Threats affecting pkg:generic/espeak-ng

A Cross-site Scripting (XSS) vulnerability exists in If-So Dynamic Content Personalization through version 1.10.3 due to improper neutralization of input during web page generation. This flaw allows reflected XSS attacks, potentially leading to partial confidentiality, integrity, and availability impacts. The vulnerability has a high severity rating with a CVSS score of 7.1.

A Missing Authorization vulnerability exists in PT Norther Lights Production MapSVG (mapsvg-lite-interactive-vector-maps) affecting versions up to 8.16.3. This flaw allows unauthorized access due to incorrectly configured access control security levels. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity with network attack vector and no privileges or user interaction required.

A stored cross-site scripting (XSS) vulnerability exists in the wpWax Directorist plugin up to version 8.10.7. This vulnerability arises from improper neutralization of input during web page generation, allowing attackers with low privileges to inject malicious scripts that execute in the context of other users. The flaw impacts confidentiality, integrity, and availability to a limited extent. No official patch or remediation details are provided in the available data.

A stored Cross-site Scripting (XSS) vulnerability exists in Mang Board WP through version 2.4.7 due to improper neutralization of input during web page generation. This flaw allows an attacker with low privileges and requiring user interaction to potentially execute script code in the context of another user. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity impact on confidentiality, integrity, and availability. No patch or remediation information is currently provided.

A stored cross-site scripting (XSS) vulnerability exists in the Nickboss WordPress File Upload plugin (wp-file-upload) through version 5.2.2. This flaw allows improper neutralization of input during web page generation, enabling attackers to inject malicious scripts that can execute in users' browsers.

A stored cross-site scripting (XSS) vulnerability exists in the Featured Image from URL component of fifu.app up to version 6.1.4. This vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers to execute malicious scripts in users' browsers.

A stored cross-site scripting (XSS) vulnerability exists in Plugins360 Labs All-in-One Video Gallery up to version 5.0.0. This vulnerability arises from improper neutralization of input during web page generation, allowing attackers with limited privileges to inject malicious scripts that execute in the context of other users. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level.

An XML External Entity (XXE) vulnerability exists in Apache Axis2/Java versions through 2.0.1. When a client builds an AxisService from a WSDL URL, imported documents are parsed by wsdl4j's XML parser, which processes external entities. This allows an attacker controlling a WSDL or its imports to read local files or cause the JVM to make network requests. The issue is fixed in version 2.0.2.

A stored cross-site scripting (XSS) vulnerability exists in WP Chill RSVP and Event Management plugin versions up to 2.7.17. This vulnerability allows attackers to inject malicious scripts that are executed in the context of users visiting affected pages.

A Server-Side Request Forgery (SSRF) vulnerability exists in Apache Axis2/Java versions through 2.0.1. The vulnerability allows an attacker who controls a WSDL or schema processed by an Axis2 application to cause the JVM to send requests to arbitrary internal or external hosts by exploiting the lack of scheme or host restrictions when fetching absolute URLs in wsdl:import locations and schemaLocations. This issue is fixed in version 2.0.2.

A stored cross-site scripting (XSS) vulnerability exists in the TI WooCommerce Wishlist plugin up to version 2.14.0. This vulnerability arises from improper neutralization of input during web page generation, allowing malicious scripts to be stored and executed in users' browsers.

Apache Axis2/Java versions through 2.0.1 contain a vulnerability where JSON message builders buffer the entire request body without size limits, allowing unauthenticated attackers to exhaust server memory with large JSON requests. This resource exhaustion issue is fixed in version 2.0.2 by introducing a configurable jsonMaxRequestSize parameter to limit JSON request sizes.

A Missing Authorization vulnerability exists in WP E-Signature Formidable Forms Signature Online Contract Automation up to version 2.0.5. This flaw allows unauthorized remote attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized data disclosure. The vulnerability has a high severity with a CVSS score of 7.5.

Apache Airflow's scheduler deserializes XCom values written by task code when evaluating task dependencies. This behavior allows a Dag author, who controls XCom data, to influence the scheduler's deserialization process, which is intended to be restricted to code installed by the Deployment Manager. This can lead to privilege escalation in deployments where Dag authors are less trusted than Deployment Managers. The issue is addressed in Apache Airflow version 3.4.0 and later by restricting dependency evaluation to primitive XCom values.

A stored cross-site scripting (XSS) vulnerability exists in the WP Customer Area plugin by Aguila Technologies, affecting versions up to 8.4.3. This vulnerability arises from improper neutralization of input during web page generation, allowing malicious scripts to be stored and executed in users' browsers.

An OAuth 1 rebinding vulnerability exists in Apache Allura versions through 1.22.0. This security flaw has been addressed in version 1.22.1, which users are advised to upgrade to in order to mitigate the issue.

Apache Airflow versions before 3.3.0 are not affected by CVE-2026-96285. Version 3.3.1 includes a partial fix that checks the scheduler's decoded next_kwargs value is a dictionary only after deserializing the entire stored payload. This deserialization process reconstructs nested objects and runs their constructors before the check, allowing a DAG author to trigger constructor execution in the scheduler and API server without non-default configuration. The fix in 3.3.1 is incomplete; deployments must upgrade to version 3.4.0 or later for a complete resolution.

A missing authorization vulnerability exists in Mamunur Rashid Radius Booking — Booking Calendar for Appointments & Services up to version 1.0.20. This flaw allows attackers to bypass access control mechanisms due to incorrectly configured security levels.

The FraudLabs Pro SMS Verification WordPress plugin versions 1.11.2 through 1.12.1 have a vulnerability where they do not perform authorization or validity checks before marking a WooCommerce order's SMS verification as completed. This flaw allows unauthenticated users to forge the verified state of an order, effectively bypassing the SMS verification control.

A security vulnerability exists in iomad versions up to 4.5.15, 5.0.11, 5.1.8, and 5.2.4 affecting the local_iomad_pluginfile function in the PDF Certificate Handler component. This flaw allows remote attackers to bypass authorization controls. A patch has been identified to address this issue. The vulnerability has a medium severity rating with a CVSS score of 4.3.