Threats affecting pkg:generic/osquery

Crawl4AI versions prior to 0.9.5 have a blind server-side request forgery (SSRF) vulnerability in the Docker server API. This flaw allows API clients to bypass the egress proxy by enabling the check_cache_freshness feature. Attackers can exploit this by caching a controlled URL and then triggering the CacheValidator to follow 302 redirects or perform DNS rebinding to internal or cloud metadata service addresses, facilitating port and service discovery.

Crawl4AI versions from 0.9.0 up to but not including 0.9.5 have a vulnerability where the CosineStrategy model_name field in Docker API request bodies is not properly filtered. This allows authenticated clients to specify which HuggingFace model the server loads, potentially referencing malicious repositories. Exploitation can lead to arbitrary Python code execution under PyTorch versions below 2.6 or resource exhaustion via disk and memory consumption.

An unauthenticated sensitive data exposure vulnerability exists in WP Crowdfunding versions up to and including 2.2.2. This flaw allows attackers to access sensitive information without authentication.

An unauthenticated Cross Site Scripting (XSS) vulnerability exists in GlobalPayments WooCommerce versions up to and including 1.23.3. This vulnerability allows attackers to inject malicious scripts without authentication, potentially impacting confidentiality, integrity, and availability of affected systems.

A privilege escalation vulnerability exists in Buddyboss Platform versions up to and including 3.5.0, allowing users with subscriber-level access to escalate their privileges. This vulnerability is identified as CVE-2026-118082 and has a high severity rating with a CVSS score of 8.8.

An Insecure Direct Object Reference (IDOR) vulnerability affects Hotel Booking versions up to and including 3.8. This flaw allows an authenticated user with limited privileges to access subscriber data directly without proper authorization checks. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity impact primarily on confidentiality.

Crawl4AI versions before 0.9.5 have an improper certificate validation vulnerability due to Chromium launching with the --ignore-certificate-errors flag. This allows network attackers performing man-in-the-middle or DNS-based attacks to intercept crawler traffic, serve forged content, and access cookies and headers. Additionally, a hard-coded --no-sandbox flag disables sandbox protections.

A PHP Object Injection vulnerability exists in FV Flowplayer Video Player versions up to and including 8.3.4. This vulnerability allows a user with shop manager privileges to potentially execute arbitrary code or cause other impacts by injecting crafted PHP objects.

A PHP Object Injection vulnerability exists in 10Web Social Photo Feed versions up to and including 1.5.6. This vulnerability allows an attacker with low privileges to execute arbitrary code remotely without user interaction, potentially leading to full system compromise.

A PHP Object Injection vulnerability exists in Finale Lite versions up to and including 2.21.0. This flaw allows an attacker with high privileges to remotely execute code or cause a denial of service without user interaction.

A PHP Object Injection vulnerability exists in the Product Catalog Feed component of PixelYourSite versions up to and including 3.1.4. This vulnerability allows an attacker with high privileges to execute arbitrary code or cause denial of service via crafted input. The flaw is identified as CWE-502 and has a CVSS 3.1 base score of 7.2, indicating a high severity impact.

A PHP Object Injection vulnerability exists in Sastra Essential Addons for Elementor versions up to and including 1.2.3. This vulnerability allows an attacker with author-level privileges to inject malicious PHP objects, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.

A PHP Object Injection vulnerability exists in WP Media folders versions up to 1.1.10. This flaw allows a user with Contributor privileges to perform object injection attacks, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.

A PHP Object Injection vulnerability exists in News Kit Elementor Addons versions up to and including 1.5.0. This vulnerability allows an attacker with low privileges to execute arbitrary code remotely without user interaction, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.

A PHP Object Injection vulnerability exists in Social Snap versions up to and including 1.5.4. This vulnerability allows an attacker with low privileges to execute arbitrary code or cause a denial of service without user interaction.

A PHP Object Injection vulnerability exists in myPOS Checkout versions up to and including 1.4.5. This vulnerability allows an attacker with high privileges to execute arbitrary code or cause denial of service. The flaw is identified as CWE-502 and has a CVSS 3.1 score of 7.2, indicating high severity.

A PHP Object Injection vulnerability exists in BuddyPress Xprofile Custom Field Types versions up to and including 1.3.1. This vulnerability allows an attacker with subscriber-level privileges to perform PHP Object Injection, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.

A PHP Object Injection vulnerability exists in Frisbii Pay versions up to and including 1.8.19. This vulnerability allows an attacker with low privileges to execute arbitrary code or cause denial of service due to unsafe deserialization of user input.

P-Net versions before 1.0.3 contain a vulnerability where RPC sessions allocated for requests naming unknown interfaces or object UUIDs are not released and no timeout is started. An unauthenticated remote attacker can exploit this by sending repeated requests with different activity UUIDs to exhaust available sessions, causing the device to stop responding to new RPC requests until it is restarted, resulting in a denial of service.

A stored cross-site scripting (XSS) vulnerability exists in The Plus Addons for Elementor Page Builder Lite up to version 6.5.3. This vulnerability involves improper neutralization of input during web page generation, which could allow an attacker with low privileges to execute malicious scripts in the context of affected users. The vulnerability has a medium severity rating with a CVSS score of 6.5.