Threats affecting pkg:generic/poppler

CVE-2026-101176 is a permission control vulnerability in the event notification management module of Huawei HarmonyOS. Exploiting this flaw may impact service confidentiality and cause high integrity and availability issues. The vulnerability affects multiple specific versions of HarmonyOS. The CVSS score is 7.1, indicating a high severity level.

CVE-2026-101186 is a denial-of-service (DoS) vulnerability in the window module of Huawei HarmonyOS version 6.1.0. Exploiting this flaw can disrupt system availability but does not impact confidentiality or integrity.

CVE-2026-101185 is a buffer access vulnerability in Huawei HarmonyOS version 6.1.0, specifically an out-of-bounds read in the peripheral module. Exploiting this flaw could lead to unauthorized disclosure of information, impacting service confidentiality. The vulnerability has a medium severity rating with a CVSS score of 5.9. No public exploits or patches are currently documented.

CVE-2026-101183 is a use-after-free (UAF) vulnerability in the location service module of Huawei HarmonyOS versions 6.1.0 and 7.0.0. Exploitation of this flaw may impact system availability. The vulnerability has a medium severity rating with a CVSS score of 5.9. No public exploits or patches are currently documented.

CVE-2026-101182 is a race condition vulnerability in the location service module of Huawei HarmonyOS version 6.1.0. Exploitation may impact system availability, causing potential denial of service. The vulnerability has a medium severity rating with a CVSS score of 5.9. No public exploits or patches are currently documented.

CVE-2026-101181 is a permission control vulnerability in the WLAN module of Huawei HarmonyOS versions 6.1.0 and 7.0.0. Exploiting this flaw may lead to unauthorized exposure of sensitive information, impacting service confidentiality. The vulnerability has a medium severity rating with a CVSS score of 5.5. No public exploits or patches are currently documented.

CVE-2026-101180 is a denial-of-service (DoS) vulnerability in Huawei HarmonyOS affecting the file parsing module. The flaw is due to uncontrolled recursion, which can lead to resource exhaustion and impact system availability. The vulnerability affects specific versions 6.1.0 and 7.0.0 of HarmonyOS. The CVSS score is 4.3, indicating a medium severity level. There is no evidence of exploitation in the wild, and no patch or remediation information is currently provided.

CVE-2026-101179 is a buffer overflow vulnerability in the file preview module of Huawei HarmonyOS versions 6.1.0 and 7.0.0. Exploitation may impact system availability but does not affect confidentiality or integrity. The vulnerability has a medium severity rating with a CVSS score of 4.7.

A high-severity security vulnerability (CVE-2026-120341) has been identified in the mathurvishal CloudClassroom-PHP-Project, specifically involving an unknown function in the studentdetails.php file. The vulnerability allows remote attackers to manipulate execution flow after a redirect, potentially leading to unauthorized code execution. The vulnerability has been publicly disclosed, and exploit code may be available. The vendor has not responded to disclosure attempts, and no version-specific affected or fixed releases have been provided due to the product's rolling release model.

A SQL injection vulnerability exists in dayrui XunRuiCMS up to version 4.7.4 in the Member Module's View function. This flaw allows remote attackers to manipulate the 'catid' argument to execute unauthorized SQL commands. The vulnerability has a high severity score of 7.3 and public exploit code is available. Users should upgrade the affected component to a patched version identified by commit 9b6ea0cf9c6e8cdc9a5260c38b95da5fed4c4231.

A code injection vulnerability exists in dayrui XunRuiCMS up to version 4.7.4 in the _get_tpl_content function of the Email Template Rendering component. This vulnerability can be exploited remotely without authentication. Public exploit code is available, and the vendor has not responded to disclosure attempts.

A vulnerability in the System REST APIs allows users with lower privilege roles to bypass access control and perform unauthorized administrative actions. This flaw does not affect APIs exposed through the WSO2 API Manager's API Gateway. Exploitation could lead to unauthorized administrative operations, impacting confidentiality, integrity, and availability of the affected system.

A cross-site scripting (XSS) vulnerability exists in the mathurvishal CloudClassroom-PHP-Project within an unknown function in the file manageassessment2.php. The flaw involves manipulation of the arguments ExamName, Q1, Q2, Q3, Q4, and Q5, allowing remote attackers to execute script code. The vendor has not responded to disclosure requests, and no specific affected versions or patches are provided due to the product's rolling release model. Exploit code has been published publicly.

A critical remote command injection vulnerability exists in WAVLINK WN551X3-A firmware M51X3_V251020-WO-182e965, specifically in the DNS Resolution Handler component. The flaw allows an attacker to manipulate input to the sub_41a430 function in /bin/ioos, leading to OS command injection without requiring authentication. Exploit code has been publicly disclosed, increasing the risk of exploitation.

CVE-2024-5617 is a vulnerability in an account lock feature that fails to enforce lockouts correctly on the primary user store when identical usernames exist in both primary and secondary user stores. The lockout condition only applies to the secondary user store account, allowing repeated authentication attempts on the primary account. This flaw enables brute force attacks against the primary user store account, potentially leading to unauthorized access to sensitive information or accounts.

A weakness in the Global Session Handler component of mathurvishal CloudClassroom-PHP-Project allows remote attackers to cause session expiration through manipulation. The attack requires high complexity and is difficult to exploit. No specific affected versions or patches are available due to the product's rolling release model. The vendor did not respond to disclosure attempts. The CVSS score is low (3.7) with limited impact to confidentiality only.

VStarcam O-KAM SuperIPCam version 1.3.3.32 contains a use-after-free vulnerability in the P2P Session Teardown component. This flaw affects the function FUN_005a2d44 in the SuperIPCam.exe file and can be exploited remotely without authentication. The vulnerability has a CVSS score of 7.3, indicating high severity. Public exploit code is available, but the vendor has not responded or issued a patch.

A SQL injection vulnerability exists in the mathurvishal CloudClassroom-PHP-Project in an unknown function within the file viewquery.php. The vulnerability is triggered by manipulation of the 'eid' argument and can be exploited remotely. Public exploit code is available. The product uses a rolling release model, so specific affected or fixed versions are not provided. The vendor has not responded to disclosure attempts.

A critical vulnerability (CVE-2026-120344) exists in WAVLINK WN551X3-A firmware version M51X3_V251020-WO-182e965. The flaw is an OS command injection in the WireGuard CLI Group Handler component, specifically in the /bin/ioos file's system function when processing the group_name argument. This vulnerability can be exploited remotely without authentication. Public exploit code has been disclosed. No patch or remediation information is currently available.

VStarcam O-KAM Client version 1.3.3.32 contains a stack-based buffer overflow vulnerability in the function FUN_10003EA0 within the DevDll_925.dll library. This vulnerability can be exploited remotely without authentication and has a high severity rating. Public exploit code is available. The vendor has not responded to disclosure attempts and no patch information is provided.