Threats affecting pkg:generic/libucl

Element Call versions from 0.16.0 up to but not including 0.20.3 log the password URL query parameter in error reports (rageshakes). These logs are shared with the application operator, potentially exposing the encryption password and compromising call confidentiality. The issue is fixed in version 0.20.3. Upgrading prevents future disclosures but does not remove secrets from previously collected logs, which require manual cleanup.

CVE-2026-63115 is an authentication bypass vulnerability in TryGhost's ActivityPub server versions 1.0.0 through 1.2.5. It allows a remote federated server to spoof the origin of an Undo activity, causing the service to remove a follow or repost relationship from another account without authorization. No private data is exposed, and content is not altered. The issue is fixed in version 1.2.6.

LORIS is a neuroimaging research management web application with a vulnerability in its issue_tracker backend. Versions from 16.0.0 prior to 27.0.4 and from 28.0.0 prior to 28.0.2 do not properly verify edit access permissions on the backend, allowing authenticated users to modify issues beyond their allowed scope. The frontend restricts issue editing, but the backend flaw bypasses these controls. The issue is fixed in versions 27.0.4 and 28.0.2. Deployments not using the Issue Tracker module can disable it to mitigate risk.

A Cross-site Scripting (XSS) vulnerability exists in phoenix_html, a component of the Phoenix Framework, due to improper neutralization of input during web page generation. The vulnerability arises because attribute names are not properly escaped, allowing an attacker controlling attribute names to inject malicious attributes and scripts into rendered HTML. This affects phoenix_html versions from 1.0.0 before 3.3.5 and from 4.0.0 before 4.4.0. The issue occurs when untrusted input is used to build attribute keys rendered through HEEx <tag {@attrs}>, content_tag/3, or direct calls. The vulnerability has a medium severity with a CVSS score of 5.3. No known exploits in the wild or patch information is provided.

A critical stack-based buffer overflow and missing authorization vulnerability exists in Thales Sentinel Keys Server on Windows versions prior to 1.3.8.0. The vulnerability arises because the server does not validate the length of the first field in an HTTP request, allowing an attacker to craft a malicious request that may lead to remote code execution with NT AUTHORITY\SYSTEM privileges.

Maxthon Browser for Android versions before 7.5.8.103 have an address bar spoofing vulnerability. This flaw allows remote attackers to create a fake address bar during fullscreen mode, misleading users about the true origin of the web page. The vulnerability arises because the browser lacks a persistent fullscreen notification or trusted origin indicator when the Fullscreen API is used. Attackers can exploit this to display a counterfeit address bar showing a trusted domain while presenting attacker-controlled content, potentially tricking users into disclosing credentials via phishing.

A stack-based buffer overflow and out-of-bounds write vulnerability exists in Thales Sentinel Keys Server on Windows versions prior to 1.3.8.0. The vulnerability arises because the software does not validate the length of the first field in an input message. A local attacker can exploit this flaw by crafting a malicious input to achieve code execution with NT AUTHORITY\SYSTEM privileges, resulting in local privilege escalation.

pgAdmin 4 versions prior to 9.19 did not invalidate existing user sessions when a password was changed, either by the user or an administrator. This allowed sessions established before the password change to remain active until they expired, potentially allowing continued access by unauthorized parties. The issue was fixed by rotating the user's session identifier upon password change, logging out all other sessions and re-encrypting saved server passwords under the new key.

In pgAdmin 4 server mode prior to version 9.19, non-administrator users could improperly share database servers with all users. This vulnerability allowed any user able to register a server to mark it as shared, despite the interface restricting this action to administrators. Although shared servers carry no credentials, this flaw enables a user to plant a server entry named to appear trusted in other users' server trees, potentially tricking them into connecting and exposing their database passwords to an attacker-controlled host. The issue was fixed by rejecting non-administrator requests to share servers, pruning shared entries from non-administrators during import, and warning about previously shared servers at startup.

pgAdmin 4 in server mode improperly resolves file paths for server password files, SSL certificates, keys, CRLs, and SSH tunnel identity files relative to the user's storage directory. This flaw allows path traversal to access or use another user's sensitive files. Additionally, crafted connection parameter names can bypass validation, potentially injecting unauthorized parameters. The issue affects versions before 9.19 and has a high severity CVSS score of 8.4.

