Threats affecting pkg:generic/libical

CVE-2026-82418 is a critical use-after-free vulnerability in IBM Watson Speech Services Cartridge versions 4.0.0 through 5.4.0. This flaw could allow a remote attacker to execute arbitrary code without any user interaction or privileges.

CVE-2026-17493 is an out-of-bounds read vulnerability in IBM Watson Speech Services Cartridge versions 4.0.0 through 5.4.0. This flaw could be exploited remotely to cause a denial of service condition. The vulnerability does not impact confidentiality or integrity but results in service disruption.

A vulnerability has been found in NPC-Worldwide npcpy up to 2.1.27. This affects the function load_sft_model of the file npcpy/ft/sft.py. The manipulation of the argument base_model_name_or_path leads to code injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

IBM Db2 Genius Hub versions 1.1.2 through 1.1.5 contain a vulnerability where error messages expose sensitive internal implementation details. This information disclosure could be exploited by a remote authenticated attacker to gain sensitive information. The vulnerability is classified under CWE-209 and has a medium severity with a CVSS score of 4.3.

IBM Db2 Genius Hub versions 1.1.2 through 1.1.5 have a vulnerability where a missing Content Security Policy (CSP) header could allow a remote authenticated attacker to bypass certain security restrictions. The issue is classified under CWE-693, indicating a protection mechanism failure. The vulnerability has a low severity score of 3.5 and does not impact confidentiality, integrity, or availability significantly.

IBM Db2 Genius Hub versions 1.1.2 through 1.1.5 contain a vulnerability where improper restriction of rendered UI layers or frames allows a remote authenticated attacker to bypass security restrictions. This issue could lead to limited confidentiality and integrity impacts but does not affect availability. The vulnerability has a medium severity rating with a CVSS score of 4.6.

IBM Db2 Genius Hub versions 1.1.2 through 1.1.5 have a security vulnerability where the absence of the X-Content-Type-Options header allows MIME type sniffing. This can enable a remote authenticated attacker to bypass security restrictions. The vulnerability is classified under CWE-693 (Protection Mechanism Failure) and has a medium severity rating with a CVSS score of 5.4.

IBM Db2 Genius Hub versions 1.1.2 through 1.1.5 contain a vulnerability that allows remote authenticated attackers to perform HTTP response splitting due to improper neutralization of HTTP headers. This vulnerability is identified as CWE-113 and has a medium severity rating with a CVSS score of 4.3.

IBM Db2 Genius Hub versions 1.1.2 through 1.1.5 contain a vulnerability that allows a local attacker to cause a denial of service by triggering uncontrolled resource consumption. The vulnerability is identified as CWE-400 and results in availability impact without affecting confidentiality or integrity.

IBM Db2 Genius Hub versions 1.1.2 through 1.1.5 contain a vulnerability due to a missing required cryptographic step. This flaw could allow a remote authenticated attacker to obtain sensitive information. The vulnerability has a medium severity rating with a CVSS score of 4.3.

IBM Db2 Genius Hub versions 1.1.2 through 1.1.5 contain a vulnerability due to improper TLS certificate validation. This flaw could allow an attacker to perform a man-in-the-middle attack to obtain sensitive information. The vulnerability has a medium severity rating with a CVSS score of 5.9.

IBM Db2 Genius Hub versions 1.1.2 through 1.1.5 contain an improper access control vulnerability that allows a remote authenticated attacker to bypass security restrictions. This flaw could lead to unauthorized modification of data or system state without impacting confidentiality or availability.

IBM Db2 Genius Hub versions 1.1.2 through 1.1.5 contain a vulnerability classified as CWE-99 Resource Injection. This flaw allows a remote authenticated attacker to cause a denial of service by exploiting improper validation of user-influenced resource identifiers. The vulnerability has a CVSS 3.1 base score of 4.3, indicating medium severity, with no impact on confidentiality or integrity but causing availability disruption.

IBM Db2 Genius Hub versions 1.1.2 through 1.1.5 contain an open redirect vulnerability (CWE-601) that could allow a remote authenticated attacker to conduct phishing attacks by redirecting users to malicious sites.

A prototype pollution vulnerability exists in the GraphML decoder of draw.io versions prior to 31.1.5. This flaw allows attacker-controlled GraphML reference keys to modify inherited object properties, including prototype objects, by assigning malicious attributes. When a malicious GraphML file is imported and the editor is used in Trello mode with the Trello integration invoked, this polluted state can lead to cross-site scripting (XSS) execution within the draw.io origin. The vulnerability is fixed in version 31.1.5.

A Server-Side Request Forgery (SSRF) vulnerability exists in draw.io versions prior to 30.3.8 in the optional /proxy endpoint. The URL validator does not block requests to the RFC 6598 shared address range 100.64.0.0/10, allowing unauthenticated remote attackers to make the server request internal services within this range. This could lead to disclosure of data from Carrier-Grade NAT, Kubernetes, cloud, or overlay-network addresses. The issue is fixed in version 30.3.8.

CVE-2026-104203 is a vulnerability in Traccar, an open source GPS tracking system, affecting versions from 5.1 up to but not including 6.15.0. It allows an unauthenticated attacker to bypass session and device authorization checks by exploiting a path parameter parsing discrepancy between MediaFilter and Jetty ResourceServlet. This enables read-only access to protected device media files such as photographs, audio, or video. The issue is fixed in version 6.15.0.

CVE-2026-122013 is a critical path traversal vulnerability in the Comfast CF-WR632AX device version 2.6.0.1. The flaw exists in the Multipart Parser component of the /usr/bin/webmgnt file, allowing remote attackers to manipulate the filename argument to perform path traversal. Exploit code is publicly available, and the vendor has not responded to disclosure requests.

SumatraPDF versions 3.6.1 and earlier contain a vulnerability in the HttpGet() function where hostname validation is disabled for HTTPS update metadata and crash-symbol requests. This allows a network attacker with a trusted certificate for a malicious domain to impersonate the update server, inject malicious promotional content, and supply attacker-controlled archives to the symbol extraction process. Direct installer replacement is prevented by additional TLS validation and host restrictions. No fixed version is currently available.

CVE-2026-102664 is a vulnerability in ProxySQL prior to versions 3.0.10, 3.1.10, and 4.0.10. It involves improper handling of compressed MySQL payloads where the decompression function does not verify that the output length matches the attacker-controlled payload length. This can lead to the proxy forwarding uninitialized heap buffer data to the backend, potentially disclosing sensitive information such as prior SQL queries, result data, credentials, or session state. The flaw also allows malformed lengths to cause excessive memory allocations. The issue has been fixed in the specified versions.