Threats affecting pkg:bitnami/pip

OmniAuth versions prior to 2.2.0 have an origin validation error that allows remote unauthenticated clients to supply a forged Host header. This can lead to host header injection risks in applications that do not have fixed full_host configurations or framework-level host validation, such as Rails host authorization. The issue is resolved in OmniAuth version 2.2.0.

CVE-2026-113780 is a critical out-of-bounds write vulnerability in the Espressif IoT Development Framework (esp-idf) affecting versions prior to 5.5.6, between 6.0.0 and before 6.0.4, and between 6.1.0 and before 6.1.1. The flaw allows a local unprivileged application to write into trusted execution environment (TEE) memory, breaking isolation boundaries and potentially enabling code execution, denial of service, or system crashes. The issue is fixed in esp-idf versions 5.5.6, 6.0.4, and 6.1.1.

A stack-based buffer overflow vulnerability exists in the lwIP DNS resolver component of Espressif's ESP-IDF framework versions 5.2.3 through certain pre-fixed versions. The flaw occurs when multiple DNS records are cached and copied into a single-element buffer without bounds checking, allowing an attacker controlling DNS responses to overwrite adjacent stack memory. This can lead to a device reboot or potential control flow hijacking if stack protection is not enabled. Fixed versions are available starting from 5.3.7, 5.4.5, 5.5.6, and 6.0.3.

bitcoinjs-lib versions from 2.3.0 up to but not including 5.2.1, 6.0.0 up to 6.1.8, and 7.0.0-rc.0 up to 7.0.2 contain a vulnerability in Merkle root validation. The library's fastMerkleRoot function pads odd Merkle-tree levels by hashing the final node with itself but does not detect adjacent duplicate hashes, allowing a peer to append duplicate transactions without changing the Merkle root or block identifiers. This can cause consumers relying on block-root validation, such as explorers or SPV clients, to process duplicated transactions or reject valid blocks. The issue is fixed in versions 5.2.1, 6.1.8, and 7.0.2.

CVE-2026-121932 is a critical OS command injection vulnerability in Linksys E5350 version 1.0.00.037. It affects the system function in /wizard/apply.cgi, where manipulation of the ping_ip or traceroute_ip arguments allows remote attackers to execute arbitrary OS commands. The exploit code is publicly available, and the vendor has not responded to disclosure attempts.

Zammad versions prior to 7.1.2 contain a stored cross-site scripting (XSS) vulnerability in the new Vue-based ticket interface. Authenticated users can inject markup into ticket articles that is rendered without proper output encoding when viewed by others. The default Content Security Policy (CSP) reduces the practical impact of this vulnerability. The classic REST/CoffeeScript interface is not affected. This issue is fixed in version 7.1.2.

A stack-based buffer overflow vulnerability exists in the OpenThread Border Router Neighbor Discovery packet handler of Espressif's ESP-IDF framework versions 5.2.0 through 5.2.7, 5.3.0 through 5.3.5, 5.4.0 through 5.4.4, 5.5.0 through 5.5.4, and 6.0.0 through 6.0.2. The flaw arises from trusting an attacker-controlled ICMPv6 option length, leading to an out-of-bounds write into adjacent stack memory. This affects firmware with the Border Router feature enabled (CONFIG_OPENTHREAD_BORDER_ROUTER=y). Exploitation requires no authentication or user interaction and can cause device crashes, reboots, or stack corruption. Fixed in versions 5.2.8, 5.3.6, 5.4.5, 5.5.5, and 6.0.3.

CVE-2026-121931 is a critical OS command injection vulnerability in the Linksys WRT54GL router firmware version 4.30.18. The flaw exists in the Traceroute Diagnostic Function's apply.cgi file, specifically in the system function handling the traceroute_ip argument. This vulnerability allows remote attackers to execute arbitrary OS commands. The exploit code has been publicly disclosed. The product is no longer supported by the vendor, and no patch or vendor response is available.

