Threats affecting pkg:generic/libucl

CVE-2026-39738 is a critical unauthenticated PHP Object Injection vulnerability affecting FunnelKit Automations versions up to and including 3.8.6.1. This flaw allows remote attackers to inject malicious PHP objects without authentication, potentially leading to full system compromise.

An unauthenticated Cross Site Scripting (XSS) vulnerability exists in VikRentCar versions up to and including 1.4.10. This vulnerability allows attackers to inject malicious scripts without authentication, potentially impacting confidentiality, integrity, and availability of the affected system.

A Cross Site Scripting (XSS) vulnerability exists in the user registration functionality of Subscriber versions up to and including 5.3.0. This vulnerability allows an attacker with limited privileges to execute scripts in the context of other users, potentially leading to partial confidentiality, integrity, and availability impacts.

An unauthenticated path traversal vulnerability exists in WP EasyPay versions up to and including 4.5.4. This flaw allows an attacker to access files outside the intended directory without authentication.

CVE-2026-39732 is an unauthenticated SQL Injection vulnerability affecting Transliterator versions up to and including 2.5.13. This flaw allows an attacker to execute SQL injection attacks without authentication, potentially leading to high confidentiality impact and partial availability impact.

A vulnerability in GStreamer's gst-plugins-bad H.265 video parser allows a specially crafted H.265 bitstream with a Screen Content Coding (SCC) extension to trigger an integer underflow. This leads to out-of-bounds writes beyond a fixed-size array, causing memory corruption and application crashes. Exploitation requires a malformed H.265 media file and results in denial of service without confidentiality or integrity impact. Red Hat Enterprise Linux 7 and 8 are not affected; RHEL 9, 10, and Red Hat In-Vehicle OS are affected but no fix is currently available. Fedora 44 and rawhide include the fix, while Fedora 43 remains vulnerable.

A PHP Object Injection vulnerability exists in MasterStudy LMS versions up to and including 3.7.55. This vulnerability allows an attacker with low privileges to execute arbitrary code remotely without user interaction, potentially leading to full system compromise.

A vulnerability in the H.264 video parser of gst-plugins-bad allows a denial of service via a crash. The flaw occurs when processing a specially crafted H.264 video file with malformed Multiview (MVC) Sequence Parameter Set data, leading to a NULL pointer dereference during cleanup after a parse failure.

An integer overflow vulnerability exists in the AV1 LEB128 variable-length integer parser of GStreamer. This flaw allows a remote attacker to cause a denial of service by crafting a malformed AV1 bitstream that triggers incorrect length calculations during stream processing, leading to application crashes.

A privilege escalation vulnerability exists in WP BASE Booking versions up to and including 6.5.2, allowing users with subscriber-level access to escalate their privileges. This vulnerability is identified as CVE-2026-118086 and has a high severity rating with a CVSS score of 8.8.

A PHP Object Injection vulnerability exists in Shop manager's Product Feed Manager versions up to and including 7.14.1. This flaw allows an attacker with high privileges to execute arbitrary code remotely without user interaction, potentially leading to full system compromise.

A deserialization of untrusted data vulnerability in ThemeREX Royal Event allows object injection, potentially leading to full system compromise. The vulnerability affects versions up to 2.0. It has a critical CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability.

A vulnerability in GStreamer's gst-plugins-base MicroDVD subtitle parser can cause a NULL pointer dereference when processing specially crafted subtitle files, leading to application crashes. This affects media players that open or play malformed MicroDVD (.sub) subtitle files. The issue results in a denial of service but requires user interaction to trigger.

Nezha versions 2.0.0 up to but not including 2.4.0 contain a NULL pointer dereference vulnerability in the ServiceSentinel.loadTodayStats function. This flaw allows authenticated users to crash the dashboard by deleting a service, which leaves orphaned service_histories rows that cause the dashboard to crash on its next startup until these rows are manually removed.

NodeBB versions 1.18.0 through 4.16.5 have an authorization bypass vulnerability that permits unauthenticated users to act on behalf of other accounts by supplying a user ID during the POST /register request. This flaw also allows attackers to clear a victim's email and confirmation state and revoke all their sessions by submitting an empty email at the /register/complete step.

CVE-2026-116861 is a high-severity vulnerability in Flexible Chat versions up to 1.1.0 that allows unauthenticated attackers to expose sensitive data. The flaw does not require user interaction or privileges and impacts confidentiality without affecting integrity or availability.

A Cross Site Scripting (XSS) vulnerability affects WP Customer Area versions up to and including 8.4.0, allowing subscribers to potentially execute malicious scripts. This vulnerability is identified as CVE-2026-116854 and has a medium severity rating with a CVSS score of 6.5.

CVE-2026-116852 is a critical remote code execution vulnerability affecting Widget Options versions up to and including 4.2.5. It allows an authenticated author-level user to execute arbitrary code on the affected system without user interaction. The vulnerability is identified as CWE-94, indicating improper control of code generation. No specific affected versions beyond "<= 4.2.5" are provided, and no patch or remediation details are available in the input data.

An unauthenticated Cross Site Scripting (XSS) vulnerability exists in Mang Board WP versions up to and including 2.4.6. This vulnerability allows an attacker to inject malicious scripts without authentication, potentially impacting confidentiality, integrity, and availability of the affected system.

CVE-2026-116851 is an unauthenticated Cross Site Scripting (XSS) vulnerability affecting eCommerce Product Catalog versions up to and including 3.6.5. This vulnerability allows an attacker to inject malicious scripts that can execute in the context of users' browsers without requiring authentication.