Threats affecting pkg:generic/libheif

CVE-2026-65184 is a critical vulnerability in the root-privileged wsserver terminal-bridge daemon. The daemon constructs shell commands directly from client-supplied WebSocket fields and executes them via system() and popen() calls without any quoting, escaping, or character-set validation. Additionally, the daemon's public-key session path lacks appliance-session checks, increasing the risk of unauthorized command execution.

CVE-2026-3322 is a vulnerability in Lobster_pro where improper permission checks allow attackers with limited privileges to access endpoints that should require administrative rights. This affects Lobster_pro version 4.12.12-LTS and possibly other versions before 25.1.3. The flaw could enable privilege escalation or unauthorized actions via these endpoints.

Xovis AG APS-R series devices up to version 2.10.1.1 contain an OS command injection vulnerability in the /sbin/ImportParamSet.sh script. This script processes symlinks from uploaded parameter archive files and embeds the symlink target path into a shell command without proper quoting or sanitization. The command is executed with root privileges via the APC_SendMsg IPC mechanism.

A security vulnerability in Kameleo up to version 5.3.1 affects the Local API component, specifically the /general/user-info endpoint. This vulnerability allows remote attackers to cause information disclosure. The vendor was notified but has not responded. The vulnerability has a medium severity rating with a CVSS score of 4.3.

CVE-2026-59107 is a critical security vulnerability in the vSolution Matrix file sharing feature. It allows an attacker who obtains the matching private key to authenticate via SSH as root on devices configured as a vSolution Matrix main/master station with file sharing enabled.

CVE-2026-59106 is a critical vulnerability in the WolfProt interface implementation that allows unauthenticated remote attackers to execute operating system commands with the privileges of the affected service due to insufficient neutralization of user-controlled input.

A medium-severity authorization bypass vulnerability exists in iFlytek astron-agent up to version 1.1.2. The flaw affects the FileInfoV2Service.listKnowledgeByPage function via manipulation of the argument space-id, allowing unauthorized access. The vulnerability can be exploited remotely. Public exploit code is available, but no vendor response or patch has been provided.

A NULL pointer dereference vulnerability in gssproxy allows any local user to crash the daemon by sending a GSSX_INIT_SEC_CONTEXT request missing the target_name field. This causes the daemon to crash and not restart automatically, resulting in a persistent denial of service that affects dependent services such as Kerberized NFS and IdM.

An SQL Injection vulnerability exists in CRM SOFTTRADE Infotech (softtradeindia) version 1.0, allowing a remote attacker to execute arbitrary code via the login page.

A vulnerability in iFlytek astron-agent up to version 1.1.2 affects the DDL Whitelist Handler component, specifically in the file core/memory/database/api/v1/exec_ddl.py. This flaw causes an incomplete blacklist, potentially allowing unauthorized actions. The vulnerability can be exploited remotely and has publicly disclosed exploit code. The vendor has not responded to the disclosure. The CVSS score is 7.3, indicating a high severity.

A local information disclosure vulnerability exists in Kameleo versions up to 5.0.1.26 in the ListProfiles function of the Profile Controller component. This flaw allows an attacker with local access to obtain information improperly. The issue is resolved by upgrading to version 5.2.0.

A vulnerability in the hackney_conn component of the benoitc hackney HTTP client allows a malicious HTTP server to exhaust client memory by sending an oversized or highly compressed response body. The client buffers the entire response without limits, and with auto decompression enabled, decompresses the entire body at once, leading to potential resource exhaustion. This affects hackney versions from 2.0.0-beta.1 up to but not including 4.9.0.

A vulnerability in the WCH CH340/CH341 USB-to-Serial Windows Driver setup package CH341SER.EXE version 4.0 allows a local attacker to escalate privileges on the affected system.

Apache SIS versions 0.7 through 1.6 have a vulnerability where the software opens linked files from data files without properly restricting their paths. This can lead to opening local files outside the intended directory. The vulnerability affects specific geographic data formats including GML, WKT with datum shift grids, and Landsat GeoTIFF bands. The risk of sensitive information leakage is low because the software stops reading at the first parsing error if the file format is unexpected. Version 1.7 of Apache SIS fixes this issue by restricting file paths to the same directory or a predetermined directory for datum shift grids.

The MongoDB Shell (mongosh) versions prior to 2.14.0 rely on a Node.js runtime that includes a TLS root certificate store containing recoverable eMudhra intermediate CA certificates. This reliance introduces a security vulnerability identified as CVE-2026-115930. The issue can be resolved by updating mongosh to version 2.14.0 or later, which bundles Node.js 24.22.1 or newer. For installations via npm, the Node.js runtime on the host must be updated separately.

The TTLock Android application versions before 9.8.260718 and associated smart-lock firmware contain a vulnerability due to a hardcoded static AES key. This flaw allows attackers within Bluetooth range to decrypt the per-pairing session key during BLE pairing. Exploitation enables unauthorized actions such as unlocking the device, adding fingerprints or access codes, and performing administrative tasks without user authentication or interaction.

A SQL injection vulnerability exists in the SQL storage module of Apache SIS versions 1.0 through 1.6 inclusive. The issue arises when sorting a stream of features, as the sort clause is copied after ORDER BY without properly quoting identifier characters, allowing crafted input to inject SQL code. This vulnerability is fixed in version 1.7.

A weakness in Kameleo up to version 5.0.1.26 affects the Local API component, specifically the /profiles file, allowing remote attackers to cause information disclosure. The issue is mitigated by upgrading to version 5.2.0.

Frappe CRM app versions before 1.89.1 have a missing authorization vulnerability that allows authenticated low-privileged users to access CRM Lead records they should not be able to see. This occurs because the get_contact_by_phone_number API endpoint performs raw database queries without enforcing permission checks, enabling unauthorized disclosure of sensitive lead data by supplying a known phone number.

Mattermost versions up to 11.9, including 11.1.9, 11.5.8, and 11.10.7.0, contain a vulnerability where the Zoom chat line length is not properly validated before slicing. This flaw allows an authenticated attacker to crash the Agents plugin by summarizing a Zoom chat transcription with short continuation lines.