pgAdmin 4 versions before 9.19 have a vulnerability in the materialized view refresh feature where the target database name is passed unchanged to psql's --dbname argument. This allows a specially crafted database name containing connection string keywords to override connection parameters, potentially redirecting connections to arbitrary hosts and exposing saved server passwords. The issue was fixed by routing the database name through a helper function to ensure it is treated strictly as a database name.

pgAdmin 4 versions before 9.19 had a vulnerability where, if no password file, client certificate, or client key was configured or found, the connection would fall back to using the operating system account's saved credentials. This allowed any user in server mode to connect using the service account's saved passwords or client certificate by supplying only the public certificate. The issue was fixed by explicitly setting these parameters to the user's own files or to inaccessible paths in server mode, preventing unintended credential use.

pgAdmin 4 in server mode had a vulnerability where symbolic links, hard links, or FIFOs inside a user's storage directory could be used to bypass path validation checks, allowing unauthorized file read, write, or load operations as the operating system user running pgAdmin. This affected file operations related to server.json export/import and files passed to utilities like pg_dump and psql. Exploitation requires write access to the storage backend as a different OS user and a race condition. The issue was fixed in version 9.19 by securely opening files with O_NOFOLLOW and restricting to regular files with a single link.

A vulnerability in pgAdmin 4 before version 9.19 allows any user in server mode to specify a connection service from the operating system account's service file, potentially using stored credentials such as passwords or client certificates. This occurs because libpq looks up connection services in the service file of the OS account running pgAdmin 4 and uses environment variables like PGPASSWORD or PGSERVICE without restriction. The issue is addressed by introducing the SERVER_MODE_ALLOWED_SERVICES setting, which restricts allowed services and removes sensitive environment variables at startup.

pgAdmin 4 versions prior to 9.19 allow users to specify a binary path for pg_dump, pg_restore, pg_dumpall, and psql. In server mode, the application only restricted binary paths under the per-user storage directory but not under shared storage directories accessible by ordinary users. This flaw allowed a user to upload a malicious executable to shared storage, set the binary path to it, and have pgAdmin run it with the operating system privileges of the pgAdmin process. The issue is particularly exploitable on Windows servers where files with executable names can run even if created through pgAdmin. The vulnerability was fixed by expanding path checks to include all shared storage directories, resolving symbolic links, normalizing paths, rejecting paths with NUL characters, and enforcing these checks consistently.

In Secret Server versions earlier than 12.3.1, a vulnerability allows a user to bypass the initial login step by successfully completing only the second factor authentication step.

A PHP Object Injection vulnerability exists in GS Testimonial Slider versions up to and including 3.3.10. This vulnerability allows an attacker with contributor-level privileges to perform object injection, potentially leading to full compromise of confidentiality, integrity, and availability.

pgAdmin 4 in server mode has a path validation flaw in its check_access_permission() function, leading to discrepancies between checked and used file paths. This allows users to potentially access, read, delete, or rename files outside their designated storage directories, including other users' files, by exploiting path handling inconsistencies. The issue affects versions before 9.19 and does not impact desktop mode.

An incorrect authorization vulnerability exists in the single-stage query engine of Apache Pinot versions through 1.5.1. When broker access control is enabled, the engine authorizes only the table named in the query's FROM clause, but not dimension tables referenced via the lookup() transform function. This allows an authenticated user authorized for at least one table to access columns and arbitrary rows from any dimension table without proper authorization or row-level security filters. The multi-stage query engine is not affected. The issue is fixed in Apache Pinot version 1.6.0.

WIT SynApps Runtime versions through 1.4.11 have a vulnerability involving hardcoded OAuth client credentials exposed in frontend JavaScript files. This exposure allows unauthenticated attackers to obtain static clientId and clientSecret values, enabling them to impersonate the application in the OAuth authentication flow at the /web/api/v1/auth/token endpoint. The vulnerability undermines the confidentiality of the OAuth client credentials but does not impact integrity or availability.