Threats affecting pkg:generic/libhevc

CVE-2026-120196 is a critical OS command injection vulnerability in the WAVLINK WN579X3-D router, specifically in the port_forward function of /cgi-bin/wapi.cgi. The flaw allows remote attackers to manipulate the 'Name' argument to execute arbitrary OS commands. Public exploit code is available, increasing the risk of exploitation.

CVE-2026-120195 is a critical OS command injection vulnerability in the WAVLINK WL-WN579A3-A device, specifically in the set_wzdgwMesh function of the /cgi-bin/adm.cgi file used by the Initial Setup Wizard. The vulnerability arises from improper handling of the wlan_ssid argument, allowing remote attackers to execute arbitrary OS commands. The exploit has been publicly disclosed and may be used. The affected version is 2026-03-10-94f93d4.

A directory traversal vulnerability exists in gettext via the LANGUAGE environment variable. This flaw could allow an attacker to influence file path resolution, potentially accessing unauthorized files. The affected product is Microsoft software version 3.0. No CVSS score or detailed impact information is provided.

CVE-2025-0750 is a path traversal vulnerability in the log handling functions of Cri-o version 3.0. This flaw allows an attacker to perform arbitrary unmounting operations on the system.

CVE-2026-119601 is a heap out-of-bounds write vulnerability in AFFLIB version 3.0, specifically in the af_get_page function. This type of flaw can lead to memory corruption, potentially causing crashes or enabling further exploitation. No CVSS score or detailed impact information is provided.

CVE-2026-120192 is an information disclosure vulnerability in Presenton versions up to 0.9.11-beta affecting the Desktop Authentication Middleware component. The flaw involves manipulation of the /app_data file and can be exploited remotely without authentication. Public exploit code has been disclosed. Upgrading to version 0.9.12-beta mitigates the issue.

CVE-2026-120191 is a vulnerability in Presenton up to version 0.9.11-beta involving missing authentication in an unspecified API component. This flaw allows remote attackers to exploit the system without proper authentication. Public exploit code is available. Upgrading to version 0.9.12-beta resolves the issue.

A stack-based buffer overflow vulnerability exists in the imagecodecs library versions 2023.1.23 through 2026.10.10. The flaw occurs in the lossless JPEG Define Huffman Table parser function decode_jpegsof3(), where crafted lossless JPEG files with manipulated DHT symbol counts can overflow internal stack arrays, causing a crash.

imagecodecs versions 2026.3.6 through 2026.10.10 contain an infinite loop vulnerability in the ccitt_fax4_decode_size() function. This flaw allows an attacker to hang the calling process by providing a crafted CCITT Group 4 stream that lacks an End Of Facsimile Block (EOFB). The vulnerability results in full CPU consumption until the affected process is terminated.

OpenAlgo versions from 1.0.0.29 up to but not including 2.0.3.1 have an improper certificate validation vulnerability in email utility scripts. This flaw disables TLS hostname and certificate checks for STARTTLS and SMTPS, allowing network attackers to present forged certificates. Exploiting this, attackers could intercept SMTP credentials and subsequent emails, including sensitive password-reset links. The issue is fixed in version 2.0.3.1.

Thelia Back-office Default Twig Template versions prior to 1.1.1 contain a cross-site request forgery (CSRF) vulnerability in certain administrative routes that accept GET requests without anti-CSRF token validation. This flaw allows an attacker to trick a logged-in administrator into executing unauthorized actions such as modifying product combination prices, stock, weight, EAN, and sale flags, potentially zeroing omitted prices.

Thelia versions prior to 3.1.1 contain a stored cross-site scripting (XSS) vulnerability. Authenticated back-office administrators with store update permissions can exploit this by uploading unsanitized SVG images as logo or banner files. These SVG files can include malicious scripts that execute when accessed via the admin or public cache directories, potentially affecting visitors and higher-privileged administrators.

FFmpeg versions 2.3 through 9.0.2 have a vulnerability in the Huffyuv decoder where uninitialized heap memory can be leaked into decoded video frames. This occurs when processing crafted Huffyuv BGR24/BGRA videos with prematurely ending entropy data, causing uninitialized bytes to be included in output frames.

A use of uninitialized variable vulnerability exists in FFmpeg versions 4.4 through 9.0.2 in the CDXL decoder. This flaw causes stack memory to leak into decoded pixels via unfilled HAM palette entries. An attacker can craft a specially designed type-0 CDXL file to expose stack bytes and pointer fragments in the BGR24 output.

A vulnerability in FFmpeg versions 0.10 through 9.0.2 involves the use of an uninitialized resource in the sunrast_decode_frame() function. This flaw causes heap memory leakage when decoding truncated 1-bit and 4-bit paletted Sun Raster images. Crafted truncated Sun Raster files can cause stale heap contents, including allocator metadata, to be exposed in the decoded output.

CVE-2026-120244 is a use of uninitialized resource vulnerability in FFmpeg versions 2.1 through 9.0.2 affecting the PCX image decoder. The flaw allows attackers to craft a specially truncated PCX image with early-ending RLE data, causing the decoder to leak heap memory by copying uninitialized buffer contents into decoded pixels. This vulnerability has a medium severity score of 6.8 and requires user interaction for exploitation.

CVE-2026-120243 is a vulnerability in FFmpeg versions 2.0 through 9.0.2 involving the use of an uninitialized variable in the Go2Meeting decoder. This flaw allows attackers to leak stack memory by exploiting out-of-range palette indices in crafted G2M3/G2M4 streams. The vulnerability arises because the function kempf_restore_buf() copies uninitialized stack bytes, potentially exposing sensitive data such as pointers or stack guards.

CVE-2026-120190 is a cross-site scripting (XSS) vulnerability in PostyBirb Plus versions 3.1.0 through 3.1.19. It affects an unknown functionality within the Submission Description Editor component, specifically the file DescriptionInput.tsx. The vulnerability allows remote attackers to perform XSS attacks. A public exploit exists. Upgrading to version 3.1.76 resolves this issue.

A security flaw exists in ken678 YznCMS versions up to 2.2.0 in the Backend function of app/admin/controller/auth/Group.php related to improper privilege management. This vulnerability can be exploited remotely and is fixed in version 2.2.1.

XS::libbrotli versions before 1.2.1.0 for Perl include a bundled brotli library with an out-of-bounds write vulnerability in the decoder. This flaw can be triggered by an attacker supplying a crafted brotli stream to any dependent module that decompresses untrusted data, potentially leading to memory corruption, information disclosure, process crashes, or arbitrary code execution. The vulnerability arises because the bundled brotli versions 1.0.7 or 1.1.0 contain the decoder flaw described in CVE-2026-111497. Upgrading the system brotli library does not mitigate this issue; only upgrading XS::libbrotli to version 1.2.1.0, which updates the bundled brotli to 1.2.1, resolves the vulnerability.