Threats affecting pkg:bitnami/couchdb

CVE-2026-93515 is a use-after-free vulnerability in the .Org Server Present Extension affecting Microsoft product version 3.0. The vulnerability is publicly known but lacks detailed technical or impact information and has no CVSS score assigned.

CVE-2026-92709 is a vulnerability in Rsyslog version 3.0 involving a path traversal flaw in DynFile that allows arbitrary file write as root, potentially leading to remote code execution (RCE).

Red Hat has released a security update for the java-21-openjdk packages in Red Hat Enterprise Linux 8 and 9. This update addresses multiple security vulnerabilities across various components of the OpenJDK 21 Java Runtime Environment and Software Development Kit, including enhancements to PKCS5 padding, TLS certificate handling, LDAP logins, SASL authentication, HTTP client and server handling, XML processing, and more. The update is rated as Important by Red Hat Product Security. Users should apply this update to mitigate the addressed vulnerabilities.

CVE-2026-107238 is a high-severity vulnerability in the Veeam Management Pack for Microsoft System Center Collector service that allows an authenticated domain user to execute code remotely with LocalSystem privileges on affected servers. This vulnerability enables privilege escalation to the highest system level, potentially compromising the entire server. No specific affected versions or patch information is provided in the available data.

CVE-2026-92744 is a high-severity vulnerability in a privilege manager agent that under certain conditions allows a remote unauthenticated attacker to execute arbitrary code with LocalSystem privileges. The vulnerability has a CVSS 4.0 base score of 8.7, indicating significant impact. No affected versions or patch information are provided, and no known exploits are reported in the wild.

This vulnerability allows a member of the Veeam Virtualization Extensions Users group to execute remote code on servers running the Veeam Management Pack for Microsoft System Center Collector service. It is identified as CVE-2026-107239 with a high severity score of 8.8. The vulnerability involves a path traversal issue (CWE-23) that could lead to remote code execution. No affected versions or patch information are provided, and there are no known exploits in the wild at this time.

An authenticated, low-privileged Nessus user on Linux with scan-creation rights can read arbitrary text files on the scanner host by running a custom Unix compliance audit. This allows reading files with the privileges of the nessusd process without requiring higher privileges or user interaction.

Spreadsheet::XLSX versions before 0.19 for Perl contain a vulnerability that allows arbitrary code execution. The flaw arises from the use of string eval on number format conditions in ExcelFmt during workbook parsing. An attacker can craft a malicious XLSX file with a specially formatted number condition to execute arbitrary Perl code when the file is processed.

Tornado's RedirectHandler in versions >=2.2.0 <2.2.2_7 allows open redirect vulnerabilities when URL templates include substitutions that can alter the scheme or host of the redirect target. This can enable attackers to craft URLs that redirect users to arbitrary external sites, facilitating phishing attacks. The issue is fixed in version 2.2.2_7 by rejecting substitutions that change the scheme or host.

Tornado HTTP servers have a vulnerability in their header parser that causes quadratic CPU usage when parsing HTTP headers with obsolete line folding (line continuation with leading whitespace). An unauthenticated attacker can exploit this by sending specially crafted requests with many folded header lines, causing the server's event loop to block and degrade availability. The issue affects all Tornado HTTP servers before version 6.6. The vulnerability is fixed in Tornado 6.6 by removing support for obsolete line folding and rejecting header lines starting with whitespace.

Tornado HTTP servers are vulnerable to event loop blocking and excessive memory use when processing HTTP/1.1 chunked transfer encoding bodies composed of many small chunks. An attacker can send a request body with millions of 1-byte chunks, causing the event loop to block for extended periods (up to a minute for ~100 MB bodies) and consuming significantly more memory than the actual body size. This affects all Tornado HTTP servers that read request bodies without early rejection and also affects the SimpleAsyncHTTPClient when reading responses. The issue is fixed in Tornado 6.6 with changes to yield to the event loop periodically and optimize chunk handling.

A vulnerability in Apple Xcode allows an app to read arbitrary files due to improper handling of symlinks. This issue is resolved in Xcode version 27.2 with improved symlink handling.

A vulnerability in Apple Xcode prior to version 27.2 could allow an app to access sensitive user data due to an authorization issue. This flaw was addressed by improved state management and fixed in Xcode 27.2.

GitPython's Submodule.move() API does not properly validate symbolic links in the destination path, allowing an attacker-controlled symlink to redirect submodule moves outside the parent repository worktree. This can cause the submodule checkout to be moved to an unintended external directory, corrupting the parent repository's index and configuration. The vulnerability requires an attacker to supply a malicious Git repository with a symlinked path and the application to call Submodule.move() on a path beneath that symlink. No code execution or confidentiality impact is demonstrated, but the integrity of the repository is compromised.

GitPython versions up to 3.1.62 contain a vulnerability in the Head.checkout() method that allows an attacker to read arbitrary files on the system by controlling the branch name. This occurs because the branch name, passed as a positional argument, is not properly sanitized and can inject unsafe git checkout options such as --pathspec-from-file, leading to disclosure of sensitive files like /etc/passwd. The vulnerability arises from an incomplete fix of prior advisories that only guarded keyword arguments but missed positional argument checks in Head.checkout().

GitPython's Remote.pull() method improperly handles the positional refspec argument, allowing an attacker to inject a malicious --upload-pack option that bypasses the unsafe-option guard. This leads to arbitrary command execution with the privileges of the calling process when using local-path or SSH transports. The vulnerability affects Snakemake versions from 7.20.0 up to but not including 9.27.0_1. A fix is available in version 9.27.0_1.

CVE-2026-110857 is a vulnerability in Snakemake's use of GitPython where three Git command wrapper methods omit critical checks for unsafe protocols and options. This omission allows potential remote code execution (RCE) when using the ls_remote method with certain git transport protocols, specifically the 'ext' transport if permitted by the victim's git configuration. The merge_base and IndexFile.move methods also forward caller-controlled arguments without proper sanitization, creating latent injection surfaces. The vulnerability affects Snakemake versions from 5.5.3 up to but not including 9.27.0_1. A fix is available in version 9.27.0_1.

Snakemake's use of GitPython contains a regex vulnerability in the parse_actor_and_date function that causes quadratic backtracking on malformed author/committer/tagger identity lines missing or having malformed trailing epoch or timezone data. This results in CPU exhaustion when processing crafted commit or tag objects with long malformed identity lines. The issue affects Snakemake versions from 5.5.3 up to but not including 9.27.0_1. A fix is available in version 9.27.0_1 that modifies the regex to prevent backtracking.

GitPython's _clone() method improperly expands environment variables in the separate_git_dir parameter derived from attacker-controlled .gitmodules submodule names. This leads to leakage of environment variable values as directory names on disk and in debug logs when cloning and updating submodules from a malicious repository. The flaw affects GitPython versions from 5.5.3 up to but not including 9.27.0_1 and has been fixed in 9.27.0_1.

Two security vulnerabilities have been identified in the expat C library used for XML parsing. The first is a denial of service vulnerability caused by an integer overflow in the expat_realloc function (CVE-2026-102633). The second is an information disclosure vulnerability due to a heap buffer over-read in the XML_ParseBuffer function (CVE-2026-77214). Red Hat has issued an important security update for expat in Red Hat Enterprise Linux 8 to address these issues.