Threats affecting pkg:generic/arrow

P-Net before 1.0.4 finds the RPC session of a received PDU by its activity UUID only, and a reject, fault or cancel PDU for the session aborts the Application Relationship, without checking that the PDU is the answer to a call of the device or where it comes from. A host with ADJACENT network access that has observed the activity UUID of the connection, which is sent in clear in every RPC request, can abort the Application Relationship with one PDU. It also allocates a session for an unknown activity UUID and changes the address stored for an existing session.

CVE-2026-124761 is a vulnerability in RT-Labs P-Net versions before 1.0.4 where the device improperly saves a refused IP address configuration. When a DCP Set request is refused due to an active Application Relationship, the device still saves the refused IP address and uses it after restart, potentially causing communication issues with the controller. This can be exploited by a host with adjacent network access while the Application Relationship is active.

P-Net before 1.0.4 sets the alarm receiver state to waiting for confirmation before the data of a received alarm notification is parsed. If the parsing fails the state is not restored, and later alarm notifications of the same priority are discarded without acknowledge until the Application Relationship is released. The Application Relationship and the cyclic data exchange keep working. The attacker must be able to send an alarm notification in the context of an established Application Relationship and requires ADJACENT network access.

P-Net before 1.0.4 does not check the record data length of an IODWrite request to a non-user record index against the size of the record block header. The 32-bit length is reduced by the header size before it is passed to the record handlers, so a length smaller than the header underflows and the handlers receive a data length of about 65530. The fixed-size reads of the I&M and PDPort handlers can then read past the end of the session buffer. The result of the write is discarded. The attacker must have an established Application Relationship or be able to send in the context of one, and requires ADJACENT network access.

CVE-2026-109096 is a vulnerability in X.Org xwayland and X Server where incorrect handling of negative return values from ddQueryImageAttributes() during XvPutImage requests can cause the X server to crash. This affects versions of xwayland before 24.1.15 and X Server before 21.1.26. The flaw allows authenticated X clients to trigger a denial-of-service condition by crashing the server.

CVE-2026-124759 is a high-severity vulnerability in RT-Labs P-Net prior to version 1.0.4. The vulnerability arises from improper origin validation of received RTA alarm frames, allowing an adjacent network host to disrupt or forge alarm notifications. This can lead to aborting established Application Relationships or injecting malicious alarm data.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Stored XSS.This issue affects Spectra: from n/a through 2.20.5.

CVE-2026-86353 is a vulnerability in Dell PowerStore 500T involving the use of a weak cryptographic algorithm. This flaw could allow an attacker with existing privileged access to the appliance to recover stored credentials. The vulnerability has a medium severity rating with a CVSS score of 5. A fix is available in Dell PowerStore version 5.1.0.0-2798105 or later.

Dell PowerStore contains an information disclosure vulnerability. An unauthenticated attacker could exploit this vulnerability to obtain service metadata useful for further attacks.

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Automattic WooCommerce woocommerce allows Leveraging Race Conditions.This issue affects WooCommerce: from 11.0.0 through 11.2.2.

CVE-2026-105880 is an authorization bypass vulnerability in Tobias WebinarIgnition affecting versions before 4.27.136. It allows attackers to exploit incorrectly configured access control security levels by manipulating a user-controlled key. The vulnerability has a medium severity with a CVSS score of 5.3 and impacts confidentiality but not integrity or availability.

Missing Authorization vulnerability in Brizy Brizy brizy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Brizy: from n/a through 2.8.25.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Stored XSS.This issue affects MapSVG: from n/a through 9.0.4.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Stored XSS.This issue affects Royal Elementor Addons: from n/a through 1.7.1070.

CVE-2026-121721 is a stored cross-site scripting (XSS) vulnerability in PublishPress Gutenberg Blocks (advanced-gutenberg) affecting versions up to 3.7.6. The flaw involves improper neutralization of input during web page generation, which can lead to persistent XSS attacks. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level. No official patch or remediation information is provided in the available data.

Affected devices running firmware versions prior to 4.1.0 may crash and become unavailable when receiving specific malformed Bluetooth messages from an unauthenticated attacker.

CVE-2026-125814 is a medium severity vulnerability in Rymera Web Co's Product Feed PRO for WooCommerce plugin. It involves improper neutralization of script-related HTML tags, leading to a basic cross-site scripting (XSS) issue. This vulnerability affects versions up to and including 13.5.8. There is no indication of known exploits in the wild or an available patch at this time.

CVE-2026-125833 is a stored cross-site scripting (XSS) vulnerability in the YITH WooCommerce Ajax Product Filter plugin. It affects versions up to and including 5.24.0. The vulnerability arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts that can be stored and executed in users' browsers.

A time-of-check time-of-use (TOCTOU) race condition vulnerability exists in the Pardus Package Installer developed by TÜBİTAK BİLGEM Yazılım Teknolojileri Araştırma Enstitüsü. This flaw affects versions from 0.7.0 up to but not including 0.7.1. The vulnerability allows an attacker to exploit the timing window between checking and using a resource, potentially leading to unauthorized actions. The issue is fixed in version 0.7.1.

CVE-2026-128834 is a missing authorization vulnerability in Brainstorm Force Spectra (ultimate-addons-for-gutenberg) affecting versions prior to 2.20.6. It allows exploitation due to incorrectly configured access control security levels. The issue is fixed in version 2.20.6.