Threats affecting pkg:generic/osquery

A memory corruption vulnerability exists in the DOM component of Google Chrome versions prior to 156.0.8078.79. This flaw could allow a remote attacker to execute arbitrary code inside the browser's sandbox by crafting a malicious HTML page. The issue is classified with high severity by Chromium security.

A use-after-free vulnerability exists in the FileSystem component of Google Chrome versions prior to 156.0.8078.79. This flaw allows a remote attacker to execute arbitrary code within the sandbox by crafting a malicious HTML page. The vulnerability is classified with high severity by Chromium security.

A vulnerability in the V8 JavaScript engine used by Google Chrome prior to version 156.0.8078.79 allows a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. The issue is due to improper input validation.

A use-after-free vulnerability exists in the Blink component of Google Chrome versions prior to 156.0.8078.79. This flaw allows a remote attacker to execute arbitrary code within the sandbox by crafting a malicious HTML page. The vulnerability is classified with high severity by Chromium security.

A use-after-free vulnerability exists in the Quota component of Google Chrome versions prior to 156.0.8078.79. This flaw could allow a remote attacker to execute arbitrary code within the browser's sandbox by crafting a malicious HTML page. The vulnerability is classified with high severity by Chromium security.

A memory corruption vulnerability exists in the Dawn component of Google Chrome versions prior to 156.0.8078.79. This flaw could allow a remote attacker to execute arbitrary code within the browser's sandbox by delivering a crafted HTML page. The vulnerability is classified with high severity by Chromium security.

A memory corruption vulnerability exists in the Autofill component of Google Chrome versions prior to 156.0.8078.79. This flaw allows a remote attacker to execute arbitrary code within the browser's sandbox by crafting a malicious HTML page. The vulnerability is classified with high severity by Chromium security.

An integer overflow vulnerability in the editing component of Google Chrome versions prior to 156.0.8078.79 could allow a remote attacker to execute arbitrary code within the browser's sandbox by delivering a crafted HTML page. The issue is classified with high security severity by Chromium.

A vulnerability in Xcode related to improper handling of symbolic links could allow an app to read arbitrary files. This issue is fixed in Xcode version 27.2 by improving symlink handling.

A heap-based buffer overflow vulnerability exists in Ghostscript when processing specially crafted TrueType fonts or documents embedding them. This flaw arises from an accounting error during font rendering that bypasses buffer size checks. Exploitation requires local access with high privileges and user interaction, potentially leading to denial of service or arbitrary code execution.

An authorization issue in Xcode was addressed by improving state management. The vulnerability could allow an app to access sensitive user data. This issue is fixed in Xcode version 27.2.

An improper input validation vulnerability exists in the Skia component of Google Chrome versions prior to 156.0.8078.79. This flaw could allow a remote attacker to execute arbitrary code outside the browser sandbox by delivering a crafted HTML page. The vulnerability is rated with high severity by Chromium security.

A vulnerability in Keycloak's required action provider mechanism allows bypassing mandatory user actions such as profile verification or terms acceptance. When an authorization request includes the kc_action query parameter set to an already assigned mandatory action, Keycloak may incorrectly skip these challenges and issue an authorization code. This flaw requires valid user credentials and affects only specific mandatory actions.

A vulnerability in the UMA resource registration endpoint of the keycloak-services component allows an authenticated user with specific permissions to update resources they do not own when remote resource management is enabled. This flaw is due to a missing ownership check when an existing resource ID is provided, enabling unauthorized modification of resource configurations such as names, URIs, and scopes.

A use-after-free vulnerability exists in the Frames component of Google Chrome versions prior to 156.0.8078.79. This flaw allows a remote attacker to execute arbitrary code within the sandbox by delivering a crafted HTML page. The vulnerability is classified with high severity by Chromium security.

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Block AJAX allows Object Injection. This issue affects Block AJAX versions: from 0.0.0 to 3.0.2.

Vulnerability in Drupal ECA Helper. This issue affects ECA Helper versions: *.*.

Incorrect Authorization vulnerability in Drupal Entity Reference Manager (Merge entities) allows Forceful Browsing. This issue affects Entity Reference Manager (Merge entities) versions: from 0.0.0 to 1.0.3.

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal MathJax: LaTeX for Drupal allows Cross-Site Scripting (XSS). This issue affects MathJax: LaTeX for Drupal versions: from 0.0.0 to 4.1.2.