DeepSeek Harness prior to 0.1.2-alpha.2, and specifically commit 3e24087, contains a missing authentication vulnerability in its web profile HTTP and WebSocket RPC control plane, allowing any local process, including those running as a different OS user, to reach unauthenticated session methods such as session.create and session.prompt. Attackers can invoke session.prompt to trigger the agent's bash and filesystem tools, achieve arbitrary command execution as the victim user using their configured model credentials, intercept live session traffic and logs over the event mux stream, and bypass human tool-approval checks via POST /api/respond by matching only rpcId, approvalId, and sessionId values broadcast over the ungated stream.

DataGerry versions prior to 3.3.0 have a server-side template injection vulnerability that allows authenticated users with specific permissions to inject and execute arbitrary Jinja2 payloads. This vulnerability enables remote code execution as the web process user, which is root by default in Docker deployments.

A cross-site scripting (XSS) vulnerability exists in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME). This flaw allows an unauthenticated remote attacker to execute arbitrary script code by tricking a user into clicking a crafted link. The vulnerability arises from improper validation of user-supplied input in the interface.

A vulnerability in the ScopingHttpClient component of Symfony HttpClient allows credentials from a default scope to be sent to an attacker-controlled server when a network-path reference URL is resolved outside the base URI's origin. This occurs in Symfony versions 5.x prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11. The issue arises because merged options like auth_bearer or auth_basic are retained even when the resolved URL points to a different origin, potentially exposing sensitive credentials.

A vulnerability in the web-based management interface of Cisco UCS Central Software allows an authenticated remote attacker to execute arbitrary commands, write files, or disclose sensitive information. The flaw arises from insufficient validation of user input in HTTP requests. Exploitation requires valid user credentials. Cisco has released software updates to fix this issue, and no workarounds are available.

The GetPaid plugin for WordPress versions before 2.8.63 has an input validation vulnerability that allows unauthenticated attackers to bypass payment processing. By submitting a negative item quantity on a public payment form, attackers can reduce the invoice total to zero, causing the system to mark the invoice as paid without charging the payment gateway.

The GetPaid plugin for WordPress versions prior to 2.8.63 contains an authorization bypass vulnerability. This flaw allows unauthenticated attackers to access and manipulate invoices belonging to other users by exploiting the maybe_use_invoice parameter. By supplying a known pending invoice ID, attackers can read checkout pricing details and change the invoice status to on-hold without proper authorization.

A vulnerability in the authorization mechanism of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) allows an unauthenticated remote attacker to obtain an endpoint identity certificate by bypassing authorization checks. This issue arises from improper authorization validation and can be exploited by sending a crafted request to the affected device. The vulnerability has a medium severity rating with a CVSS score of 5.3.

Certain Yealink terminal devices released before April 21, 2026, have an improper access control vulnerability in the Wi-Fi 802.1X PEAP network configuration function. This vulnerability allows unauthorized users to access 802.1X network authentication credentials. Yealink has addressed this issue in the latest firmware by restricting modification privileges of the 802.1X configuration to administrator accounts only by default.

Certain Yealink products released before April 15, 2026, have a vulnerability in their Wi-Fi AP function where a default 8-digit numeric pre-shared key (PSK) with insufficient strength is used. This weak PSK can be brute-forced by attackers to gain unauthorized network access and intercept Wi-Fi traffic. The vulnerability has a high severity score of 7.4 and impacts confidentiality but not integrity or availability.

A server-side request forgery (SSRF) vulnerability exists in InfiniFlow RAGFlow up to version 0.27.3 in the _account_get function of the Seafile Connector component. This vulnerability allows remote attackers to manipulate the seafile_url argument, potentially causing unauthorized requests from the server. The vulnerability has a CVSS score of 6.3 (medium severity). Public exploit code has been disclosed, but no vendor response or patch is currently available.

A vulnerability in GNU C Library versions 2.18 through 2.31 causes the iconv converter to hang when converting crafted BIG-HKSCS input to UCS-4 or the internal wide character encoding. This results in the calling application becoming unresponsive.