Threats affecting pkg:generic/libucl

CVE-2026-119586 is a command injection vulnerability in the SQLite CLI up to version 3.54.1 related to the .recover output functionality. The vulnerability allows an attacker to inject commands via the output of the .recover command. No CVSS score or detailed impact information is provided.

A heap buffer overflow vulnerability exists in SQLite versions before 3.54.0 in the session extension function sessionUpdateFind(). This flaw could potentially lead to memory corruption. No CVSS score or detailed impact information is provided.

CVE-2026-119378 is a use-after-free vulnerability in SQLite versions before 3.54.0, specifically in the R-Tree module's nodeWrite() function. This flaw could lead to memory corruption issues.

A vulnerability identified as CVE-2026-119377 affects SQLite versions before 3.54.0, specifically version 3.0 is noted as affected. The issue involves an authorizer bypass via RIGHT or FULL JOIN USING clauses. No CVSS score or detailed impact information is provided. No patch or remediation details are available in the input data.

CVE-2026-119376 is a vulnerability in SQLite versions before 3.54.0 involving stack exhaustion via the COLLATE operator chain. This flaw relates to improper handling of collate sequences that can lead to excessive stack usage.

CVE-2026-119375 is an information disclosure vulnerability affecting SQLite versions before 3.54.0. The issue involves a WAL (Write-Ahead Logging) page size mismatch that could potentially expose sensitive information. No CVSS score or detailed impact information is provided. No known exploits are reported in the wild. The affected version explicitly mentioned is SQLite version 3.0.

CVE-2026-119374 is a heap buffer overflow vulnerability in SQLite versions before 3.54.0, specifically related to the FTS5 module's fts5DoSecureDelete() function. This flaw could potentially lead to memory corruption issues.

A heap buffer overflow vulnerability exists in SQLite versions before 3.54.0 in the fts5MergeRowidLists() function. This flaw could lead to memory corruption when processing full-text search operations.

CVE-2026-119372 is a use-after-free vulnerability in SQLite versions before 3.54.0, specifically in the FTS3 module's fts3BestSnippet() function when accessed via snippet(). This flaw could lead to memory corruption issues. No CVSS score or detailed impact information is provided. No patch or remediation details are available in the input data.

A vulnerability identified as CVE-2026-119371 affects SQLite versions before 3.54.0, involving stack exhaustion via a Common Table Expression (CTE) chain in the selectExpander() function. This flaw could potentially lead to denial of service conditions due to resource exhaustion. The vulnerability is categorized under CWE-674 (Improper Control of a Resource Through its Lifetime). No CVSS score or detailed impact metrics are provided, and no public exploit or patch information is currently available.

A vulnerability in Elixir version 3.0 involves unbounded port parsing in the URI.parse/1 function, which can lead to CPU exhaustion and cause a denial of service condition.

A malicious version of the Claude Code extension (versions 2.1.312 and 2.1.313) was briefly available on the Cursor marketplace, embedding a JavaScript loader that attempts to establish persistent SSH backdoor access. The loader collects host information, adds an attacker-controlled SSH public key to authorized_keys, enables the local SSH service, creates a reverse SSH tunnel, configures persistence mechanisms, and attempts to exfiltrate host details. The incident is limited to the Cursor marketplace; official Microsoft Visual Studio Marketplace and npm packages were not affected. Successful remote access depends on host privileges and SSH configuration. Organizations should identify affected systems, preserve evidence, remove malicious artifacts, and rotate credentials if exposure is suspected.

CVE-2026-93522 is a heap buffer overflow vulnerability in the X.Org Server Glamor CopyArea component affecting version 3.0. The vulnerability is identified as CWE-122. No CVSS score or detailed impact information is provided. There is no indication of known exploits in the wild or available patches.

A vulnerability in the pyasn1 library version 3.0 allows a quadratic-complexity denial of service during binary REAL decoding. This flaw can cause excessive resource consumption when processing crafted input, potentially leading to service disruption.

A vulnerability in the pyasn1 library version 3.0 causes quadratic CPU consumption during decoding of constructed BIT STRING data. This can lead to excessive CPU usage when processing crafted inputs.

A vulnerability in pyasn1 version 3.0 allows a quadratic-time denial of service during constructed string and indefinite-length ANY decoding. This flaw can cause excessive resource consumption leading to denial of service conditions.

A vulnerability identified as CVE-2026-116566 affects Microsoft software version 3.0, where the socket.getaddrinfo() function improperly accepts embedded null bytes in the host and port parameters. This flaw relates to CWE-158, indicating improper handling of input data. No CVSS score or detailed impact information is provided, and there are no known exploits in the wild. No patch or remediation details are available in the provided data.

A cross-site scripting (XSS) vulnerability identified as CVE-2026-114538 affects Microsoft product version 3.0. The vulnerability is categorized as moderately critical and relates to the Bootstrap component. No CVSS score or detailed technical impact information is provided.

CVE-2026-102554 is a high-severity vulnerability in Keycloak related to allocation of resources without limits or throttling during Java object deserialization in Google Guava versions 4. This flaw can lead to excessive resource consumption. Fixed versions 26.4.2-r4 and 26.7.5-r2 address this issue.

CVE-2026-111497 is a critical buffer overflow vulnerability in the Brotli decoder component of Keycloak. It affects multiple packages and allows for potential remote code execution or denial of service. The flaw exists in the c/dec/decode function of the Brotli decoder. Fixed versions 26.4.2-r4 and 26.7.5-r3 address this issue.