Threats affecting pkg:generic/libraw

CVE-2025-64394 is a vulnerability in Veeam Backup for Microsoft 365 versions 8.0 through 8.6.0.1102 that allows a low-privileged local user to write arbitrary files with SYSTEM privileges during installation. This insecure operation on Windows junction or mount points can lead to privilege escalation or denial of service. The vulnerability has a medium severity score of 4.3 and requires user interaction for exploitation.

CVE-2026-108141 is a path traversal vulnerability in Veeam Backup and Replication that allows an authenticated user with the Restore Operator role, who can control a backed-up NAS share, to write files to arbitrary paths on the backup server via relative path traversal. This flaw affects versions 13.0 up to but not including 13.0.3 and 13.1 up to but not including 13.1.2. The vulnerability has a medium severity with a CVSS score of 5.9. Fixed versions are 13.0.3 and 13.1.2.

CVE-2026-106078 is a medium severity vulnerability in Veeam Backup for Microsoft 365 versions 8.0 through 8.6.0.1102. It allows an unauthenticated attacker to bypass REST API authentication by using a forged federation token, enabling access to certain REST API endpoints that do not invoke the backup service.

CVE-2026-107671 is a high-severity vulnerability in Veeam ONE versions 13.1 through 13.1.0.7233 that allows an attacker with valid Administrator credentials to bypass multi-factor authentication (MFA). The attacker can disable MFA globally before completing the MFA verification process, effectively circumventing this security control.

CVE-2026-108142 is a critical vulnerability in Veeam Backup and Replication affecting versions 13.0 up to but not including 13.0.3 and 13.1 up to but not including 13.1.2. It allows an unauthenticated attacker to bypass authorization on the CDP Coordinator Service due to a failing open authorization check (CWE-636). The vulnerability has a high CVSS 4.0 score of 9.1, indicating network exploitable with no user interaction required and high impact on confidentiality, integrity, and availability. Fixed versions 13.0.3 and 13.1.2 address this issue. No known exploits in the wild have been reported.

CVE-2026-106077 is a high-severity vulnerability in Veeam Backup for Microsoft 365 versions 8.0 through 8.5.0.1014. It allows a user with the Veeam Backup for Microsoft 365 Administrator role to read arbitrary files on the backup server with LocalSystem privileges, potentially exposing sensitive data. A patch is available for this issue.

CVE-2026-106076 is a critical SQL injection vulnerability in Veeam Backup for Microsoft 365 versions 8.0 through 8.5.0.1014. It allows an authenticated organization-transfer peer to inject SQL commands into the source server's configuration database, potentially enabling cross-tenant data access and remote code execution as the PostgreSQL service account.

CVE-2026-108140 is a path traversal vulnerability in Veeam Backup and Replication that allows an authenticated user with the Restore Operator role, who can control backed-up NAS share contents, to write files to arbitrary paths on the backup server. This flaw affects versions 13.0 up to but not including 13.0.3 and 13.1 up to but not including 13.1.2. The vulnerability is fixed in versions 13.0.3 and 13.1.2.

CVE-2026-105477 is a local privilege escalation vulnerability in Veeam Agent for Linux versions 13.1 up to but not including 13.1.2. It affects only installations managed by a Veeam Backup & Replication instance. The issue is due to an untrusted search path (CWE-426), which could allow an attacker with local access to escalate privileges.

CVE-2026-82984 is an improper access control vulnerability in Nextcloud Server versions 32.0.0 through 33.0.0. When a team is configured as "visible to everyone," the web UI prevents non-members from viewing the team, but the resources API endpoint can still be accessed by any authenticated user. This allows enumeration of the team's internal resources, revealing their existence, names, and identifiers without granting access to the actual contents.

CVE-2026-77167 is a denial-of-service vulnerability in Nextcloud server affecting versions 22.0.0 through 34.0.0. An attacker can abuse the federated share endpoint to write arbitrary rows into the oc_share_external database table, which persist indefinitely due to lack of automatic cleanup. This leads to three distinct denial-of-service conditions that self-renew every 24 hours as long as the malicious rows remain.

CVE-2026-77173 is an improper access control vulnerability in Nextcloud Files Confidential affecting versions 3.3.0 through 5.0.0. It allows a user to create a .docx or .odt file with a '#' character in the filename containing confidential information, such as credit card numbers, without the file being marked as confidential.

CVE-2026-67400 is a low-severity vulnerability in Nextcloud Richdocuments where a missing token type check allows retrieval of additional WOPI configuration information using a user or guest token.

CVE-2026-77171 is an improper access control vulnerability in Nextcloud Collectives version 4.0.0 where a public shared collective link allowed recipients to create pages. This flaw could lead to unauthorized content creation by link recipients.

A vulnerability in Nextcloud Server versions 32.0.0 through 34.0.0 allows app passwords to bypass password confirmation on sensitive endpoints. This improper privilege management issue can lead to unauthorized actions without the usual password verification step.

CVE-2026-87897 is a server-side request forgery (SSRF) vulnerability in Nextcloud Whiteboard versions prior to 1.0.0. It allows a low privileged attacker to access internal Chrome Devtools Protocol APIs and leak JWT authentication tokens of other users. Exploiting this flaw can grant the attacker read/write access to the victim's Whiteboard session. The vulnerability has a medium severity score of 4.6 and was fixed in version 1.0.0.

A vulnerability in the Nextcloud Tables app allows users with read-data access to enumerate all share recipients and their permission levels for a table via a share-listing API endpoint. This exposure does not include the table's data itself, only metadata about sharing. The flaw affects versions from 0.8.1 through 2.0.0 and has a low severity rating.

CVE-2026-82986 is an improper access control vulnerability in Nextcloud Tables versions 0.6.4 through 1.0.0. It allows a user who is a member of a group to bypass group restrictions set by an administrator on link sharing, enabling them to create share links for tables without having the required permission.

CVE-2026-54462 is a resource exhaustion vulnerability in the knative.dev/pkg webhook admissionHandler prior to version 0.0.0-20260531000007-52dbd5ece63f. The webhook handler decodes attacker-supplied AdmissionReview requests without limiting the request body size, allowing a pod-network client to send an oversized POST request that causes memory exhaustion and pod termination. This affects all downstream consumers using the shared webhook server, including Knative, Tekton, KEDA, Sigstore policy-controller, and Kpack. The issue is fixed in version 0.0.0-20260531000007-52dbd5ece63f.

The qs library version 6.7.0 through 6.16.0 has a vulnerability in its stringify function when using the arrayFormat 'comma'. If an array element has a non-callable own toString property, qs.stringify throws an uncaught TypeError. This can be triggered remotely by an unauthenticated attacker controlling input that is later serialized with this option, potentially crashing the Node.js process and causing a denial of service. There is no impact on confidentiality or integrity, and no prototype pollution occurs.