Threats affecting pkg:generic/libucl

A denial of service vulnerability exists in pyasn1 version 0.6.4 and earlier used by aws-shell, where decoding certain constructed ASN.1 string types or indefinite-length ANY types can cause quadratic CPU time consumption. This occurs due to inefficient string concatenation in the decoder, leading to CPU exhaustion when processing attacker-controlled inputs. The vulnerability affects BER and CER decoding paths and certain non-conforming DER inputs. No confidentiality or integrity impact is reported. The CVSS v3.1 base score is 7.5 (high severity).

CVE-2026-119194 is a high-severity vulnerability in pyasn1 used by aws-shell that causes quadratic CPU usage when decoding attacker-controlled BER, CER, or DER data without an ASN.1 schema. The flaw arises from inefficient handling of tag sets during schemaless decoding, allowing crafted inputs with many distinct long tag IDs to exhaust CPU resources and degrade service availability. No confidentiality or integrity impacts are reported.

pyasn1 versions up to 0.6.4 contain a denial of service vulnerability due to quadratic complexity in decoding binary-encoded ASN.1 REAL values with large mantissas. This causes excessive CPU consumption during decoding, potentially exhausting CPU resources. The issue affects BER, CER, and DER decoders that use the vulnerable RealPayloadDecoder. The vulnerability is fixed in pyasn1 version 0.6.5.

A vulnerability in pyasn1 versions up to 0.6.4 causes quadratic CPU consumption when decoding constructed BIT STRING values with many fragments. This can lead to CPU exhaustion and denial of service if attacker-controlled ASN.1 data is decoded. The issue affects BER and CER decoders and certain schema-driven DER decoding paths. The vulnerability does not impact confidentiality or integrity but can cause service disruption.

OAuthlib's token grant handlers allow an authenticated low-privilege client to supply a different client_id in the token request body, causing authorization checks to be performed under that other client identity. This affects the client_credentials and password grant flows where the application validator uses the client_id argument for authorization. The flaw enables a token authorization bypass where a low-privilege client can obtain tokens with scopes or grant types assigned to a higher-privilege client.

The Newsletters plugin for WordPress up to version 4.18.1 contains a time-based SQL Injection vulnerability in the 'id' parameter. This flaw allows authenticated users with subscriber-level access or higher to inject additional SQL queries due to insufficient input escaping and validation. Attackers can obtain necessary authentication tokens by subscribing through the public form and exploiting weak ownership checks, potentially extracting sensitive database information.

FeedWordPress plugin for WordPress versions up to and including 2026.0517 is vulnerable to stored Cross-Site Scripting (XSS) via syndicated RSS/Atom feed content. The vulnerability arises because the plugin's content sanitization is insufficient, allowing unauthenticated attackers controlling an external feed to inject malicious scripts that execute when users access the injected pages.

The WP Activity Log plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in all versions up to and including 5.6.1. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts that execute when users access the affected pages.

The Acadlix LMS plugin for WordPress versions up to and including 1.1.9 contains a path traversal vulnerability in the post_delete_assessment_file_by_id function. This flaw allows authenticated users with subscriber-level access or higher to delete arbitrary files on the server due to insufficient file path validation. The vulnerability is exacerbated by weak permission checks relying on a publicly exposed nonce, effectively allowing unauthenticated exploitation. Successful exploitation can lead to remote code execution by deleting critical files such as wp-config.php.

The Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News WordPress plugin contains a stored cross-site scripting (XSS) vulnerability in the 'display_name' parameter. This affects all versions up to and including 4.0.9. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users interact with the affected author filter block on pages containing certain grid or live-filter blocks.

The All in One SEO – AI SEO Plugin for WordPress up to version 5.0.3 contains a vulnerability that allows unauthenticated attackers to extract sensitive non-public post meta data. This includes sensitive custom fields such as API keys and internal notes, which are exposed via the 's' parameter and included verbatim in the HTML title element and JSON-LD SearchResultsPage schema. The vulnerability is classified as CWE-200, Exposure of Sensitive Information to an Unauthorized Actor.

The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications WordPress plugin up to version 3.10.2 contains an arbitrary file upload vulnerability. This flaw allows unauthenticated attackers to upload potentially executable files by bypassing extension and MIME type validation through a trailing-dot filename. The vulnerability arises from missing server-side file key allowlist and inadequate pre-sanitization in the handle_upload function. The only access control is a nonce embedded in public forms, which is easily obtainable by any visitor, enabling remote code execution.