Threats affecting pkg:bitnami/powershell

IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a critical vulnerability that allows remote attackers to execute arbitrary code. This is due to improper neutralization of special elements used in operating system commands, classified under CWE-94. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.

Share to Clipboard version 1.14.1 (versionCode 32) contains insecure permissions that allow unauthorized attackers to overwrite another user's clipboard content arbitrarily.

IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a vulnerability that allows a remote authenticated attacker to execute arbitrary SQL commands due to improper access control. This flaw could lead to high-impact integrity violations and limited availability impact. The vulnerability has a high severity score of 8.5 but no known exploits in the wild have been reported.

An insecure permissions vulnerability in craftxbox YubiClip XOR fork v1.0.1 (versionCode 10003) allows unauthorized attackers to trigger the OTP-clipboard mechanism, leading to desynchronization of the timing.

IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a server-side request forgery (SSRF) vulnerability that allows a remote authenticated attacker to obtain sensitive information. The vulnerability requires authentication and does not impact integrity or availability. The CVSS score is 4.3, indicating a medium severity risk.

lz233 Tarnhelm version 1.8.2 (versionCode 20250630) contains insecure permissions that allow unauthorized attackers to invoke an exported component. This vulnerability can lead to arbitrary data access and overwriting by unauthorized parties.

IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a server-side request forgery (SSRF) vulnerability that could allow a remote authenticated attacker to obtain sensitive information. The vulnerability does not impact integrity or availability but can lead to information disclosure. The CVSS score is 5.0 (medium severity). No patch or remediation details are provided in the available data.

IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a vulnerability that allows an authenticated attacker to create a server-generated ZIP archive with entry paths that traverse outside the intended extraction directory. If a victim extracts this archive using a tool that does not sanitize paths, it could lead to arbitrary file writes on the victim's system.

IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a vulnerability that allows remote attackers who can access the message broker to execute arbitrary code via deserialization of untrusted data. This flaw is identified as CWE-502 and has a high severity score of 8.1. The vulnerability requires network access with high attack complexity and no privileges or user interaction. No public exploits or patches are currently documented.

IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a vulnerability that allows a remote authenticated attacker to execute arbitrary code via deserialization of untrusted data. This flaw is identified as CWE-502 and has a high severity with a CVSS score of 8.8. The vulnerability requires authentication but no user interaction and impacts confidentiality, integrity, and availability.

An insecure permissions vulnerability in WikiAndPad alpha/beta version 0.2alpha03 (versionCode 200300) allows unauthorized attackers to export the application's data.

A malicious actor with local access and high privileges could exploit an Improper Access Control vulnerability found in WiFiman Desktop for macOS to escalate privileges on the host device.

A security update for Mozilla Firefox and Thunderbird addresses multiple vulnerabilities including sandbox escapes, use-after-free bugs, privilege escalations, information disclosures, and other memory safety issues across various components such as Graphics, DOM, JavaScript, and Networking. These vulnerabilities could allow attackers to escape sandbox restrictions, escalate privileges, or disclose sensitive information. The update is rated as important by Red Hat Product Security and affects Red Hat Enterprise Linux 9.2 variants.

CVE-2026-118773 is a medium severity vulnerability in the isaacs node-glob package affecting versions from 9.0.0 up to but not including 14.0.2. The flaw involves uncontrolled resource consumption due to improper handling of abort signals during file pattern matching and directory traversal. This can lead to excessive filesystem operations and CPU usage, potentially degrading service availability. The issue does not impact confidentiality or integrity. It is fixed in version 14.0.2.

A malicious actor with local access and low privileges could exploit an External Control of File Name or Path vulnerability found in WiFiman Desktop for macOS to execute arbitrary commands with root privileges on the host device.

A use-after-free vulnerability exists in librsvg when XML includes contain duplicated entities. This issue affects the glycin-loaders package used in Red Hat Enterprise Linux 10.0 Extended Update Support. The vulnerability has been rated as important by Red Hat Product Security and is addressed by an update to glycin-loaders.

A malicious actor with access to the network could exploit a Binding to an Unrestricted IP Address vulnerability found in WiFiman Desktop for macOS to obtain information about the host device.

CVE-2026-41216 is a high-severity vulnerability in vtk version 9.6 involving an expired pointer dereference in the vtkPNGReader::ExecuteInformation function. A specially crafted PNG file can trigger this flaw, causing a denial of service by crashing the application. No confidentiality or integrity impact is reported.