Threats affecting pkg:generic/mongoose

A vulnerability in gdbserver component of Gdb (version 3.0) involves heap disclosure and a wild pointer issue in the gdb_parse_agent_expr function caused by an untrusted agent-expression length.

A heap buffer overflow vulnerability exists in gdbserver's cmd_qtdpsrc command due to a mismatch between declared and actual length in qtdpsrc. This flaw could potentially lead to memory corruption. The vulnerability is identified in Microsoft product version 3.0. No CVSS score or detailed impact information is provided.

A stack buffer overflow vulnerability exists in GDB's fetch_register_using_p function due to an unchecked p-reply length. This vulnerability is identified as CVE-2026-121994 and affects Microsoft product version 3.0. No CVSS score or detailed impact information is provided.

CivetWeb version 3.0 contains a use-after-free vulnerability in its HTTP/2 implementation caused by stale pseudo-header state. This flaw can lead to memory corruption issues. No CVSS score or detailed impact information is provided. No patch or remediation details are available from the vendor advisory.

A vulnerability exists in Ansible-core's user module version 3.0 where the generate_ssh_key function follows a symlinked ~/.ssh directory. This behavior can enable local privilege escalation by allowing an attacker to manipulate SSH key generation paths.

Viber for iOS versions up to 29.4.0.24 contain a vulnerability where the app does not properly validate the logical screen width and height in GIF headers. An attacker can send a specially crafted GIF with zero dimensions that causes the app to crash due to an uncaught exception.

CVE-2026-126545 is a missing authorization vulnerability in WWBN AVideo up to version 29.7.1. It affects the API::get_api_tags() function in the plugin/API/API.php file, allowing registered users to access restricted video data by querying the tags API. Exploiting this flaw, attackers can subscribe to a tag and retrieve filenames, titles, and stored video_password values of unlisted, group-restricted, and password-protected videos, potentially enabling unauthorized viewing.

WWBN AVideo versions 6.5 through 29.7.1 have an email verification bypass vulnerability due to PHP loose comparison in the User::verifyCode() function. This flaw allows registered users to reuse a global salt from their own verification link to craft a code that can verify other users' email addresses, potentially unlocking features like live streaming on those accounts.

CVE-2026-126543 is a high-severity vulnerability in WWBN AVideo up to version 29.7.1. It involves improper verification of payment authenticity in the PayPal IPN handling script (plugin/PayPalYPT/ipnV2.php). Attackers can exploit this flaw by forwarding legitimate verified recurring payment notifications from their own PayPal accounts with arbitrary user IDs, resulting in unauthorized crediting of wallet balances on the affected site.

WWBN AVideo versions 6.5 through 29.7.1 have an authentication bypass vulnerability via Hybridauth social login display names. Attackers can impersonate any user, including administrators, by setting their social login display name to a victim's username and omitting the email, allowing login without a password.

CVE-2026-126541 is a high-severity authorization bypass vulnerability in WWBN AVideo versions up to 29.7.1. It affects the Live plugin's restream endpoints, allowing authenticated streamers to supply arbitrary live_transmitions_history_id values to obtain other users' stream keys and HLS URLs. This enables attackers to impersonate victims by publishing streams as them or restreaming private or pay-per-view content without authorization.

Directus versions before 12.1.0 have an authorization bypass vulnerability that allows unauthenticated attackers to bypass permission checks on public-mode WebSocket connections. By sending an invalid token, attackers can cause the system to set accountability to null, enabling them to read, create, update, or delete records in any user-defined collection without proper authorization. This vulnerability is fixed in version 12.1.0.

Jellyfin versions prior to 12.0 contain a path traversal vulnerability in the DELETE /Library/VirtualFolders and POST /Library/VirtualFolders/Name endpoints. This flaw allows unauthenticated attackers to delete or move directories by supplying specially crafted library names such as '..' or absolute paths before setup completes, potentially leading to recursive deletion of the data directory and the jellyfin.db database file.

WriteFreely versions before 0.17.3 contain a stored cross-site scripting (XSS) vulnerability. Authenticated authors can inject malicious HTML via the post slug in the CreatePost API. This injected script executes in RSS/Atom feed readers, newsletter recipients, and ActivityPub viewers. The vulnerability is fixed in version 0.17.3.

LibreCAD versions up to 2.2.1.6 have a heap-based out-of-bounds write vulnerability in the libdxfrw dwgReader18::parseDataPage() function. This flaw arises from unchecked buffer sizes and page offsets when processing AC1018 (R2004) DWG files. Maliciously crafted DWG files with manipulated startOffset values can trigger writes beyond the allocated heap buffer, potentially causing application crashes or code execution.

CVE-2026-126496 is an authorization bypass vulnerability in 1Panel-dev CordysCRM versions before 1.9.6. It allows authenticated users with ordinary contact or customer read permissions to access other users' contact information without proper organization, owner, or data-scope checks. Exploitation involves sending a GET request to /account/contact/get/{id} with another contact's ID to retrieve sensitive details such as names, phone numbers, owners, departments, linked customers, and custom fields.

MQTTX desktop versions up to 1.13.3 have a stored cross-site scripting (XSS) vulnerability. This flaw allows attackers to inject malicious scripts via MQTT topic names or payloads that are rendered without proper escaping in tooltips. When a user hovers over affected Topic Tree or JSON tree nodes, the malicious script executes in the Electron renderer environment, which has nodeIntegration enabled, increasing potential impact.

The npm package rex-react-diag-tools-v1 contains malicious code that fully compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted computer. Removing the package alone does not guarantee removal of all malicious software introduced by it.

Red Hat has issued a security advisory for multiple vulnerabilities in the Linux kernel packages affecting Red Hat Enterprise Linux 9.4 and related variants. The update addresses a range of issues including out-of-bounds reads and writes, denial of service, privilege requirements, and memory disclosure across various kernel subsystems such as netfilter, Bluetooth RFCOMM, IP tunnels, NVMe TCP, libceph, and others. These vulnerabilities have been assigned CVE identifiers and are rated with an overall security impact of Important. The advisory recommends applying the update and rebooting the system to mitigate these issues.

A heap out-of-bounds write vulnerability exists in Microsoft.DiaSymReader.Native on Windows platforms when reading crafted native PDB files. This affects multiple .NET runtime versions on Windows x86, x64, and Arm64 architectures. The flaw is due to crafted PDB line metadata exceeding the caller-provided buffer. Microsoft has released patches for affected .NET runtime and SDK versions to address this issue.