Threats affecting pkg:generic/lucene

A vulnerability in the proxy-cache and proxy-cache-advanced plugins of Kong Gateway Enterprise and Kong AI Gateway causes the request hostname to be omitted from the cache key. This omission may result in a cached response for one hostname being served to requests for a different hostname.

The ai-azure-content-safety plugin in Kong Gateway Enterprise fails to inspect request bodies that exceed the size of its in-memory buffer. This allows potentially unsafe prompts to bypass content-safety checks designed to filter harmful input.

The Basel Post Types plugin for WordPress contains an authentication bypass vulnerability in all versions up to and including 1.18. This flaw arises from a coding error that causes a static, publicly visible salt to be used for authentication, allowing attackers to forge valid authentication callbacks. Exploitation requires WooCommerce and a configured Basel social-login provider. Successful exploitation enables attackers to authenticate as any WordPress user without password or multi-factor authentication checks.

CVE-2025-0008 describes a vulnerability where insufficient verification of data authenticity may allow a local attacker to bypass Secure Debug Unlock (SDU), potentially granting unauthorized debug access.

Chargemap had an open redirect vulnerability in its authentication login endpoint that allowed remote unauthenticated attackers to craft URLs that redirect victims to attacker-controlled domains. This vulnerability was fixed on 2026-07-17. The CVSS score is 5.4, indicating a medium severity issue.

A vulnerability in the Secure Encrypted Virtualization (SEV) firmware allows a malicious hypervisor to operate on a resource after it has expired or been released. This flaw could enable manipulation of metadata pages, potentially compromising the confidentiality and integrity of guest memory.

The SAML plugin in Kong Gateway Enterprise fails to enforce the AudienceRestriction condition, which allows a valid SAML assertion issued for a different Service Provider to be replayed and used to authenticate to Kong.

CVE-2026-40668 is a medium severity vulnerability in AMD Secure Encrypted Virtualization (SEV) firmware. It involves an authentication bypass via spoofing that could allow a malicious hypervisor to request attestation reports for VMPL 0. No affected versions or patches are specified. There are no known exploits in the wild.

CVE-2026-28247 is a medium severity vulnerability in AMD Secure Encrypted Virtualization (SEV) firmware involving improper access control on mirrored or aliased memory regions. This flaw could allow a malicious hypervisor with high privileges to alter the encryption bit of guest context pages, potentially compromising the integrity of the guest environment.

CVE-2026-40670 is a vulnerability in AMD Secure Encrypted Virtualization - Secure Nested Paging (SEV-SNP) caused by improper checks for unusual or exceptional conditions. This flaw could allow a privileged attacker to overlap MMIO regions with DRAM regions, potentially leading to loss of integrity within the system.

Adobe Experience Manager contains a reflected Cross-Site Scripting (XSS) vulnerability that allows a low-privileged attacker to execute malicious JavaScript in the context of a victim's browser if the victim is tricked into visiting a crafted URL. The vulnerability affects the scope of the application and can lead to partial confidentiality and integrity impact without availability loss.

A vulnerability in BeeS Software Solutions ERP versions prior to 04 September 2026 allows low-privileged users to access the administrative dashboard directly. This access grants unrestricted visibility into institutional, employee, and student data without requiring higher privileges.

An off-by-one error in AMD Secure Encrypted Virtualization (SEV) firmware could allow an attacker with hypervisor access to corrupt the Reverse Map Table (RMP), potentially compromising guest memory integrity. This vulnerability has a medium severity rating and does not currently have a known exploit in the wild. No affected versions or patches are specified.

CVE-2026-125878 is a high-severity cross-site scripting (XSS) vulnerability in N-able N-central versions before 26.4.1. It involves improper neutralization of input during web page generation, which can lead to resource injection. This flaw allows an attacker with low privileges to inject malicious scripts without user interaction. No known exploits are reported in the wild, and no official patch information is provided in the source data.

A vulnerability in AMD Secure Encrypted Virtualization (SEV) firmware involves improper enforcement of behavioral workflow. This flaw could allow a malicious hypervisor to launch a guest virtual machine with an attestation report containing an ID key digest that does not match the guest's measurement, leading to loss of integrity.

A relative path traversal vulnerability exists in N-able N-central versions before 26.4.1. This flaw allows an attacker with high privileges to perform path traversal, potentially accessing files outside the intended directories. The vulnerability is classified as high severity with a CVSS score of 8.6.

N-able N-central versions up to 24.6.1 have a vulnerability where code is downloaded without an integrity check, allowing remote code inclusion. This flaw can enable an attacker with high privileges to include and execute remote code. The vulnerability is rated high severity with a CVSS score of 7.5. No patch or remediation details are provided in the source data.

CAI Content Credentials suffers from a path traversal vulnerability that allows attackers to bypass security restrictions and access unauthorized files or directories. Exploitation requires user interaction, such as visiting a malicious URL or interacting with a compromised webpage. The vulnerability has a medium severity rating with a CVSS score of 5.5.

N-able N-central before version 26.4.1 contains an incorrect privilege assignment vulnerability that allows privilege escalation. This flaw enables users with certain privileges to gain higher-level access than intended, potentially compromising system security.

A Server-Side Request Forgery (SSRF) vulnerability exists in N-able N-central versions prior to 26.4.1. This flaw allows an attacker to induce the server to make unintended requests, potentially leading to unauthorized access or data exposure. The vulnerability is rated critical with a high CVSS 4.0 score of 9.3.