Threats affecting pkg:generic/libhevc

A critical remote code execution vulnerability exists in WAVLINK WL-WN579A3-A 2026-03-10-94f93d4. The flaw is in the set_wzdgwMesh function of /cgi-bin/adm.cgi within the Initial Setup Wizard component, where improper handling of the wlan_ssid argument allows OS command injection. Public exploit code is available, and the vulnerability has a maximum CVSS score of 10. No patch or remediation information is currently provided.

CVE-2026-120218 is a cross-site scripting (XSS) vulnerability in Typemill up to version 2.26.0. The flaw exists in the ControllerApiImage::saveImage function within SvgSanitizer.php. This vulnerability can be exploited remotely and allows attackers to execute malicious scripts. An exploit has been published publicly. Upgrading to Typemill version 2.27.0 resolves the issue.

CVE-2026-120217 is a medium-severity vulnerability in Delgan loguru version 0.7.3. It involves inefficient regular expression complexity in the AnsiParser.feed function of the ANSI Color-Markup Parser component. This flaw can be exploited remotely and public exploit code is available. The vendor has not responded to the disclosure and no patch information is provided.

The MapPress WordPress plugin before 2.97.15 does not restrict which user's data its front-end map embed handler renders, allowing unauthenticated visitors to retrieve the email address and display name of any user on the site by enumerating user IDs.

The Media Library Assistant WordPress plugin before 3.44 does not escape one of its shortcode attributes before outputting it in an attribute of generated links, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.

The Media Library Assistant WordPress plugin before 3.44 does not check that the requesting user is allowed to view a post before disclosing which taxonomy terms are assigned to it, allowing any authenticated user, such as a subscriber, to learn the term assignments of private attachments and posts.

The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capability check on its test-email handler, relying only on a nonce that is available to any logged-in user, so a low-privileged user such as a Subscriber can make the site send email to an arbitrary recipient with a spoofed sender address.

The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capability check when its test-email handler resolves and returns a user's email address, relying only on a nonce that is available to any logged-in user, allowing authenticated users with minimal privileges (Subscriber and above) to disclose the email address of any registered user, including administrators.

CVE-2026-120198 is a critical command injection vulnerability in the WAVLINK WL-WN530BE1-A device, specifically in the con_check_read_finish function of the /protocol.csp file. The vulnerability arises from improper handling of the argument group_name/IP-FROM, allowing remote attackers to execute arbitrary commands. The exploit has been publicly disclosed and may be used. No specific affected versions or patches are provided in the available data.

CVE-2026-120197 is a critical OS command injection vulnerability in the WAVLINK WL-WN530HG4B router, specifically in the port_forward function of /cgi-bin/wapi.cgi. The flaw allows remote attackers to manipulate the 'Name' argument to execute arbitrary OS commands. Exploit code has been published, increasing the risk of exploitation. No affected versions or patches are specified in the available data.

A security vulnerability in Presenton up to version 0.9.11-beta allows remote attackers to cause information disclosure by manipulating an unspecified part of the /app_data file in the Desktop Authentication Middleware component. The vulnerability has a medium severity with a CVSS score of 5.3. Public exploit code has been disclosed. Upgrading to version 0.9.12-beta mitigates the issue.

OpenAlgo versions from 1.0.0.29 up to but not including 2.0.3.1 contain an improper certificate validation vulnerability in the email utility modules. This flaw disables TLS hostname and certificate checks for STARTTLS and SMTPS connections, allowing network attackers to present forged certificates. Successful exploitation can lead to interception of SMTP credentials and subsequent email traffic, including sensitive information such as password-reset links.

An infinite loop vulnerability exists in imagecodecs versions 2026.3.6 through 2026.10.10 within the ccitt_fax4_decode_size() function. This flaw allows attackers to cause a denial-of-service by supplying a crafted CCITT Group 4 stream that lacks an End Of Facsimile Block (EOFB), leading to full CPU consumption until the affected process is terminated.

Thelia Back-office Default Twig Template versions before 1.1.1 have a cross-site request forgery (CSRF) vulnerability affecting specific admin routes that accept GET requests without anti-CSRF token validation. This flaw allows an attacker to trick a logged-in administrator into executing unauthorized actions that modify product combination details such as prices, stock, weight, EAN, and sale flags, potentially zeroing omitted prices.

A stack-based buffer overflow vulnerability exists in imagecodecs versions 2023.1.23 through 2026.10.10 in the lossless JPEG Define Huffman Table parser. This flaw occurs when a crafted lossless JPEG file causes the DHT symbol counts to wrap an 8-bit sum, overflowing internal stack arrays and crashing the process.

Thelia versions before 3.1.1 have a stored cross-site scripting (XSS) vulnerability that allows authenticated back-office administrators with store update permissions to inject malicious scripts by uploading unsanitized SVG images as logo or banner files. This vulnerability enables attackers to execute scripts in the context of visitors and higher-privileged administrators via payloads served from specific directories.

FFmpeg versions 2.3 through 9.0.2 have a use of uninitialized resource vulnerability in the Huffyuv decoder. This flaw allows attackers to leak heap memory into decoded pixels by crafting specially malformed Huffyuv BGR24/BGRA video bitstreams with early-ending entropy data. The vulnerability results in uninitialized memory bytes being included in output frames, exposing potentially sensitive heap contents.

A weakness in Presenton up to version 0.9.11-beta allows remote attackers to bypass authentication due to an issue in the API component. This vulnerability can be exploited without user interaction and has a high severity rating. Public exploit code is available. Upgrading to version 0.9.12-beta resolves the issue.

FFmpeg versions 2.0 through 9.0.2 have a vulnerability in the Go2Meeting decoder where an uninitialized variable is used. This flaw allows attackers to leak stack memory by crafting a malicious G2M3/G2M4 stream with a short Kempf palette, causing uninitialized stack bytes to be copied into the decoded output.

A cross-site scripting (XSS) vulnerability exists in PostyBirb Plus versions up to 3.1.75 in the Submission Description Editor component. This flaw allows remote attackers to inject malicious scripts via the DescriptionInput.tsx file. The vulnerability is addressed in version 3.1.76, which users are advised to upgrade to.