity, causing the Node.js event loop to be blocked for seconds when processing attacker-controlled input with long whitespace runs. This can lead to denial of service by blocking other operations. The issue is fixed in version 18.3.1.

HashiCorp Nomad and Nomad Enterprise contain a vulnerability (CVE-2026-119168) involving symlink following during same-client allocation data migration. This flaw allows a malicious workload to alter permissions and ownership of host directories, potentially enabling unauthorized access or modification of host files and privilege escalation. The issue is fixed in Nomad versions 2.1.0, 1.11.12, and 1.10.18.

HashiCorp Nomad and Nomad Enterprise contain a vulnerability (CVE-2026-107347) involving improper symlink resolution during dispatch payload and executor log writes. This flaw allows a malicious workload to modify files outside its allocation directory. If the Nomad client agent runs with root privileges, exploitation could lead to root code execution on the host. The issue is fixed in Nomad versions 2.1.0, 1.11.12, and 1.10.18.

HashiCorp Nomad and Nomad Enterprise contain an authorization bypass vulnerability (CVE-2026-102260) affecting several read-only API endpoints. This flaw allows an authenticated user with read permissions in one namespace to access information about objects in other namespaces. The issue is fixed in Nomad Community Edition 2.1.0 and Nomad Enterprise versions 2.1.0, 1.11.12, and 1.10.18.