Threats affecting pkg:generic/htslib

A vulnerability in Fortinet FortiMail versions 8.0.0, 7.6.0 through 7.6.5, 7.4.0 through 7.4.7, and 7.2.0 through 7.2.9 allows an unauthenticated attacker to reset the password of any IBE webmail user. This is due to a weak password recovery mechanism that can be exploited via specially crafted HTTP requests, potentially leading to account takeover.

CVE-2026-126146 is an OS command injection vulnerability affecting multiple versions of Fortinet FortiMail and FortiRecorder. It allows an authenticated privileged attacker to execute unauthorized commands via a specially crafted archive account configuration. The vulnerability impacts FortiMail versions 7.2.0 through 7.2.9, 7.4.0 through 7.4.6, 7.6.0 through 7.6.4, and 8.0.0 through 8.0.1, as well as FortiRecorder versions 7.0.0 through 7.0.6, 7.2.0 through 7.2.11, and 7.6.0. The CVSS v3.1 score is 7.2, indicating a high severity. No patch or remediation information is provided in the data.

A path traversal vulnerability exists in Fortinet FortiMail versions 7.2 (all versions), 7.4.0 through 7.4.8, 7.6.0 through 7.6.6, and 8.0.0 through 8.0.1. This flaw allows an unauthenticated attacker to execute unauthorized commands by sending specially crafted requests that bypass directory restrictions.

An integer overflow or wraparound vulnerability exists in Fortinet FortiMail versions 7.2 (all versions), 7.4.0 through 7.4.8, 7.6.0 through 7.6.6, and 8.0.0 through 8.0.1. This flaw may allow a remote unauthenticated attacker to cause a denial of service by crashing the FortiMail daemon.

An out-of-bounds write vulnerability exists in Fortinet FortiMail versions 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and all versions of 7.2. This flaw may allow a remote unauthenticated attacker to cause a denial of service by sending a specially crafted HTTP request.

CVE-2026-126148 is a critical OS command injection vulnerability in Fortinet FortiMail versions 7.6.0 through 7.6.6 and 8.0.0 through 8.0.1. It allows an unauthenticated attacker to execute arbitrary commands by sending specially crafted HA join-request packets. The vulnerability has a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability.

A vulnerability in Fortinet FortiClientEMS versions 7.2 (all versions), 7.4.0 through 7.4.1, and 7.4.3 through 7.4.7 allows an authenticated local attacker with administrative privileges to execute commands with unnecessary elevated privileges, potentially gaining root shell access via CLI commands.

An improper authentication vulnerability exists in Fortinet FortiMail versions 7.2 (all versions), 7.4.0 through 7.4.8, 7.6.0 through 7.6.6, and 8.0.0 through 8.0.1. This flaw may allow an unauthenticated attacker to gain access to other users' secure email accounts by sending crafted HTTP requests.

CVE-2026-126152 is an authorization bypass vulnerability affecting Fortinet FortiMail versions 7.2 all versions, 7.4.0 through 7.4.8, 7.6.0 through 7.6.6, and 8.0.0 through 8.0.1. It allows an authenticated remote attacker to delete arbitrary directories as root or access and delete other users' calendar and mailbox data across tenant domains via crafted HTTP requests to the webmail and administrative interfaces.

An OS command injection vulnerability exists in Fortinet FortiMail versions 8.0.0 through 8.0.1. This flaw allows an authenticated administrator to execute unauthorized commands as root via specially crafted HTTP requests. The vulnerability is rated high severity with a CVSS score of 7.2.

An open redirect vulnerability exists in Fortinet FortiAuthenticator versions 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10. This flaw allows an unauthenticated attacker to craft HTTP requests that redirect users to untrusted external sites. The vulnerability has a medium severity rating with a CVSS score of 6.1.

Dell Display and Peripheral Manager (DDPM Windows) versions prior to 2.4.0.17 contain a Time-of-check Time-of-use (TOCTOU) condition vulnerability. This flaw allows a low privileged local attacker to potentially execute arbitrary code. The vulnerability has a high severity rating with a CVSS score of 7. No patch or remediation details are provided in the available data.

An incorrect authorization vulnerability exists in Fortinet FortiMail versions 7.2 (all versions), 7.4.0 through 7.4.8, 7.6.0 through 7.6.6, and 8.0.0 through 8.0.1. This flaw may allow an unauthenticated remote attacker to obtain an authenticated IBE webmail session as any IBE recipient and read or send their encrypted mail by sending crafted HTTP requests.

CVE-2026-126159 is an authorization bypass vulnerability in Fortinet FortiMail versions 7.2 (all versions), 7.4.0 through 7.4.8, 7.6.0 through 7.6.6, and 8.0.0 through 8.0.1. It allows an unauthenticated attacker to release or delete quarantined email messages for arbitrary mailboxes by sending a crafted quarantine release request. The vulnerability has a high severity with a CVSS score of 7.5.

CVE-2026-126785 is a critical vulnerability in rmalright TR-VISION HOME version 2.0.5. It involves incorrect default permissions in the IOCTL Handler component, specifically in the sub_11504 function of the WFanManager.sys library. The vulnerability requires local access to exploit and can lead to significant security risks due to improper permission settings. The vendor has not responded to disclosure attempts, and no patch or remediation information is currently available.

CVE-2026-125785 is a stored cross-site scripting (XSS) vulnerability in Crocoblock JetEngine versions prior to 3.9.1.1. It involves improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. The vulnerability affects versions from initial releases up to 3.9.1. The issue has been fixed in version 3.9.1.1.

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Code Injection.This issue affects Quiz And Survey Master: from n/a through 11.3.0.

Missing Authorization vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quiz And Survey Master: from n/a through 11.3.0.

.NET 9.0 on Red Hat Enterprise Linux 10 has multiple security vulnerabilities including information disclosure, elevation of privilege, and denial of service affecting ASP.NET Core and .NET components. These issues are addressed in an update to SDK 9.0.124 and Runtime 9.0.23. The update is rated as important by Red Hat Product Security.