Threats affecting pkg:generic/lucene

A high-severity vulnerability (CVE-2026-114151) exists in Microsoft.DiaSymReader.Native versions prior to 18.9.1-beta1.26515.1 used by certain .NET runtimes on Windows. The flaw involves an out-of-bounds stack write triggered by a crafted PDB LF_DECIMAL payload processed through ISymUnmanagedConstant.GetValue. This affects .NET runtime versions 8.0.0 up to but not including 8.0.34, 9.0.0 up to 9.0.23, 10.0.0 up to 10.0.15, and 11.0.0-preview.1 up to 11.0.0 on Windows x86, x64, and Arm64 architectures. The native stack-trace reading path in .NET does not invoke the vulnerable method, so not all .NET usage is affected. Patches are available in the specified fixed versions.

A high-severity vulnerability (CWE-122) in Microsoft .NET on Windows allows an out-of-bounds write triggered by a crafted Portable PDB EmbeddedSource record with parent RID 0. This affects Microsoft.DiaSymReader.Native components in .NET versions 8.0.0 up to but not including 8.0.34, 9.0.0 up to 9.0.23, 10.0.0 up to 10.0.15, and 11.0.0-preview.1 up to 11.0.0. The vulnerability impacts x86, x64, and Arm64 architectures and can be reached via the Windows runtime's native stack-trace reader fallback. Fixed versions are available and users are advised to update to these patched releases.

A heap out-of-bounds write vulnerability exists in Microsoft.DiaSymReader.Native components used by .NET on Windows when processing Portable PDB files with oversized document names. This affects multiple .NET runtime versions on Windows across x86, x64, and Arm64 architectures. The vulnerability has a high severity score of 8.8 and can lead to significant impact on confidentiality, integrity, and availability. Fixed versions are available for all affected releases.

CVE-2026-20183 is a medium severity vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE). It allows an authenticated remote attacker with valid Administrator credentials to modify parts of the device configuration due to insufficient server-side validation of Administrator permissions. Exploitation requires submitting a crafted HTTP request. The vulnerability does not impact confidentiality or availability but allows limited integrity modification of configuration descriptions.

An improper authorization vulnerability exists in Fortinet FortiManager versions 8.0.0, 7.6.0 through 7.6.7, 7.4.0 through 7.4.5, and 7.2.0 through 7.2.8. This flaw may allow an unauthenticated attacker with network access to the FGFM port to execute arbitrary code or commands via specially crafted FGFM packets. The vulnerability has a critical severity with a CVSS score of 9.8.

A vulnerability in the Secure Encrypted Virtualization (SEV) firmware involves incorrect usage of seeds in its pseudo-random number generator. This flaw could allow a malicious hypervisor or migration agent to import a forged guest context, potentially leading to loss of confidentiality of derived guest keys. The issue is classified as medium severity with a CVSS score of 6. No affected versions or patches are specified in the available data.

CVE-2026-0003 describes a vulnerability in the ASP Bootloader where a per-part static key is used. This flaw could allow an attacker to downgrade the Secure Encrypted Virtualization (SEV) firmware and exploit known vulnerabilities to decrypt memory, potentially leading to loss of confidentiality. The vulnerability has a medium severity rating with a CVSS score of 5.9. No affected versions or patches are specified in the available data.

An out-of-bounds write vulnerability exists in the AMD Secure Encrypted Virtualization (SEV) firmware. This flaw could allow a malicious hypervisor to corrupt global firmware variables, potentially compromising firmware integrity. The vulnerability has a medium severity rating and no known exploits in the wild. No affected versions or patches are specified in the available data.

An expression language injection vulnerability exists in the HeaderContentGuard.permit function in Pulpcore's publication.py. This flaw allows a low-privileged attacker who can create and attach a header content guard to a distribution to execute a jq filter that can access the environment of the content process. By repeatedly making content requests, the attacker can extract sensitive environment data, including Pulp settings such as the Django secret key and database password. The vulnerability was introduced in Pulpcore 3.39.0 and affects default configurations. Red Hat Satellite and RHUI 5 are not affected. No practical workaround is currently available.

A vulnerability in the AMD Secure Encrypted Virtualization (SEV) firmware allows an attacker with administrative privileges to perform operations on a resource after it has expired or been released. This flaw could enable the attacker to swap out a guest device without the guest's knowledge, potentially compromising confidentiality and integrity.

CVE-2026-0480 is a vulnerability in AMD Secure Encrypted Virtualization (SEV) firmware where missing authentication for a critical function allows a malicious hypervisor to forge SEV-TIO guest request messages. This flaw could compromise the integrity and confidentiality of SEV-SNP guest memory. The vulnerability has a medium severity rating with a CVSS score of 6. No patch or remediation information is currently available.

A vulnerability in AMD Secure Encrypted Virtualization (SEV) firmware involves improper preservation of consistency between independent representations of shared state. This flaw could allow a malicious hypervisor to affect cache coherency for guest context pages, potentially leading to loss of integrity. The issue has a medium severity rating and no known exploits in the wild. No affected versions or patch information are provided.

CVE-2026-91000 is a high-severity vulnerability in N-able N-central prior to version 2026.4.1. It involves missing authentication for a critical function, which can lead to privilege escalation. This flaw allows an attacker with limited privileges to gain higher-level access within the affected system.

The proxy-cache and proxy-cache-advanced plugins in Kong Gateway Enterprise and Kong AI Gateway do not properly escape separator characters when constructing cache keys. This flaw allows a remote attacker to manipulate cache keys, causing a cached response intended for one request to be served in response to a different request on the same Route. The vulnerability has a medium severity rating with a CVSS score of 6.3.

Kong Gateway Enterprise and Kong AI Gateway have a vulnerability where decoded CR/LF characters from the request path are included in the X-Forwarded-Prefix header on regex Routes. This allows HTTP header injection and request smuggling attacks against upstream services.

The graphql-proxy-cache-advanced plugin in Kong Gateway Enterprise has a vulnerability where it omits the caller's identity from the cache key. This flaw allows a cached response intended for one caller to be served to a different caller, potentially exposing sensitive data across users.

A vulnerability in the caching plugins of Kong Gateway Enterprise and Kong AI Gateway may cause cached responses intended for requests with Authorization or Proxy-Authorization headers to be served to different callers. This can lead to unauthorized access to cached data.

Chargemap has a stored cross-site scripting (XSS) vulnerability that allows a remote, authenticated attacker to inject malicious scripts into their user profile page. This payload executes when another user views the attacker's profile. The vulnerability has been fixed as of July 17, 2026.

Chargemap had a stored cross-site scripting (XSS) vulnerability in its account registration page. An unauthenticated attacker could inject malicious script code into the username field when creating an account linked to a victim's email. When the victim received and opened a forgotten password email containing the payload, the script would execute. This vulnerability was fixed on 2026-07-17.

CVE-2024-36309 describes a vulnerability involving missing lock bit protection in the Northbridge IO (NBIO) component. This flaw could allow a privileged attacker to exploit an intentionally disabled device through a remapping attack, potentially affecting data confidentiality, integrity, or availability. The vulnerability has a medium severity rating with a CVSS score of 4.6. No specific affected software versions or patches are provided, and no known exploits are reported in the wild.