Threats affecting pkg:generic/osquery

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Drupal Fasttoggle module affecting versions from 0.0.0 up to but not including 4.1.1. This flaw allows attackers to perform unauthorized actions on behalf of authenticated users. The issue is fixed in version 4.1.1.

CVE-2026-118574 is a vulnerability in the Drupal S3 File System module that involves incorrect permission assignment for critical resources. This flaw affects versions from 0.0.0 up to but not including 3.12.0. It allows exploitation due to improperly configured access control security levels. The issue has been fixed in version 3.12.0.

CVE-2026-118567 is an incorrect authorization vulnerability in the Drupal Bulk Update User Roles module that allows forceful browsing. This affects versions from 0.0.0 up to but not including 1.0.5. The issue has been fixed in version 1.0.5.

CVE-2026-118572 is an authentication bypass vulnerability in the Drupal OAuth Login - OAuth OIDC SSO module. It allows attackers to bypass authentication by exploiting an alternate path or channel. This affects versions from 0.0.0 up to but not including 3.1.1. The issue is fixed in version 3.1.1.

CVE-2026-118575 is a stored cross-site scripting (XSS) vulnerability in the Drupal Signature pad widget. It affects versions from 0.0.0 up to but not including 1.15.0. The vulnerability arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. The issue is fixed in version 1.15.0.

A Cross-site Scripting (XSS) vulnerability exists in the Drupal Stage File Proxy module. This flaw allows improper neutralization of input during web page generation, potentially enabling XSS attacks. The vulnerability affects Stage File Proxy versions from 0.0.0 up to but not including 3.1.7, and from 4.0.0 up to but not including 4.0.1. Fixed versions are 3.1.7 and 4.0.1.

CVE-2026-118554 is an authentication bypass vulnerability in the Drupal OpenID Connect Client module. It allows attackers to bypass authentication by using an alternate path or channel. This affects versions from 0.0.0 up to but not including 2.3.1. The issue is fixed in version 2.3.1.

CVE-2026-118583 is an incorrect authorization vulnerability in the Drupal Field Permissions module that allows forceful browsing. This affects versions from 0.0.0 up to but not including 1.6.0. The issue has been fixed in version 1.6.0.

CVE-2026-118584 is an incorrect authorization vulnerability in the Drupal Field Permissions module that allows forceful browsing. It affects versions from 0.0.0 up to but not including 1.6.0. The issue has been fixed in version 1.6.0.

A missing authorization vulnerability (CWE-862) in the Drupal OAuth2 Token Manager component allows forceful browsing. This affects versions from 0.0.0 up to but not including 1.2.0. The issue has been fixed in version 1.2.0.

CVE-2026-118568 is an insecure storage vulnerability in Drupal Content Sync (content-sync.io) that allows retrieval of embedded sensitive data. It affects versions from 0.0.0 up to but not including 3.2.2. The issue has been fixed in version 3.2.2.

CVE-2026-118571 is a vulnerability in the Drupal Media Alias Display module that involves the use of web browser cache containing sensitive information due to incorrectly configured access control security levels. This affects versions from 0.0.0 up to but not including 2.1.3, and from 3.0.0 up to but not including 3.0.3. Fixed versions are 2.1.3 and 3.0.3.

Brotli2Bitcoin is a purposely vulnerable web application exposed to the internet as a live hacking challenge with a $1,000 bitcoin bounty for achieving remote code execution (RCE). The challenge is streamed live, showing all attack attempts in real time. The scope is limited strictly to brotli2bitcoin.com, with authorized testing and rules to prevent denial of service or attacks outside the target. The first verified RCE that runs a specific command and reports the flag wins the bitcoin prize. This is a controlled security research exercise rather than an active threat or vulnerability disclosure.

CVE-2026-74915 is a vulnerability in Imagination Technologies Graphics DDK involving an out-of-range pointer offset (CWE-823). A specially crafted web page with unusual WebGPU content can cause an out-of-bounds read or write crash in the GPU GLES user-space shared library. On platforms where the graphics workload process has system privileges, this vulnerability could potentially enable further exploitation on the device.

CVE-2026-74912 is a vulnerability in Imagination Technologies Graphics DDK involving an out-of-range pointer offset due to integer truncation when mapping GPU buffer pages within the 0GB to 4GB range. This issue arises on GPU systems where the fix for CVE-2026-49746 is applied, limiting the mapping range of graphics buffers and causing errors that restrict kernel mode driver functionality.

CVE-2026-19199 is an integer overflow vulnerability in the Imagination Technologies Graphics DDK kernel mode driver. The flaw occurs during page-to-byte conversion of an allocation size, causing an undersized kernel buffer allocation. This may allow unallocated or previously allocated physical pages to be mapped into an attacker-controlled GPU MMU context, potentially leading to disclosure of sensitive kernel data.

CVE-2026-18629 is an integer overflow vulnerability in Imagination Technologies Graphics DDK. It occurs when unusual GPU shader code causes arithmetic operations to overflow, leading to incorrect memory size calculations and memory allocation failures. If these failures are not handled properly, the GPU compiler process may dereference a NULL pointer, causing a crash. On some platforms where the compiler runs with system privileges, this crash could potentially be leveraged for further exploits.

CVE-2026-65587 is an out-of-bounds write vulnerability in Imagination Technologies Graphics DDK. It occurs when a web page with unusual WebGPU content is loaded into the GPU GLES render process, causing the GPU user-space driver to write data beyond the intended memory offset. This can lead to memory corruption and potentially crash the browser or GPU process.

CVE-2026-65586 is a use-after-free vulnerability in Imagination Technologies Graphics DDK. It involves improper GPU system calls by non-privileged software that can free memory still in use, allowing replacement of memory buffers and causing arbitrary memory reads or writes to physical memory pages. This occurs because a memory buffer managed by the CPU driver and accessed by GPU firmware can be freed while still in use, leading to unauthorized GPU access to memory not managed by the CPU driver.

php2shell comprises two PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that allow unauthenticated remote code execution. Exploitation requires tailoring the attack to the specific PHP environment, making widespread mass exploitation difficult. However, network appliances running identical builds are vulnerable to a single calibrated exploit. Exploitation has been confirmed in the wild, including attacks on PAN-OS firewall management servers. Patching is available and strongly recommended, especially for internet-facing management interfaces and end-of-life PHP versions.