Threats affecting pkg:generic/radare2

To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle

To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle

A critical security vulnerability (CVE-2025-55754) affects the wso2mi package due to improper neutralization of escape, meta, or control sequences in Apache Tomcat. This flaw can lead to significant impact on confidentiality, integrity, and availability. Versions prior to 4.3.0-r0, 4.4.0-r0, and 4.5.0-r0 are affected. A patch is available in these fixed versions.

A security vulnerability identified as CVE-2025-5878 affects the wso2mi package due to an issue in the ESAPI esapi-java-legacy component. The vulnerability has a high severity score of 7.3 and impacts confidentiality, integrity, and availability. Fixed versions are available starting from 4.3.0-r0, 4.4.0-r0, and 4.5.0-r0.

A security vulnerability identified as CVE-2026-116540 affects the wso2mi package due to an issue in netty-tcnative 2. The vulnerability has a CVSS 3.1 base score of 5.9, indicating medium severity. It impacts availability but does not affect confidentiality or integrity. Fixed versions are available starting from 4.3.0-r0, 4.4.0-r0, and 4.5.0-r0.

CVE-2026-71497 is a medium severity security vulnerability affecting the wso2mi package, which uses the jsoup Java library for processing HTML. The vulnerability impacts versions prior to 4.3.0-r0, 4.4.0-r0, and 4.5.0-r0. It has a CVSS score of 4.7 with network attack vector, high attack complexity, no privileges required, and requires user interaction. The vulnerability results in limited confidentiality and integrity impact but no availability impact. Fixed versions are available.

A high-severity security vulnerability (CVE-2026-75140) affects the wso2mi package due to an issue involving jsoup. The vulnerability impacts availability without affecting confidentiality or integrity. Fixed versions 4.3.0-r0, 4.4.0-r0, and 4.5.0-r0 are available.

A critical security vulnerability (CVE-2025-59340) affects the wso2mi package due to an issue in jinjava, a Java-based template engine adapted from Django template syntax to render Jinja templates. The vulnerability has a CVSS score of 10.0, indicating it is exploitable remotely without authentication and can lead to complete confidentiality, integrity, and availability compromise. Fixed versions 4.3.0-r0, 4.4.0-r0, and 4.5.0-r0 are available.

A security vulnerability exists in the Trino package due to differences in the Jetty URI parser's handling of invalid or unusual URIs compared to other common parsers. This flaw affects versions prior to 484-r0 and may lead to limited confidentiality and integrity impacts. The vulnerability has a medium severity rating and a CVSS score of 6.5.

A security vulnerability in the Trino package affects Eclipse Jetty's handling of HTTP/1, HTTP/2, and HTTP/3 requests. The flaw is due to the lack of strict verification that the request authority (host and port) matches the Host header if present. This vulnerability has a medium severity rating with a CVSS score of 5.3. A fix is available in version 484-r0.

CVE-2024-6763 is a medium severity vulnerability affecting the Trino package, specifically related to the Eclipse Jetty web server component. The flaw does not impact confidentiality or availability but allows for integrity compromise without requiring privileges or user interaction. A fix is available in version 484-r0.

A critical security vulnerability exists in the Trino package due to the Eclipse Jetty Digest authentication server-side component using ISO-8859-1 encoding for passwords. This flaw affects versions of Trino prior to 484-r0 and can lead to high confidentiality and availability impacts. A fix is available in version 484-r0.

A high-severity security vulnerability exists in the Trino package due to an issue in Eclipse Jetty's JASPIAuthenticator class, which sets two ThreadLocal variables during authentication checks. This flaw affects versions of Trino prior to 484-r0 and could lead to high-impact confidentiality and integrity breaches. A fix is available in version 484-r0.

Multiple injection vulnerabilities exist in resource metadata fields of GBIF Integrated Publishing Toolkit versions before 3.3.5. These flaws allow authenticated remote attackers to execute code in another user's session via stored cross-site scripting after user interaction. The vulnerabilities have a medium severity rating and a CVSS score of 4.8. No patch or fixed version information is provided in the available data.

A Cross-Site Scripting (XSS) vulnerability exists in myCred up to version 4.0.2 due to improper neutralization of script-related HTML tags, allowing code injection. This vulnerability has a medium severity with a CVSS score of 4.3. No official patch or remediation details are provided in the available data.

A missing authorization vulnerability exists in ibericode MC4WP (mailchimp-for-wp) versions up to 4.14.1. This flaw allows exploitation of incorrectly configured access control security levels, potentially leading to unauthorized modification of data or settings. The vulnerability has a medium severity rating with a CVSS score of 5.3.

A vulnerability in OpenShift Pipelines-as-Code (PAC) allows a namespace user with limited permissions to escalate privileges within that namespace. The flaw arises because PAC does not verify if the creator of a Repository custom resource is authorized to create PipelineRuns. This enables execution of attacker-controlled PipelineRuns with the pipeline ServiceAccount, which by default has ClusterRole/edit permissions. The result is namespace-scoped privilege escalation, allowing unauthorized reading of Secrets, resource manipulation, and potential supply chain injection in CI/CD namespaces.

A missing authorization vulnerability exists in WProyal Royal Elementor Addons (royal-elementor-addons) affecting versions up to 1.7.1068. This flaw allows exploitation of incorrectly configured access control security levels, potentially enabling unauthorized access to certain functions or data. The vulnerability has a CVSS 3.1 base score of 4.3, indicating a medium severity impact primarily on confidentiality. No public exploits or known active exploitation have been reported. No patch or remediation information is currently available.

A vulnerability in OpenBMB Internet of Agents affects the _primary_field_query function in the Agent Registry component. The flaw involves improper neutralization of special elements in data query logic due to manipulation of the argument key. This vulnerability can be exploited remotely and public exploit code is available. The product uses a rolling release model, so no specific affected or fixed versions are identified. The project has been notified but has not yet responded or issued a fix. The CVSS score is 7.3, indicating high severity.

A missing authorization vulnerability exists in WP SYNTEX Polylang plugin versions up to 3.9. This flaw allows exploitation of incorrectly configured access control security levels, potentially leading to unauthorized information disclosure and modification. The vulnerability has a medium severity rating with a CVSS score of 5.4.