Threats affecting pkg:generic/libucl

Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress versions up to 3.15.5 contains a stored cross-site scripting (XSS) vulnerability. This flaw arises from insufficient input sanitization and output escaping of the 'formData.extra' parameter. Unauthenticated attackers can inject arbitrary scripts that execute when users access the affected pages. The vulnerability is exacerbated by the nf_ajax_submit endpoint issuing a valid nonce on failure, bypassing nonce protections and enabling trivial exploitation via a single unauthenticated request.

WordPress Core versions from 4.7 through 7.1.3 are affected by a time-of-check to time-of-use (TOCTOU) race condition vulnerability. This flaw arises from predictable, web-accessible staging paths used during full-package core upgrades, allowing unauthenticated attackers to execute arbitrary code on the server during the upgrade process. The vulnerability has a high severity with a CVSS score of 8.1.

The Meow Lightbox plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'post_content (bbPress reply body)' parameter in all versions up to and including 5.6.4. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary JavaScript that executes in the context of users viewing the affected pages. Exploitation requires specific conditions including enabled Output Buffering, the HtmlDomParser engine, Aggressive Resolve, and a stored-HTML submission surface with a permissive kses allow-list for img attributes.

The NextGEN Gallery WordPress plugin (Photo Gallery, Sliders, Proofing and Themes) up to version 4.5.4 is vulnerable to stored DOM-based cross-site scripting (XSS) via the 'comment' parameter. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when users view affected pages, but exploitation requires the site to use the Shutter or Shutter Reloaded lightbox and for the injected comment to be approved through WordPress moderation.

Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress versions up to 3.15.5 contains a code injection vulnerability. Authenticated users with subscriber-level access or higher can exploit this flaw by setting their display name to a shortcode string and triggering its execution on a page configured by an administrator with a specific merge tag. This allows arbitrary shortcode execution due to improper validation before calling do_shortcode.

CVE-2026-98432 is a memory corruption vulnerability in the Linux kernel's IPv4 TCP handshake path affecting kernel versions 4.4 and later. This flaw could lead to remote code execution. AWS has released updated kernel packages for Amazon Linux 2 and Amazon Linux 2023 to address this issue. Customers running self-managed Linux instances are advised to update and reboot their systems. AWS-managed services are being updated by AWS with no customer action required.

The File Force Download module for Drupal 7 improperly grants access to files in certain schemes by returning Content-Disposition headers without proper access checks. Specifically, versions 7.1.0 through 7.1.2 allow unauthenticated users to download files in the temporary:// scheme or other stream wrappers by appending a download=1 parameter to the file URL. Public and private scheme files are not affected.

CVE-2026-116755 is an OS command injection vulnerability in the Orchestrator component of SoftIron HyperCloud versions 1.0 through 2.6.17. It allows an authenticated user with management plane access to execute arbitrary OS commands on hypervisor hosts as the privileged orchestration user. The flaw arises from improper handling of attacker-controlled VM template content during lifecycle operations. The issue is fixed in version 2.6.18.

CVE-2026-115905 is a vulnerability in Microsoft software version 3.0 involving zip file parsing. It relates to a critical parser differential and security control bypass caused by dual-header inconsistencies, a technique referred to as Zip Cloaking. The vulnerability is categorized under CWE-20, indicating improper input validation. No CVSS score or detailed impact metrics are provided. No patch or remediation details are available at this time.

A vulnerability in Microsoft software version 3.0 involves unbounded handling of symlink targets during ZIP file extraction, which can cause the extraction process to abort or exhaust system memory.

A vulnerability identified as CVE-2026-115906 affects Microsoft software version 3.0, involving an AES entry HMAC authentication bypass triggered by a premature end-of-file (EOF) condition in ZIP processing.

CVE-2026-65628 is a vulnerability in Microsoft product version 3.0 involving infinite recursion in the JOSE.JWK.shared_secret/2 function when there are mismatched key types. This flaw can lead to CPU denial-of-service conditions.

The erlang-jose library version 3.0 contains a vulnerability in RSA JWK parsing where it attempts to factor an attacker-controlled modulus. This behavior can lead to CPU exhaustion, resulting in a denial of service condition.

CVE-2026-65627 is a vulnerability involving a decompression bomb via unbounded zlib:inflate in the jose_jwe_zip:uncompress/2 function. It affects Microsoft product version 3.0. No CVSS score or detailed impact information is provided.

CVE-2026-65626 is a vulnerability involving a Bleichenbacher padding oracle attack in the RSAES-PKCS1-v1_5 decryption implementation within the jose library, specifically affecting version 3.0. The vulnerability allows an attacker to exploit the padding oracle to potentially decrypt RSA-encrypted messages without the private key. No CVSS score or detailed impact information is provided.

A vulnerability identified as CVE-2026-65632 affects Microsoft product version 3.0, where the ECDSA signature length is not validated in the jose library, allowing signature malleability. This flaw could potentially allow attackers to manipulate signatures without detection.

This vulnerability involves weak PBKDF2 parameters used for password-encrypted private-key export in the jose library version 3.0. Weak PBKDF2 parameters can reduce the effectiveness of password-based key derivation, potentially making it easier for attackers to recover passwords from encrypted private keys.

CVE-2026-65625 is a vulnerability in Microsoft product version 3.0 where an attacker can control the AES-GCM authentication tag length, enabling tag forgery. This flaw relates to improper handling of authentication tags in cryptographic operations.

A timing side-channel vulnerability exists in the pure-Erlang implementation of X25519 scalar multiplication in the jose library version 3.0. This flaw can leak the private key during cryptographic operations.