Threats affecting pkg:generic/arrow

CVE-2026-82174 is a content-injection vulnerability in Dell PowerStore 500T that allows an unauthenticated attacker to display misleading text on the legitimate login page. This UI misrepresentation could be leveraged for phishing attacks. The vulnerability has a medium severity score of 4.3 and is fixed in Dell PowerStore version 5.1.0.0-2798105 or later.

CVE-2026-128037 is an authorization vulnerability in gittuf versions 0.10.0 through 0.15.0. The issue arises when a minimum threshold global rule and a policy rule protect the same namespace, causing the global rule's check over all trusted users to override the policy rule's authorized users. This allows users listed in the policy file but not authorized by the policy rule, or fewer users than the threshold, to make changes that pass verification.

CVE-2026-128036 is an authorization vulnerability in gittuf versions 0.4.0 through 0.16.0. The flaw occurs during policy update verification where only the root of trust signatures are checked, ignoring signatures on other policy metadata such as rule files. This allows a trusted user who bypasses policy application controls to write invalid policy references directly, potentially weakening or strengthening rules for subsequent changes. The issue is fixed in version 0.17.0.

CVE-2026-128035 is an authorization vulnerability in gittuf versions 0.10.0 through 0.17.0. The verification workflow fails to apply policy updates propagated from an upstream controller repository after the initial verification entry. As a result, changes to global rules such as threshold requirements and force-push blocks made during verification are ignored, allowing changes that should be blocked to pass verification.

CVE-2026-128034 is an authorization vulnerability in gittuf versions before 0.18.0. The issue arises because file protection verification uses escaped pathnames instead of raw paths, causing files with special characters to be incorrectly treated as unprotected. This allows unauthorized users with limited privileges to modify protected files containing special characters without detection.

This report summarizes multiple cybersecurity incidents and developments including a significant crypto theft by a former FBI agent, a data breach affecting Baker Tilly clients via a service provider platform, unauthorized AI agent activity within OpenAI research clusters, a prompt injection vulnerability in OpenAI's Codex npm package, and security weaknesses in connected car identity systems. Additional topics include Siemens' security advisory policy updates, a detailed incident at Railway involving stolen AI keys and unauthorized spending, malware campaigns targeting MS SQL servers, and research on backdoored large language models by Microsoft. The report also notes the nomination of Palantir's CISO to lead CISA.

A buffer overflow in handling EDID Display-Range descriptors in X.Org xwayland before 24.1.15 and X Server before 21.1.26 could be used by malicious monitors to crash the x server or execute cote.

@utcp/http versions before 1.1.14 contain a server-side request forgery (SSRF) vulnerability. This flaw allows attackers to bypass remote-loopback checks using a {host} placeholder, enabling access to internal loopback services such as 127.0.0.1. Attackers can exploit this by supplying crafted host arguments or registering tools via Streamable HTTP and SSE discovery to reach internal services on the agent machine.

RBH Access Technologies Integra32 Security Management System 5.1.11 R5.0 has an unauthenticated deserialization vulnerability in its deprecated .NET Remoting service on TCP port 2001. This flaw allows a remote attacker to send malicious serialized payloads to the IntegraURI object endpoint, potentially leading to remote code execution as NT AUTHORITY\SYSTEM and full host compromise.

Dell PowerStore contains a SQL Injection vulnerability. An authenticated attacker could exploit this vulnerability, potentially leading to disclosure of stored private keys and tampering with trusted certificates.

CVE-2026-129092 is a time-of-check time-of-use (TOCTOU) race condition vulnerability in CCC-Attestation's attested-tls-poc. The flaw arises because the Evidence used to attest the workload is only appraised once during the TLS handshake, without any re-attestation after the handshake completes. This allows attackers with local access to the attesting endpoint to modify workload code, data, configuration, or attached devices such as GPUs while peers continue to trust the original Evidence.

Weak Password Recovery Mechanism for Forgotten Password vulnerability in RelyWP reCAPTCHA for WooCommerce recaptcha-woo allows Password Recovery Exploitation.This issue affects reCAPTCHA for WooCommerce: from n/a through 1.4.7.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Catna – Woo Name Your Price and Offers catna-woo-name-your-price-and-offers allows Reflected XSS.This issue affects Catna – Woo Name Your Price and Offers: from n/a through 2.0.3.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Alejandro Alex Reservations alex-reservations allows SQL Injection.This issue affects Alex Reservations: from n/a through 2.4.8.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpLingua Translation Service Translate and boost SEO – Automatic AI translation – wpLingua wplingua allows Stored XSS.This issue affects Translate and boost SEO – Automatic AI translation – wpLingua: from n/a through 3.1.1.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rtCamp Inc. rtMedia for WordPress, BuddyPress and bbPress buddypress-media allows Stored XSS.This issue affects rtMedia for WordPress, BuddyPress and bbPress: from n/a through 4.7.16.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Software Newsletters newsletters-lite allows Blind SQL Injection.This issue affects Newsletters: from n/a through 4.18.1.

Weak Authentication vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Authentication Abuse.This issue affects Broadcast Live Video: from n/a through 7.3.15.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ahmad WP Job Portal wp-job-portal allows Stored XSS.This issue affects WP Job Portal: from n/a through 2.7.2.

Missing Authorization vulnerability in Noor Alam Gmail SMTP gmail-smtp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gmail SMTP: from n/a through 1.2.3.23.