Threats affecting pkg:generic/libraw

Memory corruption in HTML in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

A memory corruption vulnerability in the Turbolev component of Google Chrome prior to version 156.0.8078.73 allows a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. This issue has been fixed in Chrome version 156.0.8078.73.

Use after free in Animation in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

An improper access control vulnerability in the V8 engine of Google Chrome prior to version 156.0.8078.73 allows a remote attacker to read memory via a crafted HTML page. This vulnerability has been fixed in version 156.0.8078.73.

Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in Layout in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

Improper input validation in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

Improper input validation in FileAPI in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

A critical memory corruption vulnerability exists in the FileSystem component of Google Chrome prior to version 156.0.8078.73. This flaw could allow a remote attacker to execute arbitrary code outside the browser sandbox by convincing a user to visit a specially crafted HTML page. The issue is fixed in Chrome version 156.0.8078.73.

WebSub is a W3C recommendation produced by the Social Web Working Group. In recommendation REC-websub-20180123, the intent-verification protocol requires a subscriber to echo the `hub.challenge` value, also exposed as `hub_challenge` by some frameworks, but does not require safe response media typing or disabled MIME sniffing. An attacker can initiate a subscription to obtain a callback URL and redirect a victim browser to a crafted verification request containing HTML or JavaScript. Subscribers that return the challenge as `text/html` can execute the reflected content in the subscriber origin, using a victim's existing session to read private data or perform actions, exposing `localStorage` or `sessionStorage` and browser permissions granted to that origin. An alternative uses the verification response as an attacker-controlled same-origin script resource to bypass `script-src 'self'`; this can remain possible with `application/octet-stream` when MIME sniffing is allowed. Safe media typing and `X-Content-Type-Options: nosniff` are both needed to address the described scenarios. WebSub Rocks demonstrated reflection, but the advisory does not establish practical impact on that demonstration site.

CVE-2026-59158 is a vulnerability in nuxt-ollama versions prior to 1.3.1 where an API key configured for cloud access is exposed in the client-side HTML payload. This exposure occurs because the module options, including the cloud api_key, are merged into a public runtime configuration that Nuxt serializes into the server-rendered HTML. As a result, unauthenticated clients can retrieve the API key in plaintext, enabling unauthorized use of the cloud API. The issue is fixed in version 1.3.1.

CVE-2026-58257 is a path traversal vulnerability in JeromeDevome GRR prior to version 4.5.0. The flaw exists in the database restoration feature, which does not properly validate file paths. An administrator user can exploit this to read or delete arbitrary files on the server, potentially disclosing sensitive information or causing denial of service. The risk is higher if the server runs with elevated privileges. This issue is fixed in version 4.5.0.

CVE-2026-58256 is a critical code injection vulnerability in JeromeDevome's GRR resource management application. Before version 4.5.0, an administrator could inject malicious PHP code via LDAP connector configuration parameters, leading to remote code execution. Exploitation requires the administrator to connect to an attacker-controlled LDAP server and submit crafted input. The vulnerability is fixed in version 4.5.0.

Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.121, a non-administrator user or scoped API key with `create_events` and `run_events` privileges can inject top-level `uid` and `gid` fields through `/api/app/create_event` or `/api/app/update_event`. In `lib/api.js`, `requireValidEventData` uses `validateOptionalParams` as a partial allow-list that silently passes unknown keys, storing the injected fields verbatim. In `lib/job.js`, `launchJob` copies the whole event into the job, and a plugin `uid` overrides the event `uid` only when the plugin defines one. The default `shellplug` and `urlplug` plugins do not define a `uid`, so the event-controlled identity survives into child-process launch. On a root-daemon installation, this lets a low-privileged user run jobs as arbitrary users, including root, bypassing the otherwise administrator-only run-as-user control. This API-side event injection is distinct from the job-output `uid`/`gid` injection addressed by CVE-2026-39401. This issue is fixed in version 0.9.121.

JeromeDevome GRR versions prior to 4.5.0 contain a reflected cross-site scripting (XSS) vulnerability in the maj.php script. This occurs when the forcemaj parameter is reflected without proper escaping if installation files remain accessible. An attacker can exploit this by crafting a URL that executes arbitrary JavaScript in a victim's browser, potentially leading to phishing, redirection to malicious sites, cookie theft, and session hijacking due to the authentication cookie not being HttpOnly. The vulnerability is fixed in version 4.5.0.

The private keys of eight eMudhra intermediate CA certificates were compromised and subsequently revoked on October 18, 2026. This incident affects NetApp ONTAP 9 products that rely on these certificates. Although this is not a traditional software vulnerability, it has been assigned CVE-2026-22063 to track the impact on NetApp products. A fixed version, 9.18.1, addresses the issue by presumably removing or replacing the affected certificates.

ThorVG versions prior to 1.0.7 contain an out-of-bounds read vulnerability in the SFNT/TTF font loader. The function SfntLoader::gen reads the first four bytes of the input buffer without verifying its size, which can lead to reading beyond the buffer when loading undersized fonts from memory. This may cause application crashes or disclosure of adjacent heap memory. The issue is fixed in version 1.0.7.

A vulnerability has been found in a2aproject a2a-js up to 1.1.0. Impacted is the function ResultManager.applyStatusUpdate of the file src/server/result_manager.ts of the component Task Status Update Handler. Such manipulation leads to race condition. The attack may be launched remotely. Upgrading to version 1.2.0 is recommended to address this issue. The name of the patch is 7b87c9480bfa643f9d2b2eaf06988b3d3a95de25. It is recommended to upgrade the affected component.

CVE-2026-57199 is an out-of-bounds write vulnerability in the Asterisk telephony toolkit affecting the app_sms.c component. It occurs when SMS lengths controlled externally are copied into fixed-size buffers without proper bounds checking, potentially allowing memory corruption or crashes. The vulnerability affects versions prior to 20.20.1, 21.12.3, 22.10.1, 23.4.1, and certain Certified Asterisk releases. The issue requires explicit use of the SMS dialplan application and improper validation of input data. Fixed versions are available.