Threats affecting pkg:generic/libical

Sonatype Nexus Repository 3 has an authorization bypass vulnerability where a user with valid credentials and add or edit privileges on a group repository can add a repository they are not authorized to access. This allows the user to read content from that unauthorized repository via the group repository. Anonymous users can only exploit this if explicitly granted the necessary privileges by an administrator.

Sonatype Nexus Repository 3 has a SQL injection vulnerability in the optional "Reindex Search Tables By Pattern" task. This task is only available if the non-default setting nexus.reindex.search.by.pattern.visible is enabled. A user with the nexus:tasks:create privilege can supply a crafted filter condition that is executed as SQL, allowing modification of the Nexus database.

Sonatype Nexus Repository 3 has a vulnerability where an account with only read privileges on a YUM proxy or group repository can obtain the private signing key of that repository. This key allows the holder to sign repository metadata, potentially compromising repository integrity. The vulnerability does not require edit privileges, only read access.

A vulnerability in Sonatype Nexus Repository 3 allows a user with edit permissions on a hosted OCI repository to inject script content into the artifact type field of an OCI manifest. This script executes in the browser of any user who views the Attestations tab for the related image in the Browse UI, running with the permissions of the viewing user. This cross-site scripting (XSS) vulnerability can lead to unauthorized script execution in the context of the Nexus Repository web interface.

DeepSeek Harness versions prior to 0.1.2-alpha.2, specifically commit 3e24087, have a missing authentication vulnerability in the web profile HTTP and WebSocket RPC control plane. This flaw allows any local process, including those running under different OS users, to access unauthenticated session methods such as session.create and session.prompt. Exploitation enables attackers to execute arbitrary commands as the victim user, intercept live session traffic and logs, and bypass human tool-approval checks.

A cross-site scripting (XSS) vulnerability exists in InfiniFlow RAGFlow up to version 0.27.2 in the Images API component, specifically in the file api/utils/file_utils.py. The vulnerability can be exploited remotely and allows an attacker to execute malicious scripts. A public exploit is available. Upgrading to version 0.27.3 addresses this issue.

Yealink Plug-in Softwares prior to version 2.35.219.0 contain an unauthorized file write vulnerability that can be exploited under certain conditions to achieve remote code execution. This vulnerability is critical and has a high CVSS score of 9.0, indicating severe impact on confidentiality, integrity, and availability.

A critical OS command injection vulnerability exists in Linksys E5350 version 1.0.00.037 in the /wizard/apply.cgi file. The flaw arises from manipulation of the ping_ip or traceroute_ip arguments, allowing remote attackers to execute arbitrary OS commands. Public exploit code is available, but the vendor has not responded or provided a fix.

Yealink MeetingBoard Pro versions before 331.320.0.64 contain a front-end validation bypass vulnerability in the Web management module. An attacker with administrator privileges on the local network can manipulate the page DOM to bypass UI control logic and invoke screenshot functions that are normally restricted. Exploitation requires a valid administrator account and local network access.

Yealink UVC40 E2 devices running firmware versions before 319.410.0.71 are vulnerable to an attack by an adversary with short-term physical access. The attacker can extract Wi-Fi credentials through the USB interface and abuse sensitive firmware configuration data to gain root privileges. This enables audio and video eavesdropping within Wi-Fi coverage without triggering any LED alerts on the device.

A critical OS command injection vulnerability exists in the Ping Diagnostic component of Linksys WRT54GL version 4.30.18. The flaw is in the system function of the apply.cgi file, where manipulation of the ping_ip argument allows remote attackers to execute arbitrary OS commands. The vulnerability is publicly known with available exploit code. However, the affected product is no longer supported by the vendor, and no patch or official response has been provided.

A cross-site scripting (XSS) vulnerability exists in EmpireSoft EmpireCMS up to version 8.0 in the /e/member/mspace/index.php file. The flaw is triggered by manipulation of the spacename argument and can be exploited remotely. Public exploit code is available, but the vendor has not responded or issued a fix. The CVSS score is 3.5, indicating low severity.

A critical remote command injection vulnerability exists in the Traceroute Diagnostic Function of Linksys WRT54GL firmware version 4.30.18. The flaw is in the system function of the apply.cgi file, where manipulation of the traceroute_ip argument allows an attacker with high privileges to execute arbitrary OS commands. This vulnerability affects an unsupported product, and no vendor response or patch is available. Public exploit code has been disclosed.

Invoice Ninja versions before 5.13.28 have a broken access control vulnerability that allows authenticated vendor-portal users to access documents of other vendors and clients. This occurs because authorization checks validate only company_id scope instead of verifying vendor ownership. Attackers can exploit predictable sequential Hashids document identifiers due to a default empty HASH_SALT to download invoice PDFs, contracts, payment receipts, and expense attachments belonging to other vendors within the same company.

Node Version Manager (nvm) versions 0.40.0 through 0.40.8 contain a vulnerability where the commands 'nvm use --save' and 'nvm install --save' write the resolved Node.js version string to a .nvmrc file in the current directory using 'tee', which follows symbolic links. If the .nvmrc file is a symlink to a file outside the repository, this can cause unintended truncation and overwriting of arbitrary writable files, such as shell startup files or SSH authorized_keys, resulting in data loss. Version 0.41.0 fixes this by refusing to write to .nvmrc if it is a symlink, issuing a warning instead.

Alan: Health Insurance for Android version 1.450.0 contains a path traversal vulnerability in its exported ShareReceiverActivity. This flaw allows a malicious app on the same device to write files outside the intended directory by exploiting an unsanitized _display_name parameter. Attackers can overwrite sensitive files within the app's sandbox, such as databases and WebView data, potentially enabling state tampering or code execution without user interaction or authentication.

Node Version Manager (nvm) versions 0.5.0 through 0.40.8 contain an argument injection vulnerability (CWE-88) where version patterns from a .nvmrc file starting with '-' are interpreted as grep options. This causes unintended recursive directory searches, potentially leaking sensitive data such as npm tokens from symlinked files to terminal output and logs. The issue is fixed in version 0.41.0 by passing version patterns to grep with the '-e' option.

Node Version Manager (nvm) versions 0.2.0 through 0.40.8 do not properly check if the .nvmrc file is a symbolic link. This allows an attacker to craft a symlinked .nvmrc pointing to arbitrary files, causing nvm commands to read and print the contents of those files in command output or logs. Version 0.41.0 fixes this by not printing the contents of symlinked .nvmrc files and only accepting valid version strings or aliases.

CVE-2026-122016 is a medium severity vulnerability in yangzongzhuan RuoYi-Vue versions 3.9.0, 3.9.1, and 3.9.2. It involves improper privilege management in the SysPermissionService.getMenuPermission function, allowing remote attackers to manipulate permissions arguments. The vendor has not responded to disclosure attempts, and no patch or fix information is currently available.

Node Version Manager (nvm) versions 0.27.0 through 0.40.8 contain a vulnerability where the 'nvm use --delete-prefix' command can cause npm to rewrite arbitrary configuration files chosen by a project's .npmrc file. This can corrupt files such as ~/.bashrc or leave configuration files with insecure permissions, potentially allowing local users on shared machines to modify them. The vulnerability is fixed in version 0.41.0, which prevents a project .npmrc from selecting which config file is edited.