Threats affecting pkg:generic/libucl

A vulnerability in pgAdmin 4 before version 9.19 allowed unintended use of a Kerberos service account's credentials for GSSAPI authentication. When a connection was not meant to use a Kerberos user's delegated credentials, pgAdmin removed the KRB5CCNAME environment variable, causing the Kerberos library to fall back to the default credential cache of the operating system account running pgAdmin. This allowed any user to connect as the service account's Kerberos principal regardless of the username provided. The issue also affected Windows SSPI and psql started with pgAdmin's environment. The fix involves isolating Kerberos credential environment variables per connection and requiring updated libpq 16 or later for proper authentication enforcement.

In Secret Server versions prior to 12.3.1, a vulnerability exists where a user under certain conditions could submit an unsigned JSON Web Token (JWT) and gain cloudadmin permissions. This flaw allows privilege escalation by bypassing proper token validation.

pgAdmin 4 versions before 9.19 contain a critical vulnerability in the Import/Export Data tool. The tool wraps user queries in a psql \copy (...) TO command and attempts to validate balanced parentheses to prevent command injection. However, it incorrectly handles backslashes inside double-quoted identifiers, allowing an attacker to bypass this check and inject a TO PROGRAM clause. This clause executes arbitrary commands on the pgAdmin host with the operating system privileges of the pgAdmin process. The vulnerability arises because the server setting standard_conforming_strings can be turned off by ordinary database roles, affecting how backslashes are interpreted, which pgAdmin does not reliably account for. This issue is a bypass of the previous fix for CVE-2026-17566.

An unauthenticated PHP Object Injection vulnerability exists in LeadSnap versions up to and including 1.25. This vulnerability allows remote attackers to inject malicious PHP objects without authentication, potentially leading to full system compromise.

A Missing Authorization vulnerability exists in Arraytics Booktics up to version 1.0.31. This flaw allows exploitation of incorrectly configured access control security levels, potentially enabling unauthorized actions that impact data integrity. The vulnerability has a CVSS v3.1 base score of 5.3, indicating medium severity. No patch or remediation information is currently provided.

A missing authorization vulnerability exists in Liquid Web / StellarWP BookIt plugin versions up to 2.6.0.6. This flaw allows exploitation of incorrectly configured access control security levels, potentially enabling unauthorized actions. The vulnerability has a medium severity rating with a CVSS score of 4.3.

A vulnerability identified as CVE-2026-54854 affects Profile Builder versions up to and including 4.0.5, allowing users with Contributor privileges to escalate their access rights. This flaw could lead to limited confidentiality, integrity, and availability impacts. The vulnerability has a medium severity rating with a CVSS score of 6.3.

A broken access control vulnerability exists in Booking and Rental Manager versions up to and including 2.8.2. This flaw allows subscribers with limited privileges to access resources or functions beyond their authorization. The vulnerability has a medium severity with a CVSS score of 6.5, indicating a network attack vector with low complexity and no user interaction required. Confidentiality impact is high, but integrity and availability are not affected.

A missing authorization vulnerability exists in Liquid Web / StellarWP Event Tickets plugin (up to version 5.30.2) that allows exploitation of incorrectly configured access control security levels. This flaw can lead to unauthorized modification of data or actions without proper permissions. The vulnerability has a medium severity rating with a CVSS score of 4.3.

A missing authorization vulnerability exists in WP ManageNinja LLC Fluent CRM (fluent-crm) up to version 3.2.6. This flaw allows exploitation of incorrectly configured access control security levels, potentially enabling unauthorized actions. The vulnerability has a medium severity rating with a CVSS score of 5.3.

An unauthenticated Cross Site Scripting (XSS) vulnerability exists in BA Book Everything versions up to and including 1.8.33. This vulnerability allows an attacker to inject malicious scripts without authentication.

A missing authorization vulnerability exists in the Unlimited Elements For Elementor plugin (Free Widgets, Addons, Templates) up to version 2.0.26. This flaw allows exploitation of incorrectly configured access control security levels, potentially enabling unauthorized access to certain functionality or data. The vulnerability has a medium severity rating with a CVSS score of 4.3. No public exploits or known active exploitation have been reported. No patch or remediation information is currently provided.

CVE-2026-48201 is an unauthenticated Cross Site Scripting (XSS) vulnerability affecting Fast Velocity Minify versions up to and including 3.5.7. This vulnerability allows an attacker to inject malicious scripts without authentication, potentially impacting confidentiality, integrity, and availability. The vulnerability has a high severity with a CVSS score of 7.1.

A Cross-Site Scripting (XSS) vulnerability exists in the Divi Contact Form 7 plugin (cf7-styler-for-divi) up to version 4.1.0. This vulnerability allows improper neutralization of script-related HTML tags, enabling code injection. The vulnerability has a medium severity with a CVSS score of 5.3. No official patch or remediation details are provided in the available data.

A stored cross-site scripting (XSS) vulnerability exists in Brainstorm Force Ultimate Addons for Elementor - Lite header-footer-elementor plugin versions up to 2.9.5. This vulnerability involves improper neutralization of input during web page generation, which could allow an attacker with low privileges to execute malicious scripts in the context of affected users. The vulnerability has a medium severity rating with a CVSS score of 6.5.

A vulnerability classified as PHP Remote File Inclusion exists in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) up to version 2.0.26. This flaw involves improper control of filenames used in include/require statements, allowing PHP Local File Inclusion. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level.

A Cross-Site Scripting (XSS) vulnerability exists in the ithemelandco GIFTiT – Free Gifts for WooCommerce plugin, allowing improper neutralization of script-related HTML tags. This vulnerability affects versions up to 4.5 and can lead to code injection. The issue has a medium severity rating with a CVSS score of 5.3.

CVE-2026-54855 is an unauthenticated cross-site scripting (XSS) vulnerability affecting Profile Builder versions up to and including 4.0.5. This vulnerability allows attackers to inject malicious scripts without authentication, potentially impacting confidentiality, integrity, and availability.

CVE-2026-39738 is a critical unauthenticated PHP Object Injection vulnerability affecting FunnelKit Automations versions up to and including 3.8.6.1. This flaw allows remote attackers to inject malicious PHP objects without authentication, potentially leading to full system compromise.

An unauthenticated Cross Site Scripting (XSS) vulnerability exists in VikRentCar versions up to and including 1.4.10. This vulnerability allows attackers to inject malicious scripts without authentication, potentially impacting confidentiality, integrity, and availability of the affected system.