Threats affecting pkg:bitnami/brotli

Use after free in Frames in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in Input in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Memory corruption in Network in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Memory corruption in CacheStorage in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity: High)

Memory corruption in Autofill in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Memory corruption in MediaStream in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

CVE-2026-37468 is a Cross Site Scripting (XSS) vulnerability in BeeHome MyBeeHome affecting versions before 2025-11-01. It allows a remote attacker to execute arbitrary code via the Profile editing functionality and the chat messaging component.

An issue was discovered in Keyfactor EJBCA 9. When an administrator is removed from its administrator role while having a valid TLS session, EJBCA may, in certain circumstances, cache authentication for longer than the configured maximum time (default: 30 seconds), which results in the former administrator retaining access that they should no longer have.

An authenticated cross-site scripting (XSS) vulnerability exists in Spina CMS version 2.21.0 in the /spina/embeddable.rb component. This flaw allows attackers with authentication to inject arbitrary web scripts or HTML via a crafted URL, potentially leading to script execution in the context of the affected application.

CVE-2026-117183 is a path traversal vulnerability in the FeaturedImage component of astro-notion-blog version 0.13.0. This flaw allows attackers to escape the intended directory restrictions and read or overwrite files on the server by using a specially crafted URL.

A vulnerability in the GraphQL endpoint of traggo server version 0.8.3 allows attackers to cause a Denial of Service (DoS) by sending a specially crafted POST request. This flaw can disrupt the availability of the affected server.

Bitcoin Core versions prior to 29.5, 30.4, 31.2, and 32.1 contain a vulnerability that can cause an out-of-memory (OOM) condition.

Bitcoin Core versions through 31.1 have a vulnerability where undo files used by the software have no size limit, which can be exploited to cause a Denial of Service (DoS).

Bitcoin Core versions prior to 29.5, 30.4, 31.2, and 32.1 contain a vulnerability that can lead to an out-of-memory (OOM) condition.

Skuul School Management System versions up to 2.6.5 have an access control vulnerability in the ResultChecker::checkResult method. Authenticated students can exploit this flaw by manipulating the studentId parameter to access other students' examination results without authorization.

CVE-2026-111497 is a vulnerability known as Node2Shell affecting Palo Alto Networks PAN-OS on Siemens RUGGEDCOM APE1808 devices. Siemens recommends protecting network access to these devices using appropriate security mechanisms and following their operational guidelines for industrial security. The vulnerability is recognized as exploitable in the wild and has been added to the CISA KEV catalog. No specific affected versions or patch information are provided.