Threats affecting pkg:bitnami/postgresql

GoFound versions up to 1.4.1 contain a stored cross-site scripting (XSS) vulnerability. Unauthenticated attackers can inject malicious scripts by submitting document text to the /api/index endpoint. The injected HTML is returned unescaped by searcher/engine.go and rendered with v-html in dashboard.vue, leading to script execution in an administrator's browser when a search matches the malicious document.

ape-volo-admin versions before 3.6.1 have an authentication bypass vulnerability due to a hardcoded JWT signing key in appsettings.json. This allows unauthenticated attackers to forge administrator tokens and gain full API control over users, roles, permissions, and data. The vulnerability is fixed in version 3.6.1.

OwnTone Server through 29.3 contains an sql injection vulnerability in mpd_sticker_find() in src/mpd.c that allows unauthenticated remote attackers to inject SQL via the URI argument. Attackers can send a crafted 'sticker find song' command to the MPD listener on TCP port 6600 to bypass path restrictions and enumerate all media files with filesystem paths and metadata.

QuickJS-NG before 0.16.0 contains a memory leak vulnerability in js_atomics_store() in quickjs.c that fails to free the converted value when returning a RangeError. Attackers running JavaScript can repeatedly call Atomics.store with a valueOf that detaches or shrinks the buffer to exhaust heap memory and cause denial of service.

QuickJS-NG versions before 0.16.0 contain an integer overflow vulnerability in the js_typed_array_sort() function. This flaw allows attackers running JavaScript to trigger a heap buffer overflow on 32-bit systems by sorting a very large typed array with a comparator. The overflow can lead to crashes or potentially arbitrary code execution.

QuickJS-NG versions before 0.16.0 contain an integer overflow vulnerability in the js_proxy_get_own_property_names() function. This flaw causes a heap buffer overflow on 32-bit hosts when JavaScript code returns a large array-like object from a Proxy ownKeys trap. The vulnerability can lead to crashes or potentially allow code execution.

Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains an out-of-bounds read vulnerability in the tgatoppm converter's get_pixel() function that uses unchecked pixel values as color map indexes. Attackers can supply a crafted color-mapped Targa file whose pixel values exceed the declared color map bounds to crash the converter or leak adjacent memory into the output image.

Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains an integer overflow in jbigtopnm that causes heap buffer overflow when computing output buffer size. Attackers can supply a crafted multi-plane JBIG file with large header dimensions so jbg_dec_merge_planes() overflows the undersized buffer, causing crashes or potentially code execution.

CVE-2026-120435 is a heap buffer overflow vulnerability in the Netpbm image processing tool, specifically in the xpmtoppm utility. The flaw arises from an unvalidated characters-per-pixel value in the XPM file header, allowing attackers to supply crafted XPM files with characters-per-pixel greater than 3. This causes an overrun of fixed 3-byte colorName hash entries, potentially leading to crashes or code execution. The vulnerability affects Netpbm versions before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08. Fixes are available in versions 10.86.51, 11.02.30, and 11.15.08. The CVSS 4.0 score is 8.5, indicating high severity.

CVE-2026-120434 is a stack-based buffer overflow vulnerability in the Netpbm image processing tool. It affects the picttoppm utility's scanPoly() function, which improperly handles polygon edges in crafted PICT files with more than 5000 points. This can cause a crash or potentially allow code execution. The flaw affects Netpbm versions before 10.86.51, 11.0 up to but not including 11.02.30, and 11.03 up to but not including 11.15.08. Fixed versions are 10.86.51, 11.02.30, and 11.15.08.

Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a stack-based buffer overflow in the picttoppm paintPoly() function due to an unbounded polygon point count. Attackers can supply a crafted PICT file with a polygon exceeding 100 points to overwrite the fixed pts array, causing crashes or potentially code execution.

Netpbm before 10.86.51, 11.02.30, and 11.15.08 contains an integer overflow vulnerability in winicontopam that allows attackers to corrupt heap memory via oversized ICO/CUR dimensions. Attackers can supply a crafted icon file with width or height above 32767, wrapping int16_t loop counters into negative row buffer indices to cause crashes or potential code execution.

CVE-2026-120431 is a heap-based buffer overflow vulnerability in the Netpbm image processing toolkit. It affects versions before 10.86.51, 11.0 up to but not including 11.02.29, and 11.03 up to but not including 11.15.07. The flaw exists in the sgitopnm utility's readChannels() function when handling RLE-compressed SGI images. An attacker can craft malicious SGI files with oversized offset table lengths to overflow the heap buffer, potentially causing application crashes or arbitrary code execution.

CVE-2026-120430 is an insecure direct object reference vulnerability in Camaleon CMS versions before 2.9.2. It allows authenticated users with limited permissions to modify or delete categories they are not authorized to access by manipulating category IDs in update or destroy requests. The flaw affects the Admin::CategoriesController and is fixed in version 2.9.2.

Multiple security vulnerabilities affecting Mozilla Firefox and Thunderbird have been addressed in a Red Hat security update for Red Hat Enterprise Linux 7 Extended Lifecycle Support. These include sandbox escapes, use-after-free conditions, privilege escalations, information disclosures, and other memory safety issues across various components such as Graphics, DOM, JavaScript WebAssembly, Networking, and Audio/Video. The update is rated as important by Red Hat Product Security.

Camaleon CMS before 2.9.2 contains a missing authorization vulnerability in Admin::MediaController that allows low-privileged authenticated users to bypass the role-based Media permission. Attackers can POST to /admin/media/upload to store files, read private media via download_private_file, and use crop with saved_avatar to change other users' avatars.

PandaWiki 3.65.0 through 3.87.5 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to upload HTML files with image extensions via /share/v1/common/file/upload. Attackers can lure administrators to /static-file/<key>?a=.pdf, bypassing the nginx attachment header to serve HTML inline and steal the panda_wiki_token JWT for session takeover.

MrDoc versions up to 1.1.1 have an authorization bypass vulnerability in the get_doctemp view. Authenticated users can exploit this flaw by enumerating the sequential doctemp_id POST parameter to access document templates belonging to other users. This allows unauthorized reading of private template content across the instance.

OpenCSG CSGHub up to version 2.6.0-ce has an authorization bypass vulnerability in an unauthenticated file resolve route. This flaw allows remote attackers to read files from private repositories by injecting a specially crafted percent-encoded current_user parameter into the file path. The portal forwards this parameter along with its server API key, enabling unauthorized access to private model, code, or space repository files.

Chatify before 1.6.4 contains an authorization bypass vulnerability in the Pusher channel authorization endpoint that allows authenticated users to subscribe to other users' private channels by supplying arbitrary channel names. Attackers can request a signature for private-chatify.<victim id> via POST /chat/auth to receive the victim's incoming private messages and attachments in real time.