Threats affecting pkg:generic/openexr

Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Privilege escalation due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Sandbox escape in the Form Manager component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Information disclosure due to uninitialized memory in the Audio/Video component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Privilege escalation due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

CVE-2026-117504 is a denial of service vulnerability in the a2aproject a2a-go software affecting versions 2.0 through 2.4.0. The flaw exists in the Cancel function of the Distributed Manager component, allowing remote attackers to cause a denial of service. Upgrading to version 2.5.0 resolves the issue.

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and several LTS releases contain a stack-based buffer overflow vulnerability (CWE-121). This flaw could be exploited by a high privileged attacker with remote access to cause a denial of service condition. The vulnerability does not impact confidentiality or integrity but affects availability. Fixed versions are available starting from 8.9.0.0 and corresponding LTS releases.

CVE-2026-117503 is a resource consumption vulnerability in the a2aproject a2a-go software affecting versions 2.0 through 2.4.0. The flaw exists in an unknown function within the REST SSE handler component (a2asrv/rest.go). This vulnerability can be exploited remotely to cause excessive resource usage. Upgrading to version 2.5.0 addresses the issue.

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7 and specific LTS releases contain a relative path traversal vulnerability in the certificate handling component. This flaw allows a highly privileged remote attacker to potentially cause a denial of service. The vulnerability has a CVSS score of 6.5, indicating a medium severity impact. Fixed versions are available starting from 7.13.1.80, 8.3.1.40, 8.6.1.20, and 8.9.0.0 or later.

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and several LTS releases contain a path traversal vulnerability (CWE-28). This flaw allows a high privileged local attacker to potentially cause a denial of service. The vulnerability is fixed in versions 8.9.0.0 or later and corresponding later LTS releases.

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and certain LTS releases contain a relative path traversal vulnerability (CWE-23). This flaw allows a high privileged remote attacker to potentially tamper with information. The vulnerability has a low CVSS score of 3.8 and does not impact confidentiality but affects integrity and availability. Fixed versions are available starting from 8.9.0.0 and specific LTS patch levels.

Agno versions prior to 2.3.24 contain a critical arbitrary code execution vulnerability due to unsafe use of Python's eval() on the field_type parameter in FunctionCall inputs. This flaw allows attackers who can influence field_type to execute arbitrary Python code within the Agno process, impacting confidentiality, integrity, and availability. The vulnerability is fixed in version 2.3.24 and later. No safe workaround exists other than upgrading or ensuring no untrusted input reaches the vulnerable parameter.

A leaked SquareML access key potentially exposed personal and health information of 238,000 Denver Health Medical Plan members. The key was publicly accessible from June 27, 2025, until it was revoked on August 18, 2026. The compromised account was read-only, limiting the ability to alter or export data. The exposed data includes names, dates of birth, demographic details, health metrics, and hospital admission information, but excludes Social Security numbers and financial data. There is no evidence that the data was accessed or misused, only that it may have been.

OAuthLib versions from 3.3.0 up to but not including 4.0.0 contain a vulnerability in the device code grant workflow (RFC 8628). The token endpoint does not properly validate the device_code parameter, allowing an attacker who knows a valid client ID for a public client configured for device workflow to obtain a bearer token without a valid device_code. This flaw arises because the DeviceCodeGrant.validate_token_request method lacks proper device_code validation. The issue is fixed in version 4.0.0.

MONAILabel server is vulnerable to a denial-of-service and silent inference corruption attack via crafted DICOM files exploiting pydicom's improper validation of Decimal String (DS) and Integer String (IS) values. An unauthenticated attacker can upload malicious DICOM files containing NaN or infinity values in spatial metadata fields, causing the server to crash or produce corrupted AI inference results. This affects MONAILabel versions prior to 1.6.1 and pydicom versions 0.9.7 through 3.0.2. The vulnerability arises because MONAILabel trusts pydicom output without validating these invalid values, and the REST API accepts uploads without authentication by default. A fix is available in MONAILabel 1.6.1.

dcmjs, a JavaScript library for DICOM manipulation used in web-based medical imaging viewers, contains an input validation bypass in its handling of DS (Decimal String) and IS (Integer String) value representations. The vulnerability allows malformed input strings to bypass sanitization and produce JavaScript Infinity or NaN values, or accept scientific notation in integer fields, violating DICOM standards. This can corrupt spatial geometry, image display, radiation dose calculations, and other clinical data in downstream applications. The issue is fixed in dcmjs version 0.52.0.

Wails v2 contains a vulnerability in its origin validation logic where wildcard patterns in BindingsAllowedOrigins are improperly converted to regular expressions. This allows origins with suffixes matching the allowed pattern to bypass restrictions and invoke Go backend methods. The issue affects versions before 2.13.0 and can lead to unauthorized access to file systems, databases, or command execution depending on the exposed API surface. A fix is available in version 2.13.0.