Threats affecting pkg:generic/arrow

The npm package 'berg-fonbock' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removing the package alone does not guarantee removal of all malicious components, as the attacker may have established persistent control.

CVE-2026-123975 is a high-severity heap out-of-bounds write vulnerability in Grid Community Toolkit versions before 6.2.20261111 and globus-gss-assist before 12.9. It occurs in the function globus_gss_assist_token_get_fd() when processing SSLv2 record lengths below 3. Remote unauthenticated attackers can exploit this by sending crafted GSI handshake records to services such as globus-gatekeeper and myproxy, causing heap corruption and service crashes. A fix is available in versions 6.2.20261111 and 12.9.

xschem versions 2.9.9 through 3.4.7 have a heap out-of-bounds write vulnerability in the read_dataset() function of src/rawtovcd.c. This flaw arises from an unchecked variable index when processing crafted ngspice .raw files, allowing heap memory corruption.

xschem 2.9.9 through 3.4.7 contains an out-of-bounds read vulnerability in read_xschem_file() in src/save.c that mishandles embedded-symbol records lacking a preceding instance. Attackers can supply a crafted schematic beginning with a "[" record, causing xschem to read and dereference memory below the instance array and crash.

The sol-wallet-adapater npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected computer should be rotated immediately from a different, uncompromised machine. Removal of the package alone does not guarantee elimination of all malicious software introduced by it.

CVE-2026-109092 is an integer underflow vulnerability in X.Org xwayland and X Server that occurs when processing ProcXvShmPutImage requests with negative sizes. This flaw affects versions prior to 24.1.15 for xwayland and prior to 21.1.26 for X Server. Local authenticated X clients can exploit this to crash the X server or execute arbitrary code.

Dell PowerStore contains an Improper Authorization vulnerability. An authenticated user could exploit this vulnerability, potentially leading to privilege escalation to administrator.

The celest-browser npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a separate, secure device. Removing the package alone may not fully eliminate the malicious presence, as the attacker may have established persistent control over the system.

Insertion of Sensitive Information Into Sent Data vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Retrieve Embedded Sensitive Data.This issue affects Spectra: from n/a through 2.20.5.

Missing Authorization vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RepairBuddy: from n/a through 4.1236.

A stack-based buffer overflow vulnerability exists in PLANET Technology Corp.'s PLANET GS-5220-8P2T2S hardware version 3.0 firmware before version 3.2412b261008. The flaw is triggered by an unauthenticated attacker sending an HTTP request with an oversized webstax_auth cookie, which is copied into a fixed-size stack buffer without proper length validation. This can overwrite the saved return address and corrupt stack memory, potentially causing denial of service on the device.

CVE-2026-107523 is an integer overflow vulnerability in Dell PowerStore 500T. This flaw allows an adjacent attacker to bypass volume bounds checks, which could lead to data destruction or denial of service. The vulnerability is rated high severity with a CVSS score of 8.7. A fix is available in Dell PowerStore version 5.1.0.0-2798105 or later.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hupe13 Extension for Leaflet Map extensions-leaflet-map allows Stored XSS.This issue affects Extension for Leaflet Map: from n/a through 6.1.1.

Red Hat Satellite 6.19.6 includes multiple security fixes addressing critical vulnerabilities across various components such as python3.12-pyjwt, rubygem-smart_proxy_dynflow, foreman, candlepin, and others. These fixes resolve issues including token verification flaws, authorization bypasses, denial-of-service conditions, cryptographic integrity compromises, and cross-tenant access problems. The advisory is rated critical by Red Hat Product Security and targets Red Hat Satellite 6.19 on RHEL 9 x86_64.

Missing Authorization vulnerability in Andy Moyle Church Admin church-admin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Church Admin: from n/a through 5.1.8.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Lite for Beaver Builder powerpack-addon-for-beaver-builder allows Stored XSS.This issue affects PowerPack Lite for Beaver Builder: from n/a through 1.3.2.

Missing Authorization vulnerability in WP Media Imagify imagify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Imagify: from n/a through 2.3.4.

Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.31.0.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in myCred myCred mycred allows Blind SQL Injection.This issue affects myCred: from n/a through 4.0.2.

Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.