Threats affecting pkg:generic/libucl

The Redux Framework plugin for WordPress versions up to and including 4.5.15 contains a stored cross-site scripting (XSS) vulnerability via the multi_media field. This occurs because the field's renderer outputs stored values into multiple HTML contexts without proper escaping. Additionally, a flaw in permission checking allows authenticated users with Subscriber-level access to inject scripts into their own profile, which execute when an administrator views that profile. Exploitation requires a theme or plugin that registers a multi_media field through the Redux Users API.

Blender versions before 4.5.15 and 5.x before 5.2.3 contain an out-of-bounds read vulnerability in the blo_bhead_id_* accessors within readfile.cc. This flaw allows crafted .blend files with short ID blocks to cause heap over-reads, potentially leading to application crashes or disclosure of heap memory.

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress versions up to and including 2.8.19 contains a vulnerability that allows unauthenticated attackers to execute arbitrary shortcodes. This occurs because the plugin does not properly validate input before calling do_shortcode, enabling arbitrary shortcode execution. Exploitation requires an administrator to have configured an ad block with dynamic tags such as {title}, {tag}, {category}, or {smart-tag} displayed on search pages, which is a normal plugin configuration.

A missing authorization vulnerability exists in Liquid Web / StellarWP Event Tickets plugin up to version 5.30.2. This flaw allows exploitation of incorrectly configured access control security levels, potentially enabling unauthorized access to certain functions or data. The vulnerability has a medium severity rating with a CVSS score of 4.3.

The Database Cleaner plugin for WordPress versions up to and including 1.4.7 has a vulnerability that allows authenticated users with Administrator-level access or higher to delete arbitrary database tables. This occurs because the plugin does not restrict which database tables can be deleted, potentially enabling deletion of core WordPress tables.

A Cross Site Scripting (XSS) vulnerability exists in BeeHome MyBeeHome versions before 2025-11-01. This flaw allows a remote attacker to execute arbitrary code through the Profile editing functionality and the chat messaging component.

A Cross-Site Request Forgery (CSRF) vulnerability exists in Meow Apps AI Engine ai-engine up to version 3.8.8. This vulnerability allows an attacker to perform unauthorized actions on behalf of an authenticated user. The vulnerability is rated high severity with a CVSS score of 8.8.

A vulnerability in DBHub prior to version 0.22.6 allows bypassing read-only SQL validation on the MySQL and MariaDB connectors. This occurs due to incorrect parsing of double-dash comments in SQL statements, enabling an attacker to hide write or destructive commands from validation. The issue does not affect PostgreSQL. The vulnerability is fixed in version 0.22.6.

A Cross-Site Request Forgery (CSRF) vulnerability exists in WPExperts APIExperts Square for WooCommerce (woosquare) versions up to 4.7.5. This vulnerability allows an attacker to perform unauthorized actions on behalf of an authenticated user by exploiting the lack of proper request validation.

OpenStack keystonemiddleware versions before 13.0.2 contain a vulnerability where supplying a custom X-Service-Token header allows an attacker with access to a restricted application credential to bypass access restrictions and elevate privileges.

A missing authorization vulnerability exists in Liquid Web / StellarWP The Events Calendar plugin (the-events-calendar) affecting versions up to 6.18.2. This flaw allows exploitation of incorrectly configured access control security levels, potentially leading to unauthorized information disclosure or modification. The vulnerability has a medium severity rating with a CVSS score of 5.4.

A stored cross-site scripting (XSS) vulnerability exists in the Media Player Addons for Elementor plugin for WordPress, specifically in the Media Player widget. This vulnerability affects versions up to and including 1.1.10. It allows improper neutralization of input during web page generation, which could lead to execution of malicious scripts in the context of the affected site.

NocoDB versions prior to 2026.08.0 have a clickjacking vulnerability due to missing X-Frame-Options and CSP frame-ancestors headers. This allows attackers to embed the authenticated interface in a malicious page and trick signed-in users into performing unintended actions such as modifying or deleting records, changing sharing settings, or inviting collaborators.

PipesHub versions prior to 0.10.0 have a vulnerability in the getClientIp() function that allows unauthenticated attackers to bypass rate limiting by spoofing the X-Forwarded-For or X-Real-IP headers. This enables attackers to evade per-IP throttling on authentication endpoints, facilitating password spraying and flooding of OTP or password-reset emails.

A heap out-of-bounds access vulnerability exists in Blender versions before 4.5.15 and 5.x before 5.2.3 in the read_struct() function. This flaw occurs because size validation is skipped when a .blend file's SDNA struct layout compares equal, allowing crafted .blend files with short blocks to cause heap memory overruns. Such overruns can lead to application crashes or potentially arbitrary code execution.

A heap out-of-bounds read vulnerability exists in Blender versions before 4.5.15 and 5.x before 5.2.3 in the read_file_dna() function. This flaw occurs because the function reads a GLOB block field without validating its declared length. An attacker can craft a malicious .blend file with a truncated GLOB block that triggers the out-of-bounds read, causing Blender to crash.

pybars4 versions up to 0.9.13 have a code injection vulnerability in the pybars/_compiler.py file. This flaw allows attackers to execute arbitrary Python code by injecting unescaped bracketed path segments in Handlebars templates. Specifically, crafted template segments in helper or block arguments can break out of the generated resolve() string literal, leading to code execution within the application process.

An improper certificate validation vulnerability exists in the HTTPS listener of Canonical LXD versions 4.0.14, 5.0.10, 5.21.8, and 6.9. This flaw allows an unauthenticated attacker to impersonate any trusted client by using a crafted certificate chain, thereby gaining full access to the cluster and managed virtual machines. The issue is fixed in versions 4.0.15, 5.0.11, 5.21.9, and 6.10.1.

A vulnerability in Keyfactor EJBCA 9 allows a removed administrator to retain access longer than intended due to cached authentication sessions. Specifically, when an administrator is removed from their role while having an active TLS session, the system may cache their authentication beyond the configured maximum time (default 30 seconds), potentially allowing unauthorized continued access.

Blender versions before 4.5.15 and 5.x before 5.2.3 contain a heap buffer overflow vulnerability caused by an integer overflow in the ptcache_data_alloc() function when reading point cache files. An attacker can supply a crafted point cache file with a large totpoint value alongside a .blend file to cause a crash or execute arbitrary code with the user's privileges.