Threats affecting pkg:generic/vlc

Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in myCred myCred mycred allows Stored XSS.This issue affects myCred: from n/a through 4.0.2.

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Cristián Lávaque s2Member s2member allows Code Injection.This issue affects s2Member: from n/a through 261106.

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in eLightUp Slim SEO slim-seo allows Code Injection.This issue affects Slim SEO: from n/a through 4.11.5.

Dell PowerStore contains an out-of-bounds read vulnerability. An attacker could exploit this vulnerability, potentially leading to denial of service or limited information disclosure.

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Code Injection.This issue affects MapSVG: from n/a through 9.0.4.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetTabs jet-tabs allows Stored XSS.This issue affects JetTabs: from n/a through 2.3.5.

Missing Authorization vulnerability in VillaTheme CURCY woo-multi-currency allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CURCY: from n/a through 2.2.21.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HTMega HT Mega ht-mega-for-elementor allows Stored XSS.This issue affects HT Mega: from n/a through 3.2.8.

Missing Authorization vulnerability in HTMega HT Mega ht-mega-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HT Mega: from n/a through 3.2.8.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Go Maps WP Go Maps wp-google-maps allows Stored XSS.This issue affects WP Go Maps: from n/a through 10.1.10.

In Telerik UI for Blazor, versions v12.0.0 through 15.2.0, an improper input validation vulnerability exists, where the Grid, TreeList and Gantt's AI command filters on any model property, bypassing the declared column allowlist.

Missing Authorization vulnerability in PublishPress Gutenberg Blocks advanced-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gutenberg Blocks: from n/a through 3.7.6.

CVE-2026-118976 is a relative path traversal vulnerability in Progress Software's Telerik UI for Blazor demo application's Chat AI Integration example. It affects versions 11.1.0 through 14.0.0 and allows an attacker to read files outside the intended chat attachments folder within the server's filesystem. The vulnerability has a high severity with a CVSS score of 7.5. A fix is available in version 14.1.0.

CVE-2026-128910 is a vulnerability in DJI AeroScope Mobile (TP703) firmware 03.00.00.26 and associated 1300 communications board firmware versions 02.00.07.12 through 02.00.08.40. It involves the use of hard-coded credentials on the 1300 communications board, allowing an attacker with physical access to the board's serial console to log in as root. The password hash is identical across all units and uses DES crypt, enabling offline password recovery. No network login service accepts this password by default. The product is discontinued and no firmware fix is available.

CVE-2026-128909 is a high-severity vulnerability in DJI AeroScope Mobile (TP703) firmware 03.00.00.26 and 1300 communications board firmware versions 02.00.07.12 through 02.00.08.40. It involves improper verification of cryptographic signatures in the firmware update handler, allowing an unauthenticated local network attacker to install modified firmware. This leads to persistent root code execution. The device only checks an MD5 checksum supplied in the update request and does not verify a cryptographic signature. Exploitation requires network access to TCP port 16000 and that the device is not connected to another controlling host. No fix is available as the product is discontinued and unsupported by DJI.

Dell PowerStore contains an integer overflow vulnerability. An authenticated storage host could exploit this vulnerability, potentially leading to out-of-bounds data access or denial of service.

CVE-2026-128908 is an OS command injection vulnerability in the network-configuration handling of the management service (uavmonitor_usbv1) on the 1300 communications board of DJI AeroScope Mobile (TP703) firmware 03.00.00.26 and board firmware versions 02.00.07.12 through 02.00.08.40. An unauthenticated attacker on the local network can execute arbitrary commands as root by sending crafted input to TCP port 16000. The injected commands persist across reboots. This product is discontinued and no firmware fix is available.

Eclipse AAS Model for Java (Eclipse AAS4J) versions before 3.0.1 contain a vulnerability in XML schema validation where external DTDs and entities are resolved by default. This allows an attacker to supply crafted XML or AASX packages that can read local files and exfiltrate their contents, as well as cause outbound requests (SSRF) without validation errors. The issue is fixed in version 3.0.1 by disabling external entity resolution and rejecting DOCTYPE declarations.

CVE-2026-128907 is a medium-severity vulnerability in DJI AeroScope Mobile (TP703) firmware 03.00.00.26 and 1300 communications board firmware versions 02.00.07.12 through 02.00.08.40. It involves missing authentication for a critical management service, allowing unauthenticated local network attackers to read sensitive device information and change configuration settings via the proprietary DUML protocol over TCP port 16000 or USB. The product is discontinued and no fix is available.