Threats affecting pkg:generic/libucl

CVE-2026-116851 is an unauthenticated Cross Site Scripting (XSS) vulnerability affecting eCommerce Product Catalog versions up to and including 3.6.5. This vulnerability allows an attacker to inject malicious scripts that can execute in the context of users' browsers without requiring authentication.

CVE-2026-116862 is a high severity vulnerability involving unauthenticated broken access control in WP REST Cache versions up to and including 2026.3.1. This flaw allows an attacker to access restricted resources without authentication, potentially leading to exposure of sensitive data. The vulnerability has a CVSS score of 7.5, indicating a significant impact on confidentiality but no impact on integrity or availability.

CVE-2026-116410 is a vulnerability in Masteriyo LMS versions up to and including 3.4.3 that allows unauthenticated users to delete arbitrary content. The flaw permits content deletion without requiring authentication, potentially impacting data integrity. The vulnerability has a medium severity rating with a CVSS score of 6.5.

An unauthenticated Cross Site Scripting (XSS) vulnerability exists in VikRentCar versions up to and including 1.4.9. This vulnerability allows attackers to inject malicious scripts without authentication, potentially leading to partial confidentiality, integrity, and availability impacts.

CVE-2026-116853 is a medium severity vulnerability in GiveWP versions up to and including 4.19.0.1. It involves unauthenticated broken access control, allowing unauthorized users to access restricted functionality or data. The vulnerability has a CVSS score of 6.5, indicating a moderate impact on confidentiality and integrity without affecting availability.

An unauthenticated bypass vulnerability exists in YITH WooCommerce Product Add-Ons versions up to and including 4.34.0. This vulnerability allows an attacker with no privileges or user interaction to bypass certain security controls, potentially leading to limited integrity impact without affecting confidentiality or availability.

CVE-2026-115604 is a vulnerability in SureDash versions up to and including 1.12.3 that allows an attacker with limited privileges to perform arbitrary file deletion. The flaw is categorized under CWE-22 (Path Traversal). It has a medium severity with a CVSS score of 5. The vulnerability does not impact confidentiality or integrity but affects availability by enabling denial of service through file deletion. There is no information on available patches or vendor advisories. No known exploits are reported in the wild.

CVE-2026-115947 is a vulnerability in HUSKY versions up to and including 1.4.6 that allows unauthenticated exposure of sensitive data. The flaw permits attackers without any privileges or user interaction to access sensitive information. The vulnerability has a medium severity rating with a CVSS score of 6.5.

CVE-2026-116401 is a high-severity vulnerability in HUSKY versions up to and including 1.4.6. It involves unauthenticated broken access control, allowing unauthorized users to access resources without proper authentication.

An unauthenticated Cross Site Scripting (XSS) vulnerability exists in Ad Inserter versions up to and including 2.8.19. This vulnerability allows attackers to inject malicious scripts that can execute in the context of the victim's browser. The flaw affects confidentiality, integrity, and availability to a limited extent.

CVE-2026-116386 is a critical unauthenticated privilege escalation vulnerability affecting SMS Alert Order Notifications versions up to and including 4.0.2. This flaw allows an attacker to escalate privileges without authentication, potentially leading to full compromise of confidentiality, integrity, and availability.

A Cross Site Scripting (XSS) vulnerability affects MultiVendorX versions up to and including 5.0.20. This vulnerability allows a subscriber-level user to execute malicious scripts in the context of other users. The flaw is identified as CWE-79 and has a medium severity rating with a CVSS score of 6.5.

A missing authorization vulnerability exists in Arraytics Booktics up to version 1.0.31. This flaw allows exploitation of incorrectly configured access control security levels, potentially enabling unauthorized access to certain functions or data. The vulnerability has a medium severity rating with a CVSS score of 4.3.

LORIS is a web application for neuroimaging research data management. Versions from 22.0.0 prior to 27.0.4 and from 28.0.0 prior to 28.0.2 have an authorization bypass vulnerability in the imaging_browser API module. Authenticated API users can modify imaging data without proper edit permissions. The issue is fixed in versions 27.0.4 and 28.0.2.

Trail of Bits fickling versions up to 0.1.12 contain a vulnerability where a pickle STACK_GLOBAL operand with a dotted __qualname__ is incorrectly resolved to an arbitrary attribute path instead of a module-level function. This flaw allows an attacker to execute arbitrary code by loading a crafted pickle that reaches the optparse.Values.read_file method, which executes code from a file. The vulnerability bypasses fickling's safety checks because the trailing attribute reference is not analyzed or flagged. The issue remains unpatched as of the latest vendor commit on 2026-10-30.

The PDF Invoices & Packing Slips for WooCommerce WordPress plugin from 5.16.2 before 5.16.5 does not properly escape several customer-supplied order fields — including the billing and shipping address values and the customer order note — before they are output in generated invoice and packing-slip documents, allowing unauthenticated users placing guest orders to store a malicious script that executes when a shop administrator views the document, leading to Stored Cross-Site Scripting.

Trail of Bits fickling versions up to 0.1.12 contain a protection mechanism failure where the _process_import() method trusts imported callables from standard library modules without verifying their behavior. This leads to unsafe calls being marked as likely safe, allowing malicious pickle payloads to execute arbitrary code or write files. The issue affects Python 3.7 through 3.12 and involves modules such as dataclasses, mailcap, and readline. The vendor has added the demonstrated unsafe modules to a denylist on the master branch but no official release patch is available yet.

CVE-2026-62991 is an authorization bypass vulnerability in shopperlabs shopper prior to version 2.10.1. It allows authenticated staff with certain permissions to access and enumerate user profiles beyond their intended scope, including administrator and staff accounts. The flaw also permits destructive actions on non-customer accounts if additional privileges are held. This issue is fixed in version 2.10.1.

CVE-2026-62990 is a high-severity cross-site scripting (XSS) vulnerability in the Shopper headless e-commerce admin panel. Authenticated back-office staff with content-upload permissions can upload executable media files, including SVG and HTML, which execute scripts in the administrator's session when opened. This can lead to unauthorized creation of attacker-controlled administrator accounts with full access to sensitive data and management functions. The vulnerability affects versions from 2.0.0 prior to 2.10.1 and prerelease versions 3.0.0-beta.1 and beta.2. It is fixed in versions 2.10.1 and 3.0.0-beta.3.

CVE-2026-62989 is an improper authorization vulnerability in shopperlabs shopper versions prior to 2.10.0. It allows authenticated staff users with edit_products permission but without delete_product_variants permission to delete product variants permanently via the Variants Livewire component. This can disrupt the storefront by destroying sellable product variants, affecting product pages, cart, and checkout functionality. The issue is fixed in version 2.10.0.