Threats affecting pkg:generic/opencv

A denial of service vulnerability exists in the Hivex component of Microsoft software due to an out-of-bounds read during big-data block processing. This flaw can cause the affected software to crash or become unresponsive when processing specially crafted data. The issue is identified as CWE-125 (out-of-bounds read) and affects version 3.0 of the product. No CVSS score or detailed impact metrics are provided. No known exploits are reported in the wild, and no patch information is available at this time.

A heap overflow vulnerability exists in the git-credential-wincred OAuth Store component of Git for Windows version 3.0. This vulnerability is identified as CWE-787 and has been published with no CVSS score or known exploits in the wild as of the publication date.

A heap overflow vulnerability exists in the git-credential-wincred Erase Path component of Git for Windows version 3.0. This flaw is identified as CWE-787 (Out-of-bounds Write). No CVSS score or detailed impact information is provided, and no known exploits are reported in the wild.

A vulnerability in FRRouting's ospf6d component causes it to fail to enforce that all OSPFv3 packets use IPv6 link-local addresses. This could lead to protocol enforcement issues in OSPFv3 implementations.

A vulnerability identified as CVE-2026-121520 involves a malicious client being able to set an extended attribute (xattr) value outside of the BuildKit state directory in Microsoft software version 3.0. The description and details are minimal, with no CVSS score or detailed impact information provided.

CVE-2026-112910 concerns a vulnerability in Microsoft software version 3.0 where the WindowsFileLock component ignores the specified mode (0o600) for lock files, causing the ReadWriteLock database to inherit the directory's access control list (ACL) instead. This behavior can lead to improper file permissions.

A stack buffer overflow vulnerability exists in ntopng version 3.0 within the nDPI custom category detection component. This flaw could allow remote code execution if exploited with crafted input.

CVE-2026-82413 is an authenticated OS command injection vulnerability in ntopng version 3.0. It involves the vulnerability-scan feature's scan_ports parameter, which improperly handles input, allowing non-admin authenticated users to execute arbitrary operating system commands.

A critical security vulnerability (CVE-2025-55754) affects the wso2mi package due to improper neutralization of escape, meta, or control sequences in Apache Tomcat. This flaw can lead to significant impact on confidentiality, integrity, and availability. Versions prior to 4.3.0-r0, 4.4.0-r0, and 4.5.0-r0 are affected. A patch is available in these fixed versions.

A security vulnerability identified as CVE-2025-5878 affects the wso2mi package due to an issue in the ESAPI esapi-java-legacy component. The vulnerability has a high severity score of 7.3 and impacts confidentiality, integrity, and availability. Fixed versions are available starting from 4.3.0-r0, 4.4.0-r0, and 4.5.0-r0.

A security vulnerability identified as CVE-2026-116540 affects the wso2mi package due to an issue in netty-tcnative 2. The vulnerability has a CVSS 3.1 base score of 5.9, indicating medium severity. It impacts availability but does not affect confidentiality or integrity. Fixed versions are available starting from 4.3.0-r0, 4.4.0-r0, and 4.5.0-r0.

CVE-2026-71497 is a medium severity security vulnerability affecting the wso2mi package, which uses the jsoup Java library for processing HTML. The vulnerability impacts versions prior to 4.3.0-r0, 4.4.0-r0, and 4.5.0-r0. It has a CVSS score of 4.7 with network attack vector, high attack complexity, no privileges required, and requires user interaction. The vulnerability results in limited confidentiality and integrity impact but no availability impact. Fixed versions are available.

A high-severity security vulnerability (CVE-2026-75140) affects the wso2mi package due to an issue involving jsoup. The vulnerability impacts availability without affecting confidentiality or integrity. Fixed versions 4.3.0-r0, 4.4.0-r0, and 4.5.0-r0 are available.

A critical security vulnerability (CVE-2025-59340) affects the wso2mi package due to an issue in jinjava, a Java-based template engine adapted from Django template syntax to render Jinja templates. The vulnerability has a CVSS score of 10.0, indicating it is exploitable remotely without authentication and can lead to complete confidentiality, integrity, and availability compromise. Fixed versions 4.3.0-r0, 4.4.0-r0, and 4.5.0-r0 are available.

A security vulnerability exists in the Trino package due to differences in the Jetty URI parser's handling of invalid or unusual URIs compared to other common parsers. This flaw affects versions prior to 484-r0 and may lead to limited confidentiality and integrity impacts. The vulnerability has a medium severity rating and a CVSS score of 6.5.

A security vulnerability in the Trino package affects Eclipse Jetty's handling of HTTP/1, HTTP/2, and HTTP/3 requests. The flaw is due to the lack of strict verification that the request authority (host and port) matches the Host header if present. This vulnerability has a medium severity rating with a CVSS score of 5.3. A fix is available in version 484-r0.

CVE-2024-6763 is a medium severity vulnerability affecting the Trino package, specifically related to the Eclipse Jetty web server component. The flaw does not impact confidentiality or availability but allows for integrity compromise without requiring privileges or user interaction. A fix is available in version 484-r0.

A critical security vulnerability exists in the Trino package due to the Eclipse Jetty Digest authentication server-side component using ISO-8859-1 encoding for passwords. This flaw affects versions of Trino prior to 484-r0 and can lead to high confidentiality and availability impacts. A fix is available in version 484-r0.

A high-severity security vulnerability exists in the Trino package due to an issue in Eclipse Jetty's JASPIAuthenticator class, which sets two ThreadLocal variables during authentication checks. This flaw affects versions of Trino prior to 484-r0 and could lead to high-impact confidentiality and integrity breaches. A fix is available in version 484-r0.

Multiple injection vulnerabilities exist in resource metadata fields of GBIF Integrated Publishing Toolkit versions before 3.3.5. These flaws allow authenticated remote attackers to execute code in another user's session via stored cross-site scripting after user interaction. The vulnerabilities have a medium severity rating and a CVSS score of 4.8. No patch or fixed version information is provided in the available data.