Threats affecting pkg:generic/htslib

A vulnerability in PostgreSQL vacuumdb prior to version 18.7 within major version 18 allows a database owner to execute arbitrary SQL as the database user running vacuumdb. This is due to an untrusted search path issue involving shadowing operators used in the --missing-stats-only catalog query. Versions before PostgreSQL 18 are not affected.

A vulnerability in PostgreSQL's MERGE command causes inconsistent transition-capture state, allowing an AFTER trigger to process an incorrect new row when using partitioned table MERGE operations that perform an INSERT before an UPDATE. This affects PostgreSQL major versions 15 through 18, specifically versions before 15.20, 16.16, 17.12, and 18.7. Versions prior to 15 are not affected.

A type confusion vulnerability in PostgreSQL's plperl procedural language allows an object creator to execute arbitrary code by blessing a non-hash reference into PostgreSQL::InServer::ARRAY. This affects PostgreSQL versions prior to 18.7, 17.12, 16.16, 15.20, and 14.25. The vulnerability has a high severity with a CVSS score of 8.8. It is not confirmed whether the pointer can be controlled sufficiently to achieve full security impact, but the issue is treated as potentially exploitable.

An uncontrolled recursion vulnerability exists in the Qt QXmlSimpleReader XML parsing functionality affecting the Qt 5 Core Compatibility APIs module (Qt 6) and the Qt XML module (Qt 5). This vulnerability can lead to high impact due to uncontrolled recursion during XML parsing.

A use-after-free vulnerability exists in PostgreSQL's COPY FROM error reporting, allowing a database user to potentially disclose portions of server memory. This occurs when a longer input row follows an ignored or nullified conversion error. The file_fdw feature also reaches the same vulnerable code path. Affected versions include minor releases before PostgreSQL 18.7 and 17.12 within major versions 17 and 18. Versions prior to 17 are not affected.

A missing authorization vulnerability exists in pardus-image-writer before version 0.9.0, developed by TÜBİTAK BİLGEM Yazılım Teknolojileri Araştırma Enstitüsü. This flaw allows privilege escalation, potentially enabling an attacker with limited privileges to gain higher-level access.

A vulnerability in PostgreSQL's pg_restore utility allows arbitrary code execution due to improper input validation of non-plain archive providers. This flaw affects versions prior to PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25. The issue enables an attacker to execute code as the operating system user running pg_restore by supplying a crafted archive. This is distinct from arbitrary SQL execution during restore, as it impacts the OS process itself.

A use-after-free vulnerability exists in PostgreSQL's handling of anonymous RECORD type identifiers among parallel workers. This flaw allows a database user to execute arbitrary code with the privileges of the operating system user running the database. The issue arises when one process frees a shared tuple descriptor while another process still retains and later uses its address. Versions prior to PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

A type confusion vulnerability in PostgreSQL composite-value field assignment allows an object creator to execute arbitrary code with the privileges of the operating system user running the database. This occurs by changing a composite type between deforming and reforming a value. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

A missing authorization check in PostgreSQL's DROP OWNED command allows a role to remove itself from restrictive row level security policies. This bypass enables the role to read or modify rows that the security policy was designed to restrict. Versions prior to PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

A use-after-free vulnerability exists in the PostgreSQL plperl procedural language feature that allows an object creator to execute arbitrary code as the operating system user running the database. This occurs by re-entering plperl and freeing a prepared query while an outer invocation is executing it. Versions prior to PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

A missing authorization check in PostgreSQL type conversion allows database users to invoke cast functions without having EXECUTE privilege on those functions. This can occur via mechanisms such as foreign keys and the to_json() function. Exploitation requires an attacker to identify access-restricted cast functions and assess confidentiality impact, which is reportedly rare or minimal. Versions prior to PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected. The vulnerability has a low CVSS score and no known exploits in the wild.

A buffer over-read vulnerability exists in the PostgreSQL dict_int module that allows a database user to disclose portions of server memory by using a zero-length token. This issue affects PostgreSQL versions prior to 18.7, 17.12, 16.16, 15.20, and 14.25. The vulnerability has a medium severity rating with a CVSS score of 4.3.

A path traversal vulnerability exists in the SafeTensorIndex.loadWeights function of tjake Jlama up to versions 0.8.4 and 0.9.0-beta. This flaw allows remote attackers to manipulate the weight_map argument to perform unauthorized path traversal. The vulnerability has a medium severity score and public exploit code is available. The project has been notified but has not yet issued a response or patch.

CVE-2026-71367 is an incorrect authorization vulnerability in AWX's WebSocket consumer that allows authenticated users in multi-organization deployments to subscribe to global broadcast groups without proper permission checks. This leads to unauthorized access to real-time job status metadata across organizations, including job IDs, status changes, timestamps, and infrastructure details. The vulnerability does not expose full job outputs or credentials. It mainly impacts multi-organization and managed service deployments, while single-organization setups are not practically affected.

A vulnerability in affected versions of Octopus Server allows a user with permission to edit accounts to exploit insufficient validation of custom claims on OIDC accounts. This flaw enables the issuance of signed OIDC tokens that impersonate a different project, potentially granting unauthorized access to external systems that trust the impersonated project's identity.

WonderCMS versions before 3.7.0 have a vulnerability in the saveAction functionality that allows an authenticated user to change the administrator password without needing to re-authenticate. This missing re-verification step can be exploited by attackers with existing authenticated access to bypass controls designed to prevent unauthorized password changes.

A low-severity out-of-bounds write vulnerability exists in Git when the git-merge command is used on a tag containing more than two GPG signatures. This flaw could potentially cause a denial of service or application instability but does not impact confidentiality or integrity.

The Gaia OS DynamicCLI daemon runs with root privileges and listens on a world-writable local socket (/tmp/dynamic_socket) without authenticating connecting processes. This allows any authenticated local user to send commands to the socket and have them executed as root, leading to full system compromise.

CVE-2026-120490 is a vulnerability affecting Scalable Platforms where an administrator with permissions to edit and install Access Control Policy and NAT rules can create a NAT rule that redirects traffic to the Gateway's Sync interface. This bypasses the built-in Sync protection and could allow the administrator to execute operating system commands and write files on the Gateway with superuser privileges. The vulnerability has a low CVSS score of 3.8 and does not have known exploits in the wild. No patch or remediation information is provided.