Threats affecting pkg:generic/poppler

libgphoto2 through 2.5.34 contains a heap out-of-bounds read and write vulnerability in jl2005bcd_decompress() that allows malicious USB cameras to corrupt heap memory via oversized thumbnail processing. Attackers can supply small allocation-table values and a thumbnail header byte so in-place byte-swapping exceeds the buffer by about 30 KB, leaking heap contents in preview images.

CVE-2026-120451 is a high-severity vulnerability in libgphoto2 up to version 2.5.34. It involves stack-based and heap-based buffer overflows in the jl2005c_init() function caused by malicious USB devices supplying an unbounded allocation table entry count. This can lead to memory corruption, including overwriting the saved return address and heap data, potentially allowing code execution.

LaraDashboard versions 1.4.0 through 1.4.8 contain an improper authorization vulnerability allowing authenticated users with read-only email_template.view permission to send arbitrary emails via the MCP send-email tool. This flaw enables attackers to mint an MCP token and send emails with arbitrary recipients, subjects, and HTML bodies, potentially facilitating phishing or spam campaigns. The issue is fixed in version 1.4.9.

Outline before 1.12.0 contains an improper access control vulnerability that allows unauthenticated users to read unpublished documents because the share loader ignores unpublished status. Attackers holding an existing share link can query shares.info, documents.info, or the /s/ share routes to read withdrawn content, while shares.revoke returns 404 and blocks revocation.

DoraCMS through 3.1.0 contains a mass assignment vulnerability in the PUT /api/v1/user/api-keys/:id endpoint that allows authenticated low-privileged users to rebind their API key to another user's account. Attackers can set the userId field on their own key to a victim's id, then act as that victim to modify profiles and publish or delete content.

HotGo 2.8.4 through 2.15.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to choose the SMS login verification code by supplying the Code field to /admin/sms/send. Attackers who know a user's mobile number can set a known code and sign in through /admin/site/mobileLogin to take over accounts, including administrators.

madong-admin-saas versions up to 5.1.4 have a missing authentication vulnerability in the platform tenant management API. This flaw allows unauthenticated remote attackers to access critical endpoints such as /platformapi/tenant/account, bind-plan, and sync-data. Exploitation enables attackers to list, create, modify, disable, or delete tenants and bind subscription plans without any authentication.

madong-admin-saas through 5.1.4 contains an incorrect authorization vulnerability in AccessTokenMiddleware that allows authenticated tenant users to access the platform management API in multi-tenant mode. Attackers can reuse a tenant login JWT against /platformapi controllers to create platform administrator accounts, read tenant database settings, and take control of every tenant.

GoFound through 1.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to delete arbitrary directories by supplying ../ sequences in the database parameter. Attackers can send GET requests to /api/db/create and /api/db/drop, directly or via a victim's browser, triggering os.RemoveAll on directories outside the data directory.

GoFound versions up to 1.4.1 contain a stored cross-site scripting (XSS) vulnerability. Unauthenticated attackers can inject malicious scripts by submitting document text to the /api/index endpoint. The injected HTML is returned unescaped by searcher/engine.go and rendered with v-html in dashboard.vue, leading to script execution in an administrator's browser when a search matches the malicious document.

ape-volo-admin versions before 3.6.1 have an authentication bypass vulnerability due to a hardcoded JWT signing key in appsettings.json. This allows unauthenticated attackers to forge administrator tokens and gain full API control over users, roles, permissions, and data. The vulnerability is fixed in version 3.6.1.

OwnTone Server through 29.3 contains an sql injection vulnerability in mpd_sticker_find() in src/mpd.c that allows unauthenticated remote attackers to inject SQL via the URI argument. Attackers can send a crafted 'sticker find song' command to the MPD listener on TCP port 6600 to bypass path restrictions and enumerate all media files with filesystem paths and metadata.

QuickJS-NG before 0.16.0 contains a memory leak vulnerability in js_atomics_store() in quickjs.c that fails to free the converted value when returning a RangeError. Attackers running JavaScript can repeatedly call Atomics.store with a valueOf that detaches or shrinks the buffer to exhaust heap memory and cause denial of service.

QuickJS-NG versions before 0.16.0 contain an integer overflow vulnerability in the js_typed_array_sort() function. This flaw allows attackers running JavaScript to trigger a heap buffer overflow on 32-bit systems by sorting a very large typed array with a comparator. The overflow can lead to crashes or potentially arbitrary code execution.

QuickJS-NG versions before 0.16.0 contain an integer overflow vulnerability in the js_proxy_get_own_property_names() function. This flaw causes a heap buffer overflow on 32-bit hosts when JavaScript code returns a large array-like object from a Proxy ownKeys trap. The vulnerability can lead to crashes or potentially allow code execution.

Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains an out-of-bounds read vulnerability in the tgatoppm converter's get_pixel() function that uses unchecked pixel values as color map indexes. Attackers can supply a crafted color-mapped Targa file whose pixel values exceed the declared color map bounds to crash the converter or leak adjacent memory into the output image.

Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains an integer overflow in jbigtopnm that causes heap buffer overflow when computing output buffer size. Attackers can supply a crafted multi-plane JBIG file with large header dimensions so jbg_dec_merge_planes() overflows the undersized buffer, causing crashes or potentially code execution.

CVE-2026-120435 is a heap buffer overflow vulnerability in the Netpbm image processing tool, specifically in the xpmtoppm utility. The flaw arises from an unvalidated characters-per-pixel value in the XPM file header, allowing attackers to supply crafted XPM files with characters-per-pixel greater than 3. This causes an overrun of fixed 3-byte colorName hash entries, potentially leading to crashes or code execution. The vulnerability affects Netpbm versions before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08. Fixes are available in versions 10.86.51, 11.02.30, and 11.15.08. The CVSS 4.0 score is 8.5, indicating high severity.

CVE-2026-120434 is a stack-based buffer overflow vulnerability in the Netpbm image processing tool. It affects the picttoppm utility's scanPoly() function, which improperly handles polygon edges in crafted PICT files with more than 5000 points. This can cause a crash or potentially allow code execution. The flaw affects Netpbm versions before 10.86.51, 11.0 up to but not including 11.02.30, and 11.03 up to but not including 11.15.08. Fixed versions are 10.86.51, 11.02.30, and 11.15.08.

Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a stack-based buffer overflow in the picttoppm paintPoly() function due to an unbounded polygon point count. Attackers can supply a crafted PICT file with a polygon exceeding 100 points to overwrite the fixed pts array, causing crashes or potentially code execution.