Threats affecting pkg:generic/hunspell

WeKnora before 0.8.2 contains a server-side request forgery vulnerability in isRestrictedIP() that misclassifies NAT64-prefixed IPv6 addresses as public. Authenticated attackers can supply URLs resolving to NAT64 encodings of internal addresses via web_fetch or URL-based knowledge import to reach internal services or cloud metadata endpoints.

An out-of-bounds write vulnerability exists in llama.cpp versions before b11865 in the ggml-rpc RDMA transport's rdma_recv() function. This flaw allows unauthenticated peers advertising RDMA capabilities to overflow a 1-byte stack variable by sending up to 256 KiB of data, potentially crashing the server or enabling code execution.

LibreSSL versions up to 4.4.0 contain a memory exhaustion vulnerability in the ocspcheck component. This flaw allows malicious OCSP responders to send unbounded HTTP responses, causing the client to consume excessive memory. Attackers who control the OCSP responder or can intercept unencrypted HTTP AIA OCSP traffic can exploit this by streaming endless headers or body data, resulting in denial of certificate status checks.

CVE-2026-118373 is a vulnerability in LibreSSL's ocspcheck component up to version 4.4.0 that causes cleartext transmission of sensitive OCSP request data. The issue arises because the function url2host() removes the OCSP URL scheme, and http_alloc() only uses TLS for port 443. As a result, OCSP requests sent to HTTPS responder URLs on non-443 ports are transmitted without encryption, exposing certificate serial numbers, issuer hashes, and nonces to on-path attackers.

LibreSSL ocspcheck through 4.4.0 contains a CRLF injection vulnerability that allows attackers to inject HTTP headers by embedding CR/LF sequences in a certificate's AIA OCSP URI path. Because url2host() copies the path without rejecting control characters and http_open() places it in the POST request line, attackers can inject headers or split OCSP requests sent to the responder host.

LibreSSL versions up to 4.4.0 have a CRLF injection vulnerability in the libcrypto OCSP_sendreq_new() and OCSP_parse_url() functions. This flaw allows attackers to inject carriage return and line feed characters into the OCSP request line by embedding them in a certificate's Authority Information Access OCSP URI. This can lead to HTTP header injection or request splitting when communicating with OCSP responders or proxies.

CVE-2026-118370 is a high-severity vulnerability in libexpat up to version 2.9.0 involving a signed integer overflow in the storeAtts() function. This flaw allows attackers to cause out-of-bounds writes by supplying a document with an extremely large number of attributes, potentially crashing applications or corrupting heap memory.

CVE-2026-117610 is a high-severity vulnerability in libexpat up to version 2.9.0 involving a NULL pointer dereference in the externalEntityInitProcessor2() function. This flaw occurs when the function mishandles the XML_TOK_NONE token from empty input, allowing attackers who control stream chunking to cause a crash by forcing an empty non-final first parse on an external entity subparser.

rtl_433 through 25.12 contains a stack-based buffer overflow vulnerability in proflame2_mc() that allows nearby attackers to write past a 7-byte stack buffer by sending more than seven valid Manchester-coded words. Attackers can transmit a crafted OOK radio signal or supply a crafted signal file to crash rtl_433 and corrupt stack memory, enabling control-flow hijacking on builds without stack canaries.

An integer overflow vulnerability exists in assimp through version 6.0.5 in the MD2Importer::ValidateHeader() function. This flaw allows attackers to craft malicious .md2 files with manipulated numFrames and numVertices fields that bypass frame table bounds checks. Exploitation can lead to heap out-of-bounds reads, causing application crashes or potential exposure of adjacent heap memory.

Xerte Online Toolkits versions up to 3.15.5 have a remote code execution vulnerability that allows authenticated users with system permissions to execute arbitrary PHP code by importing a specially crafted language pack ZIP file containing a .inc file. This file can then be accessed via the language parameter to trigger code execution on the server.

NexoPOS versions up to 6.3.0 have an authorization bypass vulnerability that allows authenticated cashiers with the default permission nexopos.use.registers to manipulate other cashiers' register sessions. This occurs because the CashRegistersService does not verify that the user performing actions on a register session is the session owner. Attackers can submit POST requests to the cash register API endpoints to force-close sessions or alter cash balances without proper authorization.

nopCommerce before 5.00.0 contains a missing authorization vulnerability in the admin ProductController RelatedProductAddPopup, CrossSellProductAddPopup and AssociatedProductAddPopup handlers that fail to verify parent product ownership. Authenticated vendors can submit another vendor's product id as model.ProductId to inject their products into the victim's related-products, cross-sell and grouped-product listings.

A vulnerability was detected in a2ui-project a2ui up to 0.10.6. Affected is the function DataContext.dispatchExpressionError of the file renderers/web_core/src/v0_9/rendering/data-context.ts of the component Error Handler. Performing a manipulation results in information exposure through error message. It is possible to initiate the attack remotely. The exploit is now public and may be used. The patch is named 8f149a1c7b0ce1fa8e93ac3adfa5fda960faeb01. It is suggested to install a patch to address this issue.

CVE-2026-111943 addresses a vulnerability in Go version 3.0 related to the distrust of compromised intermediate certificates in the crypto/x509 package. The issue involves handling of intermediate certificates that have been compromised, which could affect the validation of certificate chains.

The Jupiter X Core WordPress plugin up to version 4.61.0 contains an authentication bypass vulnerability in its Twitter/X social login handler. The flaw arises because the plugin fails to update the OAuth token after exchanging the oauth_verifier, causing the Twitter API call to authenticate as the site owner rather than the visitor. This allows attackers to gain authenticated access as the WordPress user linked to the Twitter app owner, typically the site administrator.

CVE-2026-118271 is a medium severity vulnerability in a2ui-project a2ui versions 0.10.0 through 0.10.6. It involves resource consumption caused by manipulation of an unknown function in the data-context Resolver component. The vulnerability can be exploited remotely without user interaction or privileges. Public exploit code has been disclosed. A patch identified by commit eb314e14fabd29cfb4a74e1202afc4fe2081efa2 is available to remediate the issue.

The FBI seized the domain virtualine.net on October 27, 2026, as part of Operation Omegaline targeting Virtualine Technologies, which operated the bulletproof hosting provider Omegatech (AS202412). Bulletproof hosting providers rent servers to cybercriminals and ignore abuse complaints, facilitating phishing, malware, and ransomware operations. Over the past year, law enforcement actions, sanctions, and strategic abandonments have resulted in 50 such providers losing their autonomous system numbers. Despite these disruptions, operators rapidly rebrand and acquire new ASNs to continue malicious activities. The investigation involved multiple international law enforcement agencies and private partners.

A vulnerability identified as CVE-2026-2270 affects Microsoft software version 3.0, where write permissions on StatefulSet and ControllerRevision resources allow creation of pods across namespaces. This could lead to unauthorized pod creation in namespaces where the attacker should not have permissions.

CVE-2026-76654 is a vulnerability involving subpath symlinking on Windows nodes that permits NTLM coercion. The vulnerability is identified with CWE-59, which relates to improper linkage of symbolic links. No CVSS score or detailed impact information is provided. The affected version is Microsoft product version 3.0. There is no public exploit known in the wild and no patch information is available.