Threats affecting pkg:generic/espeak-ng

The LaserGest mobile application uses a hardcoded AES key and IV to encrypt stored assistance portal credentials. This practice allows an attacker who can access the application package to decrypt and recover these credentials in cleartext. The vulnerability is classified as high severity with a CVSS score of 8.7.

A TOCTOU race condition in the Sandisk Dashboard installer allows a local authenticated standard user to replace a binary in a user-writable temporary directory between validation and execution. This leads to execution of an attacker-controlled binary with elevated administrative privileges. The vulnerability affects Sandisk Dashboard versions through 5.2.2.3.

Eclipse Langium versions 3.0.0 and later have a vulnerability in the langium-sprotty package where diagnostic messages are not HTML-escaped before rendering in hover popups. This allows attacker-controlled JavaScript to execute in the browser or webview when a malicious source file triggers an unresolved cross-reference diagnostic containing HTML markup.

An XSS vulnerability exists in OpenText Filr Appliance versions up to 25.1.2 that allows an authenticated user to upload a malicious file and execute a stored cross-site scripting attack.

The AM CLUB mobile application contains hard-coded MQTT credentials that allow an authenticated attacker to connect to the MQTT broker. This vulnerability enables unauthorized access to data and actions across tenant boundaries within the application environment.

rConfig Core versions 8.2.3 through 8.2.12 contain an information disclosure vulnerability that allows authenticated users to retrieve cleartext SSH, Telnet, and enable passwords for managed devices via the device-credentials API. This occurs due to missing authorization checks and automatic decryption on read. The vulnerability is fixed in version 8.2.13. rConfig Pro is not affected.

CVE-2026-123802 is an improper authentication vulnerability in SuperTokens Core affecting versions from 11.3.0 up to but not including 11.3.8, 11.4.0 up to 11.4.8, 12.0.0 up to 12.0.11, 12.1.0 up to 12.1.2, 12.2.0 up to 12.2.1, and 12.3.0 up to 12.3.1. The flaw allows a licensed deployment with a configured SAML client to authenticate an identity from an assertion that does not satisfy the audience check properly, enabling an attacker to impersonate a victim IdP user. This issue is fixed in versions 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.

OffSeq Mirage honeypot sensors observed the URL https://github.com being used in attacker activity associated with CVE-2021-41773 on 2026-11-09. The URL was seen 9 times as part of attacker payloads involving the T1105 technique (Ingress Tool Transfer), indicating it was used for tool download, callback, or exploitation targeting. The attacker infrastructure was identified as located in the US. This URL should be blocked and monitored in proxy, web, and WAF logs to detect related malicious activity.

SuperTokens Core versions from 11.3.0 up to but not including 11.3.8, 11.4.0 up to 11.4.8, 12.0.0 up to 12.0.11, 12.1.0 up to 12.1.2, 12.2.0 up to 12.2.1, and 12.3.0 up to 12.3.1 contain an authentication bypass vulnerability in the SAML.handleCallback function. This flaw allows replay of valid SAML responses and RelayState pairs, bypassing important validation checks such as Response.InResponseTo, Destination, and SubjectConfirmationData. The issue permits attackers to reuse authorization codes and complete logins with different identities. Fixed versions are 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.

Attackers are actively searching for SAP NetWeaver webshells by exploiting a known vulnerability (CVE-2025-31324) that allows unauthenticated file uploads. This vulnerability has a critical CVSS score of 10 and has been used to upload webshells typically located in the /irj/servlet_jsp/irj/root/ directory. Multiple URLs related to SAP NetWeaver and other upload endpoints are being targeted in this campaign.

CVE-2026-125041 is a vulnerability in GStreamer's gst-plugins-good MOV/MP4 demuxer used in Red Hat Enterprise Linux 10. The flaw involves improper validation of declared row alignment and chroma geometry in uncompressed video tracks, leading to an out-of-bounds heap read. This can cause the application processing the crafted file to crash, resulting in a denial of service condition. The issue is addressed in gst-plugins-good version 1.28.3 and later.

A flaw was found in the SRT and WebVTT subtitle parser in GStreamer's gst-plugins-base. While sanitizing inline subtitle markup, the parser repeatedly searches the remaining text with unanchored regular expressions. A crafted subtitle cue with a long line of unmatched markup-like text can force quadratic CPU use and make a GStreamer-based application unresponsive.

CVE-2026-123800 is a critical authorization bypass vulnerability in SuperTokens Core affecting multiple versions from 6.0.0 up to but not including various fixed releases. The flaw allows an attacker with a valid API key for one application in a licensed multi-tenant deployment to update the parent connection URI domain and manipulate sibling application keys and user sessions. This can lead to unauthorized access, modification of user data, persistence establishment, and denial of service to sibling applications. The issue is fixed in versions including 12.3.1, 12.2.1, 12.1.2, 12.0.11, 11.4.8, 11.3.8, 11.2.4, 11.1.4, 11.0.9, and 10.1.9.

A vulnerability in loggingredactor versions prior to 0.0.7 caused personally identifiable information (PII) to be exposed in logs. Specifically, PII contained in the string or representation output of non-primitive objects was not redacted when custom __str__ and __repr__ methods were used. This flaw was addressed in version 0.0.7.

CVE-2026-120834 is an Incorrect Privilege Assignment vulnerability in the Tobias WP2LEADS plugin, affecting versions from initial release up to 3.5.17. This flaw allows unauthorized privilege escalation. The issue is addressed in version 3.5.18.

CVE-2026-121769 is a high-severity SQL Injection vulnerability in the WP w3all phpBB integration plugin for WordPress, affecting versions prior to 3.2.0. This flaw allows an attacker with low privileges to execute SQL commands that can compromise confidentiality and availability. The issue is fixed in version 3.2.0.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log wp-security-audit-log allows Stored XSS.This issue affects WP Activity Log: from n/a through 5.6.7.

SuperTokens Core is an open source authentication server. From 11.0.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, and 12.1.2, Dashboard.isValidUserSession treats any stored session row as valid without comparing DashboardSessionInfo.expiry to the current time. DashboardQueries.getSessionInfoWithSessionId also selects by app and session identifier without an expiry predicate, leaving the periodic DeleteExpiredDashboardSessions cleanup as the only expiration enforcement. An attacker who obtains a dashboard administrator session after its 30-day lifetime can continue using POST /recipe/dashboard/session/verify until the row is removed, and frequent Core restarts can prevent the 12-hour cleanup sweep from running. The stale session retains full dashboard read and write access, but the flaw does not provide a way to guess or acquire the random session identifier. This issue is fixed in versions 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, and 12.1.2.

SuperTokens Core versions 11.3.0 through 11.3.6, 11.4.0 through 11.4.6, and 12.0.6 through 12.0.9 contain an improper authentication vulnerability due to incorrect SAML signature validation. The software accepts cryptographically valid signatures that reference different XML elements than those used for authentication, enabling XML Signature Wrapping attacks. This allows an attacker to impersonate another identity provider user. The issue affects both response-level and assertion-level signing and is fixed in versions 11.3.7, 11.4.7, and 12.0.10.

CVE-2026-84503 is a vulnerability in the ansible-core ansible.builtin.git module used by Red Hat Migration Toolkit for Applications 8. The module invokes git commands with a repository URL as a positional argument without a '--' separator, allowing a repository URL starting with a dash to be interpreted as a git command-line option. This can lead to argument injection and arbitrary command execution on the host running the module if an attacker controls the repository URL.