Threats affecting pkg:generic/zxc

A critical security vulnerability (CVE-2026-33186) affects the yunikorn-k8shim package, specifically related to the gRPC-Go implementation. Versions prior to 1.8.0-r4 are vulnerable. The flaw has a high impact on confidentiality and integrity but does not affect availability. A patch is available in version 1.8.0-r4.

A security vulnerability affecting the yunikorn-k8shim package has been identified and resolved in version 1.8.0-r5. The vulnerability has a CVSS 4.0 base score of 6.3, indicating a medium severity issue. The flaw allows network-based exploitation without user interaction but requires partial attack complexity and privileges. No known exploits are reported in the wild.

A security vulnerability identified as CVE-2026-84303 affects the yunikorn-k8shim package, specifically related to the gRPC-Go implementation. The issue impacts versions prior to 1.8.0-r4. The vulnerability has a medium severity rating with a CVSS score of 6.3. A fix is available in version 1.8.0-r4.

A high-severity security vulnerability (CVE-2026-84445) affects the yunikorn-k8shim package, specifically versions prior to 1.8.0-r4. The issue relates to the gRPC-Go implementation used within this package. A fix is available in version 1.8.0-r4.

A high-severity security vulnerability (CVE-2026-84304) affects the yunikorn-k8shim package, specifically versions prior to 1.8.0-r4. The issue involves the gRPC-Go implementation, which is the Go language version of gRPC. A fix is available in version 1.8.0-r4.

A security vulnerability in the yunikorn-k8shim package allows the Nickname profile to panic due to an out-of-bounds slice error when processing crafted input into a short destination buffer. This can cause a denial of service by crashing the affected component. The issue affects versions prior to 1.9.0-r1 and has been assigned CVE-2026-56851 with a high severity rating.

A concurrency issue in the yunikorn-k8shim package's HTTP/2 server implementation can cause crashes by inadvertently modifying the HPACK encoder concurrently. This vulnerability affects versions prior to 1.9.0-r1 and has been fixed in version 1.9.0-r1.

A security vulnerability in the yunikorn-k8shim package affects HTTP/1 servers where exceeding MaxBytesReader's limit causes the "Connection: close" header to be set automatically without synchronization. This can race with another header set explicitly in the server handler, potentially leading to inconsistent header states.

A critical security vulnerability in the yunikorn-k8shim package's HTTP/2 server allows connection-level flow control to be refunded twice for the same data. This occurs once when a client resets a stream and again when the request handler reads buffered data. This flaw affects versions prior to 1.9.0-r1 and has been fixed in version 1.9.0-r1.

A vulnerability in the yunikorn-k8shim package allows a malicious HTTP/2 peer to cause excessive CPU consumption on the client or server. This occurs when the attacker opens many streams and sends numerous small SETTINGS frames with SETTINGS_INITIAL_WINDOW_SIZE values. The issue affects versions prior to 1.9.0-r1 and has a high severity rating.

A security vulnerability in the yunikorn-k8shim package prior to version 1.9.0-r1 involves lax handling of malformed framing-related headers in its HTTP/2 implementation. Although these malformed headers cannot disrupt HTTP/2 framing, they can lead to a high-impact integrity issue. The vulnerability is rated with a CVSS score of 7.5 (high severity).

A security vulnerability in the yunikorn-k8shim package involves the use of system root certificates by Go on most platforms. This issue affects versions prior to 1.8.0-r3 and has been addressed in version 1.8.0-r3.

A security vulnerability in the yunikorn-k8shim package exists where the HTTP server uses client-sent "Trailer" headers to populate the request internally. This flaw affects versions prior to 1.9.0-r1 and can cause denial of service. A fix is available in version 1.9.0-r1.

A high-severity security vulnerability (CVE-2026-116587) affects the loki package, specifically versions prior to 3.5.12-r9. The vulnerability involves the Go JOSE implementation of Javascript Object Signing and Encryption standards, including JSON Web Encryption, Signature, and Token standards. The flaw does not impact confidentiality or integrity but results in a high impact on availability. A patch is available in version 3.5.12-r9.

A security vulnerability exists in the loki package's Go JOSE implementation, which handles Javascript Object Signing and Encryption standards including JWE, JWS, and JWT. Versions prior to 3.5.12-r9 are affected. The vulnerability has a medium severity with a CVSS score of 6.9. A fix is available in version 3.5.12-r9.

A security vulnerability exists in the loki package's Go JOSE implementation, which supports Javascript Object Signing and Encryption standards including JWE, JWS, and JWT. Versions prior to 3.5.12-r9 are affected. The vulnerability has a medium severity with a CVSS score of 6.9. A fix is available in version 3.5.12-r9.

A SQL injection vulnerability exists in projectworlds Visitor Management System 1.0 within the mysqli_query function of actionpage.php. This flaw allows remote attackers to manipulate the 'purpose' argument to execute arbitrary SQL commands. Exploit code has been published, and the vulnerability has a high severity rating with a CVSS score of 7.3.

A security flaw exists in Stirling-Tools Stirling-PDF versions up to 3.3.0 in the WorkflowParticipantController.getParticipantDetails function. The flaw causes an insufficient session timeout value, which can be exploited remotely. The vendor has not responded to disclosure attempts. The CVSS score is 5.3, indicating a medium severity vulnerability.

IBM Cyber Fraud versions 1.0.0 through 1.1.0 contain a cross-site scripting (XSS) vulnerability that allows unauthenticated attackers to inject arbitrary JavaScript into the web user interface. This can alter the intended functionality and potentially lead to credential disclosure within a trusted session.

IBM Cyber Fraud versions 1.0.0 through 1.1.0 contain a vulnerability that allows an unauthorized user to inject data into log messages. This occurs due to improper neutralization of special elements when writing to log files, potentially leading to log injection attacks.