Threats affecting pkg:generic/libhevc

pyasn1 versions up to 0.6.4 contain a denial of service vulnerability in the decoding of binary-encoded ASN.1 REAL values with large mantissas. The decoding process is quadratic in the mantissa length, causing excessive CPU consumption when processing crafted inputs. This affects BER, CER, and DER decoders using the RealPayloadDecoder. The issue is fixed in pyasn1 version 0.6.5.

CVE-2026-119196 is a high-severity vulnerability in pyasn1 versions from 3.4.0 up to but not including 5.47.0. It causes quadratic CPU consumption when decoding constructed BIT STRING values with many fragments, leading to potential CPU exhaustion and denial of service. The issue affects BER and CER decoders and certain schema-driven DER decoding paths. The vulnerability arises from inefficient bit-shifting operations during decoding. A fix is available in pyasn1 version 5.47.0.

pyasn1 versions 0.6.4 and earlier contain a quadratic-time denial of service vulnerability in the decoding of constructed OCTET STRINGs, constructed character strings, and indefinite-length ANY types. The decoder repeatedly concatenates fragments inefficiently, causing CPU usage to grow quadratically with the number of fragments. This can lead to CPU exhaustion if an attacker supplies crafted ASN.1 input to an affected decoder. The vulnerability affects BER and CER decoding paths and certain non-conforming DER inputs. No confidentiality or integrity impact is reported. The issue is fixed in version 5.47.0.

CVE-2026-119194 is a high-severity vulnerability in Prowler's pyasn1 library versions >=3.4.0 and <5.47.0. It causes quadratic CPU usage when decoding attacker-controlled BER, CER, or DER data without an ASN.1 schema, potentially leading to denial of service by exhausting CPU resources. The issue arises from inefficient handling of tag sets during schemaless decoding. A fix is available in version 5.47.0.

OAuthlib contains a vulnerability in its token grant handlers where an authenticated low-privilege client can supply a different client_id in the token request body, causing authorization checks to be performed under that other client's identity. This affects the client_credentials and Resource Owner Password Credentials grant flows. The issue arises because OAuthlib does not require the client_id in the request body to match the authenticated client's client_id before validating grant types and scopes. As a result, a low-privilege client can obtain tokens with scopes or grant types assigned to a higher-privilege client if the application validator authorizes based on the attacker-supplied client_id argument. The vulnerability is fixed in OAuthlib version 5.43.0_2.

The SimpleForm WordPress plugin up to version 3.10.2 contains an arbitrary file upload vulnerability via its handle_upload function. This flaw allows unauthenticated attackers to upload potentially executable files by bypassing extension and MIME type validation using trailing-dot filenames. The vulnerability arises from missing server-side file key allowlisting and inadequate pre-sanitization. Exploitation could lead to remote code execution. The nonce used for access control is publicly available in form shortcodes, making unauthorized exploitation trivial.

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress versions up to 2.4.12 is vulnerable to sensitive information exposure via the 'page' parameter. This vulnerability allows unauthenticated attackers to access personally identifiable information of staff members, including full name, email, phone number, gender, and timezone, as well as internal notes authored by administrators for published events. The sensitive data is exposed because the raw providers array is included in the JSON response without proper filtering.

The Acadlix LMS WordPress plugin up to version 1.1.9 contains an arbitrary file deletion vulnerability due to insufficient file path validation in a specific function. This flaw allows attackers with subscriber-level access or higher to delete arbitrary files on the server. The vulnerability is exacerbated by weak authentication controls, effectively allowing unauthenticated exploitation. Deleting critical files like wp-config.php can lead to remote code execution.

The All in One SEO – AI SEO Plugin for WordPress up to version 5.0.3 is vulnerable to sensitive information exposure via the 's' parameter. This vulnerability allows unauthenticated attackers to retrieve arbitrary non-public post meta values, including sensitive custom fields such as API keys and internal notes. These values are exposed verbatim in the HTML title element and JSON-LD SearchResultsPage schema, potentially leaking confidential information.

A vulnerability in konflux-ci's Continuous Integration automation scripts causes sensitive GitHub access tokens to be stored in plaintext on the runner without cleanup after execution. A local attacker with access to the CI environment can read these tokens and gain unauthorized repository access, potentially modifying source code or release artifacts. Exploitation requires prior code execution access on the CI runner. No effective mitigation or patch is currently available according to the vendor advisory.

CVE-2026-116086 is a vulnerability in konflux-ci where an attacker with permission to trigger automated workflow runs can cause information disclosure. The flaw arises because user-supplied issue titles are incorporated directly into data queries without proper sanitization, enabling injection of malicious filter commands. This can expose sensitive information such as API credentials, deployment keys, and internal notes in workflow logs. The impact is limited to information disclosure within CI pipeline logs and does not allow direct code execution or cluster compromise. No patch or mitigation meeting Red Hat's criteria is currently available.

The Smart Post WordPress plugin versions up to 4.0.9 are vulnerable to stored cross-site scripting (XSS) via the 'display_name' parameter. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users interact with certain page elements. Exploitation requires a page containing an Author Filter block alongside a grid or live-filter block, with script execution triggered by clicking the attacker's author entry in the dropdown filter.

The FeedWordPress plugin for WordPress versions up to and including 2026.0517 is vulnerable to stored cross-site scripting (XSS) via syndicated RSS/Atom feed content. The vulnerability arises because the plugin's content sanitization function only removes the 'target' attribute and does not strip potentially dangerous 'style' or event-handler attributes. Additionally, the plugin disables WordPress's default content filters before saving imported feed items, allowing unauthenticated attackers controlling an external feed to inject malicious scripts that execute when users view the injected content.

The Uncanny Toolkit for LearnDash WordPress plugin versions up to and including 3.8.2 contains an authentication bypass vulnerability via the email parameter in the uo_login_action() function. This flaw allows attackers to bypass account verification and suspension controls by exploiting inconsistent input sanitization between user lookup and authentication. Attackers with valid credentials for unverified or suspended accounts can obtain a valid session cookie without proper approval. The required nonce for exploitation is publicly accessible, making the attack trivial for anyone with network access and knowledge of the target credentials.

The Newsletters plugin for WordPress up to version 4.18.1 is vulnerable to a time-based SQL Injection via the 'id' parameter. This vulnerability arises from insufficient escaping and lack of proper preparation of the SQL query involving user-supplied input. Authenticated attackers with subscriber-level access or higher can exploit this flaw to append additional SQL queries and extract sensitive database information. Attackers can obtain necessary authentication tokens without a WordPress account by subscribing through the public newsletter form and using the management link sent via email. The ownership check only verifies the subscriber_id field and does not confirm that the injected 'id' parameter belongs to the authenticated subscriber.