Threats affecting pkg:generic/libultrahdr

Grimoire before 1.0.0 contains an unauthenticated server-side request forgery vulnerability in the /api/fetch-metadata POST handler that passes user-supplied URLs to getMetadata() without authentication checks. Attackers can submit URLs targeting loopback, internal-network, or cloud metadata endpoints and read the parsed title, description, and page content returned.

abp-next-admin versions 10.4.0 through 10.7.0 have an authorization bypass vulnerability in the BlobManagement download-by-name endpoint. Authenticated users can exploit this flaw to access files belonging to other tenants by supplying a victim tenantId in the request path, causing the system to switch tenant context improperly.

SonicJS versions up to 3.0.0 have a missing authorization vulnerability in certain API write routes. Authenticated users with author or editor roles can bypass document access controls and administrator restrictions to create, modify, publish, or soft-delete documents belonging to other users. This occurs because the API only checks coarse role labels rather than fine-grained permissions.

InternLM lmdeploy versions 0.9.0 through 0.18.0 contain a critical unauthenticated remote code execution vulnerability. The flaw arises from unsafe deserialization of pickled data sent to the /update_weights endpoint, allowing attackers to execute arbitrary OS commands as the api_server process by submitting crafted base64-encoded pickle payloads.

SerpBear before 3.1.1 contains a missing authentication vulnerability in pages/api/notify.ts that allows remote unauthenticated attackers to trigger notification emails because verifyUser() is never called. Attackers can repeatedly POST to /api/notify, optionally with a domain parameter, to exhaust SMTP rate limits, trigger provider abuse flags and flood recipients.

BastilleBSD bastille versions up to 1.4.4 have a symlink following vulnerability in certain subcommands that allows jailed users to escape jail isolation. This occurs because jailed users can create symbolic links pointing to host system paths or other jail roots, causing administrator-run copy commands to overwrite or read host files with root privileges.

xiaozhi-esp32-server versions up to 0.9.8 have an authentication bypass vulnerability in the WebSocketServer._handle_auth function. This flaw allows remote attackers to bypass Bearer HMAC token verification by spoofing the Device-ID header with an allowlisted MAC-address-shaped identifier. Exploiting this, attackers can open authenticated WebSocket sessions, issue voice-assistant commands, exchange audio, and access the conversation context of the spoofed device.

WPGraphQL versions before 2.24.1 have a missing authorization vulnerability in the createComment mutation. This flaw allows unauthenticated attackers to add comments to non-public posts, including drafts, private, trashed, or password-protected posts. Exploitation can lead to leaking hidden post titles via moderator notifications, enumerating post IDs, and manipulating comment metadata such as backdating or marking comments as pingbacks.

WPGraphQL before 2.24.1 contains a missing rate limiting vulnerability that allows unauthenticated attackers to flood password reset emails by aliasing the sendPasswordResetEmail mutation. Attackers can send one HTTP request with many aliases, bypassing batch_limit, to exhaust mail provider quota and repeatedly rotate reset keys, blocking legitimate password recovery.

WPGraphQL versions before 2.24.2 have an information disclosure vulnerability that allows unauthenticated attackers to infer the existence of certain objects by observing distinct error responses. This flaw affects mutations such as deleteMediaItem, updateMediaItem, deleteComment, and updateComment, enabling attackers to discover hidden draft, private, trashed posts, custom post types, and unapproved comments.

WPGraphQL Smart Cache versions before 2.3.3 have a vulnerability that allows unauthenticated attackers to cause uncontrolled resource consumption. This occurs via the Automatic Persisted Query handler, enabling attackers to persist unlimited query documents. By sending distinct queries with matching SHA-256 queryId values, including batched operations, attackers can cause unbounded growth of the wp_posts database table, leading to degraded database performance.

CVE-2026-104067 is an out-of-bounds memory access vulnerability in Scribus versions before 1.6.7. It occurs in the importsvm plugin when it fails to verify that bitmap and transparency mask dimensions match. An attacker can craft a malicious SVM file with mismatched mask dimensions to trigger heap reads and writes, potentially causing application crashes or arbitrary code execution under the user's privileges.

Scribus before 1.6.7 contains a heap buffer overflow vulnerability in the Mac PICT image loader and import plugin when unpacking 4-bit indexed pixel data. Attackers can supply a crafted PICT file with inconsistent width and row data that, when placed or imported, writes out of bounds, causing crashes or code execution.

Scribus versions before 1.6.7 have an out-of-bounds write vulnerability in the importdrw Micrografx Draw plugin. This flaw arises from using an unvalidated y offset to select image scanlines when importing crafted DRW files. Exploitation can lead to heap corruption, causing application crashes or potential code execution.

Scribus versions before 1.6.7 have an integer overflow vulnerability in the TIFF loader component. This flaw allows attackers to craft TIFF files with large tile dimensions that trigger a heap overflow when imported, potentially leading to application crashes or arbitrary code execution.

CVE-2026-104063 is an out-of-bounds read vulnerability in Scribus versions before 1.6.7. It affects the Mac PICT image loader and import plugin when decoding planar pixel data. A crafted PICT file with manipulated dimensions can cause heap over-reads, potentially leading to application crashes or disclosure of heap memory.

Scribus before 1.6.7 contains a heap buffer overflow vulnerability in the PICT image loader and import plugin that allows attackers to corrupt heap memory by supplying an unchecked bytesPerLine value. Attackers can craft a PICT file whose bytesPerLine exceeds the QImage scanline size, so placing or importing it crashes Scribus and may execute code as the user.

CVE-2026-104061 is a heap out-of-bounds write vulnerability in Scribus versions before 1.6.7. It occurs in the scimgdataloader_psd loader due to unchecked PSD file values used as array indexes. An attacker can exploit this by convincing a user to open or import a crafted PSD file, leading to heap corruption, application crashes, and potentially arbitrary code execution with user privileges.

CVE-2026-119369 is a stored cross-site scripting (XSS) vulnerability in The Events Calendar plugin by Liquid Web / StellarWP. It affects versions from initial releases up to 6.18.2. The flaw allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. A fix is available in version 6.18.3.

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Code Injection.This issue affects JetFormBuilder: from n/a through 3.6.7.1.