Threats affecting pkg:npm/@urql/next

CVE-2026-116839 is a Cross-Site Request Forgery (CSRF) vulnerability in Ubiquiti Inc's airMAX M devices. An attacker can trick an authenticated user into visiting a malicious page, causing unauthorized changes and potentially triggering a Denial of Service (DoS) on the device. The vulnerability affects versions prior to 6.3.26. A fix is available in version 6.3.26.

CVE-2026-116838 is a Cross-Site Request Forgery (CSRF) vulnerability in Ubiquiti Inc's airMAX M devices. An attacker can trick an authenticated user into visiting a malicious page, which could then execute a command injection on the device. This vulnerability affects versions prior to 6.3.26 and has been assigned a high severity score of 8.8. A fix is available in version 6.3.26.

CVE-2026-116623 is a vulnerability in code-projects Simple Content Management System version 1.0. It involves missing authorization in the admin interface component, specifically in the /web/admin/welcome.php file. The flaw arises from manipulation of the 'addnews' argument, allowing remote attackers to exploit the system without proper authorization. Public exploit code is available. The vulnerability has a medium severity rating with a CVSS score of 6.9.

CVE-2026-116837 is a heap-based buffer overflow vulnerability affecting Ubiquiti Inc's airMAX M, LTU, SolarPoint, and SolarSwitch devices. An attacker with access to the adjacent network can exploit this flaw to execute arbitrary code on the affected devices. The vulnerability has a high severity with a CVSS score of 8.8. Fixed versions are available for all affected products.

Fclairamb ftpserverlib through 0.32.4 contains a cleartext transmission vulnerability because TransferOpen checks only the transferTLS flag set by PROT, not whether the prepared data connection uses TLS. When a client sends PROT P after PASV or PORT, file contents and directory listings cross the network unencrypted, even with mandatory encryption, letting on-path attackers read or modify them.

Mistral Vibe versions before 3.0.3 have a remote code execution vulnerability. This flaw allows attackers to execute arbitrary commands by defining git filter drivers in an untrusted repository's .git/config file. When the application is started with the --worktree option, git worktree add applies .gitattributes and runs filter commands before verifying the trusted folder, leading to execution of attacker-controlled commands with user privileges. The vulnerability is fixed in version 3.0.3.

DevilutionX versions 1.4.0 through 1.5.5 contain a heap buffer overflow vulnerability in the bundled libmpq library. The flaw occurs in the libmpq__archive_dup routine when opening specially crafted MPQ archives with a block table count exceeding the hash table count. This causes a heap overflow via memcpy during game startup, leading to a crash.

DevilutionX versions 1.4.0 through 1.5.5 contain an out-of-bounds read vulnerability in the bundled libmpq library. This flaw occurs in the libmpq__file_number_from_hash function due to unchecked block_table_index values, allowing attackers to read heap memory. Exploitation requires placing a crafted .mpq archive, such as a mod, in the game's data path, which can trigger reads beyond the intended memory bounds and cause the game to crash.

llama.cpp b5854 before b11275 contains an integer overflow vulnerability in gguf_init_from_reader that bypasses the CVE-2025-53630 size check when padding near-SIZE_MAX tensor sizes. Attackers can supply a crafted GGUF file whose tensor size pads to zero, causing an undersized data blob and out-of-bounds reads by consumers.

An integer overflow vulnerability exists in llama.cpp versions from 0.1.0 up to but not including 0.6.0. The flaw occurs in the gguf_init_from_reader function, where attackers can supply tensor shapes whose product wraps to zero, bypassing tensor element-count validation. This allows crafting GGUF files with extremely large tensor extents that overflow internal byte count calculations, leading to out-of-bounds memory access.

A heap out-of-bounds write vulnerability exists in llama.cpp before commit b10261 in the function llm_tokenizer_plamo2::build. This flaw allows attackers to corrupt heap memory by supplying crafted GGUF models with BYTE-typed token text containing negative parsed values. The vulnerability can cause crashes or potentially enable code execution during model loading.

CVE-2025-71439 is a heap out-of-bounds read vulnerability in llama.cpp before commit b5649. The flaw exists in the function llama_vocab::impl::print_info(), where supplying a crafted GGUF model with an undersized tokenizer.ggml.tokens array and oversized special token IDs can cause the software to read beyond allocated memory and crash during model loading. This affects llama-cli and llama-server components.

llama.cpp before b3701 contains an out-of-bounds read vulnerability in llama_decode_internal and llama_encode_internal that allows remote unauthenticated attackers to read memory by supplying unvalidated token IDs. Attackers can send integer-array prompts to the llama-server /completion endpoint with IDs outside 0 to n_vocab to read embedding memory out of bounds or crash the process.

An out-of-bounds read vulnerability exists in llama.cpp versions from b1046 up to but not including b2731. The flaw occurs in the llama_model_loader component when processing crafted GGUF model files with arbitrary 64-bit tensor offsets. This can cause the process to crash or read adjacent memory as model weights.

YesWiki versions prior to 4.7.0 have a stored cross-site scripting (XSS) vulnerability in the handlers/page/referrers_sites.php component. This flaw allows unauthenticated attackers to inject malicious scripts via specially crafted Referer headers. When a victim visits the referrer-sites page, the injected JavaScript executes in their browser context, enabling same-origin authenticated actions.

YesWiki versions from 4.6.2 up to but not including 4.7.0 have a vulnerability in the HttpSignatureService::verifySignature() method where replay protection is missing. Specifically, the method does not validate the Date header nor track previously seen signatures. This allows an attacker who captures a signed request to the /api/forms/{formId}/actor/inbox endpoint to replay that request later, potentially re-executing sensitive actions such as Delete, Update, Follow, or Undo.

YesWiki versions prior to 4.7.0 have a SQL injection vulnerability in the despam.php script. The flaw arises because the 'from' POST parameter is escaped but used in an unquoted INTERVAL context, allowing authenticated administrators to perform blind SQL injection. This can lead to unauthorized reading of database contents, including user password hashes.

YesWiki versions prior to 4.7.0 have a vulnerability in the AclService::updateRequestWithACL function where usernames are interpolated into SQL LIKE patterns without escaping wildcard characters. This allows self-registered attackers to bypass read access controls by using specially crafted usernames containing wildcards, enabling unauthorized reading of restricted pages and Bazar entries via the public Bazar listing API.

YesWiki versions prior to 4.7.0 have a server-side request forgery (SSRF) vulnerability in the Bazar CSV import function copyUrlToLocalFile(). Authenticated administrators can exploit this by supplying crafted URLs in CSV or image fields, allowing arbitrary outbound requests. The vulnerability enables bypassing extension checks via query-string suffixes or redirects, potentially exposing cloud metadata credentials, internal services, or local files. Responses are stored in a web-accessible directory, increasing exposure risk.

YesWiki versions from 4.6.0 up to but not including 4.7.0 contain an information disclosure vulnerability. This flaw allows unauthenticated attackers to view assembled SQL queries by appending the 'showreq' parameter to public Bazar listing API requests. The disclosed information includes database table names, JSON storage paths, ACL filter logic, and collation details, which could facilitate targeted SQL injection attacks.