Threats affecting pkg:npm/@byondreal/accessor

CVE-2026-86575 is a critical stack-based buffer overflow vulnerability affecting multiple Hitachi JP1 products, including JP1/Integrated Management 3 - Manager and JP1/Automatic Job Management System 3 components. The flaw exists in versions from 13-00 up to but not including 13-50-31 for Integrated Management and Automatic Job Management System, and from 11-00 up to but not including 12-50-54 for JP1/Base. This vulnerability allows an unauthenticated attacker to execute arbitrary code with high impact on confidentiality and integrity, and a low impact on availability. Fixed versions are available for all affected products.

CVE-2026-86574 is a critical heap-based buffer overflow vulnerability in Hitachi JP1/Base affecting versions from 11-00 up to but not including 12-50-54. This flaw allows an attacker to execute arbitrary code or cause a denial of service due to memory corruption. The issue has been fixed in version 12-50-54.

The twofactor_gauthenticator plugin for Roundcube has a vulnerability that allows bypassing two-factor authentication by spoofing client IP address headers. An attacker who has obtained a user's password can exploit the lack of validation of Client-IP and X-Forwarded-For headers to spoof a whitelisted IP address, thereby bypassing the second factor. This issue has been fixed in a specific commit.

The twofactor_gauthenticator plugin for Roundcube has a vulnerability where sessions persist after failed two-factor authentication (2FA) attempts due to insufficient session expiration. An attacker who obtains a user's password may exploit this to keep the session alive and attempt to brute force the second-factor code. This issue was fixed in a specific commit.

The twofactor_gauthenticator plugin for Roundcube suffers from a vulnerability that allows brute-forcing of the second-factor authentication code due to lack of rate limiting. An attacker who has obtained a user's password can repeatedly submit arbitrary 6-digit codes to bypass the second-factor authentication and gain unauthorized access. This issue has been fixed in a specific commit.

A Cross-Site Request Forgery (CSRF) vulnerability exists in the category management functionality of the Phoca Download extension for Joomla versions 3.1.0 through 6.1.5. This vulnerability allows an attacker to trick an authenticated user into performing unwanted actions without their consent.

An authenticated IPMI Administrator can exploit this vulnerability to read arbitrary files from the BMC filesystem, exposing sensitive data beyond the intended IPMI management scope. The vulnerability has a CVSS score of 4.9, indicating medium severity. No patch or remediation details are currently provided.

An authenticated IPMI Administrator can read and write arbitrary physical memory on the Baseboard Management Controller (BMC), potentially allowing execution of code on the BMC operating system. This vulnerability has a high severity with a CVSS score of 7.2, indicating significant confidentiality, integrity, and availability impacts. No specific affected versions or patches are provided in the available data.

An IPMI authenticated administrator may be able to execute commands as the operating system root user on the Baseboard Management Controller (BMC). This vulnerability has a CVSS score of 6.6, indicating a medium severity level. It involves command execution with high impact on confidentiality, integrity, and availability. No affected versions or patch information are provided.

A vulnerability in the BMC RAKP+ implementation allows an attacker to send a request followed by a specially crafted RAKP message to establish an RMCP+ session. This session could then be used to execute commands on the affected system. The flaw has a CVSS score of 7.4, indicating high severity.

The Qode Membership plugin for WordPress versions up to and including 2.0.6.2 contains an authentication bypass vulnerability due to a typographic error in Facebook OAuth token verification. This flaw allows unauthenticated attackers to bypass token validation and log in as any existing WordPress user, including administrators, by exploiting a publicly accessible nonce. The vulnerability arises from an undefined variable causing the token verification check to be skipped, enabling account takeover.

A logic flaw in the Baseboard Management Controller (BMC) IPMI implementation allows an attacker with limited privileges to send specially crafted RAKP+ messages and escalate their account to administrator privileges. This vulnerability can lead to full control over the BMC, impacting confidentiality, integrity, and availability.

An OS command injection vulnerability exists in the OnCell G3150A-LTE Series devices. This vulnerability occurs when the SMS management functionality is enabled and configured, allowing a remote attacker with required privileges to execute arbitrary commands due to insufficient input validation.

A vulnerability in the Baseboard Management Controller (BMC) allows improper enforcement of integrity and encryption requirements for IPMI commands. This flaw enables an attacker to craft malicious packets that could execute arbitrary commands within an active session. The vulnerability has a critical severity rating with a CVSS score of 9.8.

CVE-2026-18451 describes a vulnerability in the HTML5 KVM-over-IP console authentication mechanism where session tokens returned by the web interface can be guessed due to weaknesses in token generation. This could allow an attacker to take control of an active KVM session. The vulnerability has a low CVSS score of 3.1, indicating limited impact and exploitability.

CVE-2026-16521 is an OS command injection vulnerability caused by insufficient input filtering in a BMC function. An attacker with high privileges can inject malicious commands that may execute when the related service is restarted. This vulnerability has a high severity score of 7.2 and impacts confidentiality, integrity, and availability.

The Baseboard Management Controller (BMC) fails to properly enforce integrity and encryption requirements for IPMI commands. This vulnerability allows an attacker to craft malicious packets that could execute arbitrary commands on an active session without requiring privileges or user interaction. The issue poses a high security risk due to the potential for unauthorized command execution.

The Jupiter X Core plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'forget_password_link' parameter. This affects all versions up to and including 4.61.0. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises from insufficient input sanitization and output escaping.

This vulnerability involves a hardcoded key in the GSS Deployment Server installation that, if obtained by an attacker, could allow decryption of sensitive credentials including domain/service account passwords, task run-as credentials, and sysprep passwords. The flaw has a high severity rating with a CVSS score of 7.6. No affected versions or patch information are provided, and there are no known exploits in the wild at this time.

An improper certificate validation vulnerability in Moxa Remote Connect Suite (MRC Client) allows an unauthenticated attacker with on-path access to impersonate a trusted server. This can enable a man-in-the-middle attack, potentially compromising the confidentiality and integrity of communications between the client and server.