Threats affecting pkg:generic/hdf5

A security update for the cjose component addresses a vulnerability identified as CVE-2026-53938. This update is functionally equivalent to the Red Hat advisory RHSA-2026:90812. No specific technical details or affected versions are provided in the input data.

Two denial of service vulnerabilities were identified in Grafana, an open source metrics dashboard and graph editor. The first vulnerability (CVE-2026-8609) involves unbounded memory growth in the OAuth login route. The second (CVE-2026-33382) involves excessive memory allocation from large API request payloads. These issues could cause Grafana to consume excessive memory, potentially leading to service disruption. Red Hat has issued a security update for Grafana in Red Hat Enterprise Linux 9 to address these vulnerabilities.

A resource exhaustion vulnerability exists in the joserfc Python library prior to version 1.7.6. The vulnerability occurs during compact JWS deserialization, where attacker-controlled input causes excessive memory allocation before size limits are enforced. This can lead to denial of service by exhausting process memory, even if signature verification ultimately fails. The issue is resolved in version 1.7.6.

A heap overflow vulnerability in the X.Org X11 libXrender runtime library's RenderQueryPictFormats function allows for code injection. This security flaw is tracked as CVE-2026-88807 and affects Red Hat Enterprise Linux 9 across multiple architectures. Red Hat has issued an important security update to address this issue.

Bricks Theme version 2.4 and earlier for WordPress has an unauthenticated broken access control vulnerability in the load_popup_content REST endpoint. This flaw allows anonymous attackers to read draft and unpublished page content by manipulating the popupId parameter without any status or capability checks. Attackers can use a public nonce obtained via the bricks_regenerate_query_nonce action to enumerate confidential unpublished posts on the site.

HashiCorp Boundary and Boundary Enterprise contain a server-side request forgery (SSRF) vulnerability in the Vault credential store integration. An authenticated user with permissions to manage credential stores and credential libraries within a project can exploit this flaw to make the Boundary controller send outbound requests to arbitrary network destinations and receive the responses. This could expose internal endpoints accessible only from the controller's host, such as cloud instance metadata services. The vulnerability is identified as CVE-2026-13303 and has a high severity rating. It is fixed in Boundary Enterprise versions 1.0.2 and 0.21.6.

A vulnerability in openshift-ansible's installer container run script allows downloading and executing remote inventory and dynamic scripts without verifying their integrity. An attacker with network-level access or control over the remote script server could substitute malicious executables, which would run with the installer's user ID and full cluster provisioning privileges, enabling arbitrary code execution. The risk is limited to environments that use remote inventory sources via environment variables and is mitigated by securing network communications and using HTTPS with trusted servers.

IDrive Backup for Windows versions 7.0.1.1 and earlier contain a vulnerability in the id_service.exe component that allows a local attacker to execute arbitrary code. This issue is resolved in version 7.0.1.2.

A vulnerability in IDrive Backup for Windows versions 7.0.1.1 and earlier allows a local attacker to execute arbitrary code via the id_service.exe component. This issue is fixed in version 7.0.1.2.

A memory corruption vulnerability exists in the vtkDEMReader ReadProfiles functionality of vtk version 9.6.1. This vulnerability is triggered by processing a specially crafted USGS DEM file, which can cause a buffer overflow. An attacker can exploit this by providing a malicious file to the vulnerable functionality, potentially leading to denial of service due to application crash.

An out-of-bounds read vulnerability exists in the vtkChacoReader InputGraph2 functionality of vtk version 9.6.1. This flaw can be triggered by processing a specially crafted chaco file, potentially leading to a high-severity impact including denial of service. The vulnerability is identified as CVE-2026-9535 with a CVSS score of 8.2.

A heap-based buffer overflow vulnerability exists in the vtkWindBladeReader FindVariableOffsets functionality of vtk version 9.6.1. This vulnerability can be triggered by processing a specially crafted .wind file, potentially causing a buffer overflow condition. The flaw does not impact confidentiality or integrity but can cause a denial of service due to application crash or instability.

A domain separation bypass vulnerability was identified and addressed in the ServiceNow SR – CSM – Task Plan Templates Store application. This flaw allows an authenticated user with a specific role to create records in domains they should not have access to, potentially leading to unauthorized data creation across domain boundaries. There is no current evidence of active exploitation. Customers are advised to apply updates or upgrade to patched releases promptly.

CVE-2026-8824 is a memory corruption vulnerability in the vtkBMPReader component of vtk version 9.6.1. It occurs in the ExecuteDataWithInformation functionality when processing specially crafted .bmp files, leading to a buffer overflow. This vulnerability can be triggered by an attacker supplying a malicious BMP file.

An Improper Access Control vulnerability in WiFiman Desktop for macOS allows a malicious actor with local access and high privileges to escalate privileges on the host device. This vulnerability could lead to full compromise of confidentiality, integrity, and availability of the system.

CVE-2026-42057 is a high-severity vulnerability in vtk version 9.6 affecting the vtkPNGReader::vtkPNGReaderUpdate2 function. It involves an invalid pointer dereference triggered by processing a specially crafted PNG file, which can cause a denial of service (application crash). No confidentiality or integrity impact is reported. No known exploits in the wild have been documented.

HashiCorp Nomad and Nomad Enterprise contain a vulnerability involving symlink following during same-client allocation data migration. This flaw allows a malicious workload to change permissions and ownership of host directories, potentially enabling unauthorized access or modification of host files and leading to privilege escalation. The issue is tracked as CVE-2026-119168 and has a high severity rating.

CVE-2026-119250 is an External Control of File Name or Path vulnerability in WiFiman Desktop for macOS that allows a local attacker with low privileges to execute arbitrary commands with root privileges. This vulnerability requires local access and does not involve user interaction. It has a high severity score of 7.8.

CVE-2026-119249 is a vulnerability in WiFiman Desktop for macOS where a binding to an unrestricted IP address allows a malicious actor with network access to obtain information about the host device. The vulnerability has a high severity score of 7.5 and does not require privileges or user interaction to exploit.

CVE-2026-41216 is an invalid pointer dereference vulnerability in the vtkPNGReader::ExecuteInformation function of vtk version 9.6. A specially crafted PNG file can cause a denial of service by triggering this flaw. This vulnerability allows an attacker to crash the application processing the malicious PNG file.