Threats affecting pkg:generic/mongoose

A vulnerability in the dbus-daemon component of Microsoft software causes the daemon to abort when a broadcast from the driver cannot be delivered and the reply_serial is not zero. This issue is identified as CVE-2026-120749 and relates to improper handling of message delivery failures.

CVE-2026-77299 is a vulnerability in Microsoft software involving the Regexp2 engine, where an unbounded memory amplification can occur due to a large {m} quantifier applied on a zero-width subexpression. This can lead to excessive memory consumption during regular expression processing.

A stack buffer overflow vulnerability exists in GDB version 3.0 in the function parse_tracepoint_definition due to a stale rs->buf tail. This vulnerability is identified as CWE-121. No CVSS score or detailed impact information is provided.

A stack buffer overflow vulnerability exists in Gdb version 3.0 in the parse_tsv_definition function due to a stale buffer tail. This vulnerability is identified as CWE-121. No CVSS score or detailed impact information is provided.

A vulnerability in gdbserver component of Gdb (version 3.0) involves heap disclosure and a wild pointer issue in the gdb_parse_agent_expr function caused by an untrusted agent-expression length.

A heap buffer overflow vulnerability exists in gdbserver's cmd_qtdpsrc command due to a mismatch between declared and actual length in qtdpsrc. This flaw could potentially lead to memory corruption. The vulnerability is identified in Microsoft product version 3.0. No CVSS score or detailed impact information is provided.

A stack buffer overflow vulnerability exists in GDB's fetch_register_using_p function due to an unchecked p-reply length. This vulnerability is identified as CVE-2026-121994 and affects Microsoft product version 3.0. No CVSS score or detailed impact information is provided.

CivetWeb version 3.0 contains a use-after-free vulnerability in its HTTP/2 implementation caused by stale pseudo-header state. This flaw can lead to memory corruption issues. No CVSS score or detailed impact information is provided. No patch or remediation details are available from the vendor advisory.

A vulnerability exists in Ansible-core's user module version 3.0 where the generate_ssh_key function follows a symlinked ~/.ssh directory. This behavior can enable local privilege escalation by allowing an attacker to manipulate SSH key generation paths.

Viber for iOS versions up to 29.4.0.24 contain a vulnerability where the app does not properly validate the logical screen width and height in GIF headers. An attacker can send a specially crafted GIF with zero dimensions that causes the app to crash due to an uncaught exception.

CVE-2026-126545 is a missing authorization vulnerability in WWBN AVideo up to version 29.7.1. It affects the API::get_api_tags() function in the plugin/API/API.php file, allowing registered users to access restricted video data by querying the tags API. Exploiting this flaw, attackers can subscribe to a tag and retrieve filenames, titles, and stored video_password values of unlisted, group-restricted, and password-protected videos, potentially enabling unauthorized viewing.

WWBN AVideo versions 6.5 through 29.7.1 have an email verification bypass vulnerability due to PHP loose comparison in the User::verifyCode() function. This flaw allows registered users to reuse a global salt from their own verification link to craft a code that can verify other users' email addresses, potentially unlocking features like live streaming on those accounts.

CVE-2026-126543 is a high-severity vulnerability in WWBN AVideo up to version 29.7.1. It involves improper verification of payment authenticity in the PayPal IPN handling script (plugin/PayPalYPT/ipnV2.php). Attackers can exploit this flaw by forwarding legitimate verified recurring payment notifications from their own PayPal accounts with arbitrary user IDs, resulting in unauthorized crediting of wallet balances on the affected site.

WWBN AVideo versions 6.5 through 29.7.1 have an authentication bypass vulnerability via Hybridauth social login display names. Attackers can impersonate any user, including administrators, by setting their social login display name to a victim's username and omitting the email, allowing login without a password.

CVE-2026-126541 is a high-severity authorization bypass vulnerability in WWBN AVideo versions up to 29.7.1. It affects the Live plugin's restream endpoints, allowing authenticated streamers to supply arbitrary live_transmitions_history_id values to obtain other users' stream keys and HLS URLs. This enables attackers to impersonate victims by publishing streams as them or restreaming private or pay-per-view content without authorization.

Directus versions before 12.1.0 have an authorization bypass vulnerability that allows unauthenticated attackers to bypass permission checks on public-mode WebSocket connections. By sending an invalid token, attackers can cause the system to set accountability to null, enabling them to read, create, update, or delete records in any user-defined collection without proper authorization. This vulnerability is fixed in version 12.1.0.

Jellyfin versions prior to 12.0 contain a path traversal vulnerability in the DELETE /Library/VirtualFolders and POST /Library/VirtualFolders/Name endpoints. This flaw allows unauthenticated attackers to delete or move directories by supplying specially crafted library names such as '..' or absolute paths before setup completes, potentially leading to recursive deletion of the data directory and the jellyfin.db database file.

WriteFreely versions before 0.17.3 contain a stored cross-site scripting (XSS) vulnerability. Authenticated authors can inject malicious HTML via the post slug in the CreatePost API. This injected script executes in RSS/Atom feed readers, newsletter recipients, and ActivityPub viewers. The vulnerability is fixed in version 0.17.3.

LibreCAD versions up to 2.2.1.6 have a heap-based out-of-bounds write vulnerability in the libdxfrw dwgReader18::parseDataPage() function. This flaw arises from unchecked buffer sizes and page offsets when processing AC1018 (R2004) DWG files. Maliciously crafted DWG files with manipulated startOffset values can trigger writes beyond the allocated heap buffer, potentially causing application crashes or code execution.

CVE-2026-126496 is an authorization bypass vulnerability in 1Panel-dev CordysCRM versions before 1.9.6. It allows authenticated users with ordinary contact or customer read permissions to access other users' contact information without proper organization, owner, or data-scope checks. Exploitation involves sending a GET request to /account/contact/get/{id} with another contact's ID to retrieve sensitive details such as names, phone numbers, owners, departments, linked customers, and custom fields.