Threats affecting pkg:generic/libucl

CVE-2026-118131 is a published vulnerability affecting Microsoft product version 3.0. No detailed technical information, impact, or exploit data is provided. There is no CVSS score or vendor advisory content available to clarify the nature or severity of the vulnerability.

CVE-2026-97631 is a vulnerability in the EDK II PXE driver related to pre-boot remote code execution. The description and details are limited, with no CVSS score or exploit reports available. The affected versions include exactly version 3.0 and the edk2 version of the product. No patch or remediation information is provided, and no known exploits in the wild have been reported.

CVE-2026-116591 is a vulnerability in the compress zstd component of Microsoft software version 3.0 that causes a panic when processing two-block frames. The issue relates to an integer overflow or similar error classified under CWE-190. No CVSS score or detailed impact information is provided.

A vulnerability identified as CVE-2026-116585 affects version 3.0 of a Microsoft product related to Go JOSE, causing a panic during CBC-HMAC processing. The issue is categorized under CWE-129, indicating an improper validation of array index or similar error. No CVSS score or detailed impact information is provided, and no patch or remediation details are available.

CVE-2026-116587 is a denial-of-service (DoS) vulnerability in the Go JOSE library when parsing JSON Web Keys (JWKs) that contain RSA keys. The issue affects version 3.0 of the Microsoft product implementing this library. No CVSS score or detailed impact information is provided.

CVE-2026-116586 is a vulnerability in the Go JOSE library version 3.0 that causes panics during JSON parsing. The issue relates to improper handling of JSON input, potentially leading to application crashes.

A vulnerability identified as CVE-2026-97045 affects version 3.0 of the golang.org/x/net package, related to checking all ancestor namespace transitions when rendering raw text in HTML. The advisory lacks detailed technical information and impact description.

A vulnerability identified as CVE-2026-78661 involves quadratic complexity when coalescing text nodes in the golang.org/x/net package. The issue is specifically noted in version 3.0 of the affected software. No CVSS score or detailed impact information is provided.

A vulnerability identified as CVE-2026-119568 affects vsftpd version 3.0. It involves a bypass of the require_ssl_reuse setting through FTPS data channel hijacking. This could allow an attacker to circumvent security controls intended to enforce SSL session reuse in FTPS connections.

CVE-2026-119567 is a vulnerability in vsftpd version 3.0 that allows bypassing the cmds_denied restriction via RFC 775 command aliases. This flaw could enable unauthorized command execution by circumventing intended command denial mechanisms.

A vulnerability in SQLite versions before 3.54.0 involves stack exhaustion triggered via the countOfViewOptimization() function in the VALUES clause. This flaw could potentially lead to denial of service conditions due to resource exhaustion. The affected version explicitly noted is 3.0. No CVSS score or detailed impact metrics are provided.

CVE-2026-119586 is a command injection vulnerability in the SQLite CLI up to version 3.54.1 related to the .recover output functionality. The vulnerability allows an attacker to inject commands via the output of the .recover command. No CVSS score or detailed impact information is provided.

A heap buffer overflow vulnerability exists in SQLite versions before 3.54.0 in the session extension function sessionUpdateFind(). This flaw could potentially lead to memory corruption. No CVSS score or detailed impact information is provided.

CVE-2026-119378 is a use-after-free vulnerability in SQLite versions before 3.54.0, specifically in the R-Tree module's nodeWrite() function. This flaw could lead to memory corruption issues.

A vulnerability identified as CVE-2026-119377 affects SQLite versions before 3.54.0, specifically version 3.0 is noted as affected. The issue involves an authorizer bypass via RIGHT or FULL JOIN USING clauses. No CVSS score or detailed impact information is provided. No patch or remediation details are available in the input data.

CVE-2026-119376 is a vulnerability in SQLite versions before 3.54.0 involving stack exhaustion via the COLLATE operator chain. This flaw relates to improper handling of collate sequences that can lead to excessive stack usage.

CVE-2026-119375 is an information disclosure vulnerability affecting SQLite versions before 3.54.0. The issue involves a WAL (Write-Ahead Logging) page size mismatch that could potentially expose sensitive information. No CVSS score or detailed impact information is provided. No known exploits are reported in the wild. The affected version explicitly mentioned is SQLite version 3.0.

CVE-2026-119374 is a heap buffer overflow vulnerability in SQLite versions before 3.54.0, specifically related to the FTS5 module's fts5DoSecureDelete() function. This flaw could potentially lead to memory corruption issues.

A heap buffer overflow vulnerability exists in SQLite versions before 3.54.0 in the fts5MergeRowidLists() function. This flaw could lead to memory corruption when processing full-text search operations.

CVE-2026-119372 is a use-after-free vulnerability in SQLite versions before 3.54.0, specifically in the FTS3 module's fts3BestSnippet() function when accessed via snippet(). This flaw could lead to memory corruption issues. No CVSS score or detailed impact information is provided. No patch or remediation details are available in the input data.