Threats affecting pkg:generic/libultrahdr

A missing authorization vulnerability exists in Webba Plugins Webba Booking (webba-booking-lite) up to version 6.5.4. This flaw allows exploitation of incorrectly configured access control security levels, potentially leading to unauthorized information disclosure and modification. The vulnerability has a CVSS 3.1 base score of 5.4, indicating a medium severity level.

RT (Request Tracker) versions prior to 5.0.11 and 6.0.4 have a vulnerability where automatic link creation for URLs in HTML ticket content does not properly HTML-escape the URLs. This allows an attacker who can add HTML content to a ticket, including unauthenticated senders of HTML email to certain queues, to inject scripts that execute when the ticket history is viewed. The script runs with the privileges of the viewing user, potentially allowing unauthorized actions within RT.

A vulnerability in Shirt Pocket's SuperDuper! version 4.0.9 and earlier allows a local attacker to obtain sensitive information without requiring privileges or user interaction.

CVE-2026-62264 is a vulnerability in SylphxAI's pdf-reader-mcp affecting versions 2.2.0 through before 3.0.1. When the HTTP server is enabled via MCP_TRANSPORT=http, the server logs that API key authentication is enabled but does not actually validate the X-API-Key header. This allows unauthenticated clients to access the /mcp endpoint and use PDF reading tools with the permissions of the server process. The default bind address 0.0.0.0 exposes this to any reachable client. URL-based sources can also trigger limited server-side request forgery if private IP allowance is enabled. The issue is fixed in version 3.0.1.

Subscriber PHP Object Injection in MasterStudy LMS <= 3.7.55 versions.

Shop manager PHP Object Injection in Product Feed Manager <= 7.14.1 versions.

Subscriber Privilege Escalation in WP BASE Booking <= 6.5.2 versions.

Unauthenticated Broken Access Control in WP REST Cache <= 2026.3.1 versions.

Unauthenticated Sensitive Data Exposure in Flexible Chat <= 1.1.0 versions.

Subscriber Cross Site Scripting (XSS) in WP Customer Area <= 8.4.0 versions.

Unauthenticated Broken Access Control in GiveWP <= 4.19.0.1 versions.

Author Remote Code Execution (RCE) in Widget Options <= 4.2.5 versions.

Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog <= 3.6.5 versions.

Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.6 versions.

Unauthenticated Arbitrary Content Deletion in Masteriyo - LMS <= 3.4.3 versions.

Unauthenticated Cross Site Scripting (XSS) in VikRentCar <= 1.4.9 versions.

Unauthenticated Broken Access Control in HUSKY <= 1.4.6 versions.

Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 4.0.2 versions.

Unauthenticated Sensitive Data Exposure in HUSKY <= 1.4.6 versions.

Subscriber Arbitrary File Deletion in SureDash <= 1.12.3 versions.