Threats affecting pkg:generic/kimageformats

This vulnerability involves incorrect boundary conditions in the JavaScript Engine's Just-In-Time (JIT) component in Microsoft software version 4.0. The issue is categorized under CWE-119, indicating a potential buffer-related error. No CVSS score or detailed impact information is provided. There is no indication of active exploitation in the wild, and no patch or remediation details are available.

CVE-2026-100813 is a vulnerability involving an invalid pointer in the JavaScript Engine's JIT component in Microsoft software version 4.0. The vulnerability is identified as CWE-763. No CVSS score or detailed impact information is provided, and no known exploits are reported in the wild. No patch or remediation details are available at this time.

A use-after-free vulnerability in the DOM Core & HTML component of Microsoft software version 4.0 can lead to a sandbox escape. This vulnerability allows an attacker to potentially break out of the restricted execution environment. No CVSS score or detailed impact information is provided.

CVE-2026-100810 is a vulnerability in the DevTools component of Microsoft software version 4.0. The available information is limited and does not specify the nature of the issue beyond referencing a CWE-200 classification, which relates to information exposure. No CVSS score or detailed impact description is provided.

CVE-2026-100809 is a vulnerability involving a same-origin policy bypass in the DevTools component of Microsoft software version 4.0. The same-origin policy is a critical security mechanism that restricts how documents or scripts loaded from one origin can interact with resources from another origin. This bypass could potentially allow unauthorized access to restricted resources. No CVSS score or detailed impact information is provided, and there are no known exploits in the wild. No patch or remediation details are available at this time.

A mitigation bypass vulnerability exists in the DOM Service Workers component of Microsoft software version 4.0. The vulnerability is identified as CVE-2026-100808 and is categorized under CWE-693. No CVSS score or detailed impact information is provided. No patch or remediation details are available at this time.

This vulnerability involves a privilege escalation issue in the Service Workers component of Microsoft software version 4.0. No CVSS score or detailed technical information is provided. The description references Microsoft's support lifecycle but does not elaborate on the flaw or its exploitation.

A race condition and use-after-free vulnerability exists in the Audio/Video component of Microsoft software version 4.0. The vulnerability is identified as CVE-2026-100805 and is classified under CWE-362. No CVSS score or detailed impact information is provided, and no patch or remediation details are available.

A use-after-free vulnerability exists in the Preferences: Backend component of Microsoft software version 4.0, which could allow a sandbox escape. This vulnerability is identified as CVE-2026-100804 and is categorized under CWE-416. No CVSS score or detailed impact information is provided, and no known exploits are reported in the wild. There is no information about available patches or vendor advisories.

A same-origin policy bypass vulnerability exists in the WebExtensions component of Microsoft software version 4.0. This flaw could potentially allow unauthorized cross-origin interactions that violate the browser's security model. No CVSS score or detailed impact information is provided, and no known exploits are reported in the wild.

A privilege escalation vulnerability exists in the DLL Services component of Microsoft software version 4.0. The vulnerability has been published but lacks detailed technical information and a CVSS score. No known exploits are reported in the wild, and no patch or remediation details are provided.

CVE-2026-100800 is a use-after-free vulnerability in the Disability Access APIs component of Microsoft software version 4.0. This flaw could allow a sandbox escape, potentially enabling an attacker to break out of restricted execution environments.

CVE-2026-100798 is a vulnerability involving cryptography misuse in the Storage: Quota Manager component of Microsoft software version 4.0. The issue is categorized under CWE-325, which relates to improper cryptographic usage. No CVSS score or detailed impact information is provided.

A use-after-free vulnerability in the Graphics: WebRender component of Microsoft software version 4.0 can lead to privilege escalation. This vulnerability is identified as CVE-2026-100797 and is categorized under CWE-416. No CVSS score or detailed impact information is provided. No patch or remediation details are available at this time.

CVE-2026-123607 is a denial of service vulnerability in Hickory DNS related to the NSEC3 Closest-Encloser Proof, causing an unbounded loop. The vulnerability affects version 4.0 of the Microsoft product. No CVSS score or detailed impact information is provided. No patch or remediation details are available.

A use-after-free vulnerability exists in the JavaScript WebAssembly component of Microsoft software version 4.0. The vulnerability has been publicly disclosed but lacks detailed technical information and a CVSS score. No known exploits are reported in the wild, and no patch or remediation details are provided.

A sandbox escape vulnerability exists in the Internationalization component of Microsoft software version 4.0 due to incorrect boundary conditions. This flaw could potentially allow an attacker to break out of the sandbox environment.

A security vulnerability in the miniforge3 package's imaplib module allows injection of additional commands when a user-controlled command includes newlines. This flaw affects versions prior to 25.11.0.1-r6, 26.1.1.3-r4, and 26.3.2.3-r6. The vulnerability has a medium severity score of 5.9 and has been fixed in the specified versions.

CVE-2026-4360 is a medium severity security vulnerability in the miniforge3 package affecting versions prior to 25.11.0.1-r6. The issue relates to the Tarfile component and can lead to integrity impact without confidentiality or availability impact. A fix is available in version 25.11.0.1-r6.

A security vulnerability identified as CVE-2026-3446 affects the miniforge3 package. The issue has been resolved in version 25.11.0.1-r6. The vulnerability has a medium severity rating with a CVSS score of 6. No known exploits are reported in the wild.