Threats affecting pkg:generic/libhevc

The pystr-codec package on PyPI contains malicious code that executes on every Python startup. It runs obfuscated JavaScript via a Bun engine to exfiltrate credentials to a public GitHub repository, establish persistence, accept remote commands, spread using stolen credentials, and perform destructive actions if credentials become invalid. This malware is linked to the Miasma-family worm.

CVE-2026-120189 is a critical stack-based buffer overflow vulnerability in the D-Link DIR-505 router version 1.10B02. The flaw exists in the TFTP Upload Filename Handler component, specifically in the save_upload_file/mp_upload_file functions within /usr/bin/tftpd. This vulnerability can be exploited remotely without authentication. Public exploit code is available, increasing the risk of exploitation.

XS::libbrotli versions before 1.2.1.0 include a bundled brotli library with an out-of-bounds write vulnerability in the decoder. This flaw allows an attacker to supply crafted brotli streams that can corrupt decoder state, disclose memory, crash the process, or potentially execute arbitrary code. The vulnerability is fixed in version 1.2.1.0, which updates the bundled brotli library to version 1.2.1. Upgrading the system brotli library does not mitigate this issue because the vulnerable library is statically linked.

Red Hat has issued a security advisory for the java-17-openjdk packages in Red Hat Enterprise Linux 9, addressing multiple vulnerabilities across various components of the OpenJDK 17 runtime and development kit. The update includes enhancements and fixes for issues related to PKCS5 padding, TLS certificate handling, LDAP logins, SASL authentication, HTTP client and server handling, XML processing, image and font rendering, Kerberos validation, and more. These fixes collectively address a broad range of security concerns in the Java environment provided by OpenJDK 17.

CVE-2026-120185 is a medium severity vulnerability in ken678 YznCMS versions 2.0, 2.1, and 2.2.0. It involves improper privilege management in the Backend function of the app/admin/controller/auth/Group.php file within the Auth Group Handler component. This flaw can be exploited remotely to manipulate privileges improperly. The issue is fixed in version 2.2.1.

CVE-2026-118147 is a vulnerability in Visual Studio involving improper certificate validation. This flaw allows an unauthorized attacker to perform network-based spoofing attacks. The vulnerability has a high severity rating with a CVSS score of 7.4, indicating significant impact on confidentiality and integrity but no impact on availability. No affected versions or patch information are provided in the available data.

Uncontrolled Recursion vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

**UNSUPPORTED WHEN ASSIGNED**  JavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject() on frame bytes with no class filter, so an application that puts it in front of an untrusted peer is open to gadget-chain RCE. As the 3.0.0 branch is inactive, we do not plan to release a version that fixes this issue. Users are recommended to use the latest Apache MINA 2.2.X branch.

TànPhá V3 is an open-source, modular penetration testing framework designed for Termux on Android and lightweight Linux environments. It automates discovery, fingerprinting, vulnerability assessment, validation, and reporting using a state-machine architecture. The tool supports multiple exploitation vectors including SQL injection, command injection, file upload, local file inclusion, and a stateful PHP remote access trojan (RAT). It features automatic CSRF token bypass for authenticated scans and basic web application firewall evasion. The project is actively maintained with plans for advanced evasion techniques and additional modules in future releases. It is intended solely for authorized security testing and educational purposes.

A heap-based buffer overflow vulnerability exists in libheif versions 1.18.0 up to but not including 1.23.3 in the function unc_decoder_mixed_interleave::processTile(). This flaw allows attackers to write out of bounds by crafting HEIF files with chroma components of unequal bit depths, potentially leading to code execution during image processing.

AJ-Report versions through 1.7.1 use a hard-coded JWT secret to sign share tokens. This allows attackers to forge valid share tokens offline. By crafting a token with the reportCode 'dataSet', attackers can access the testTransform endpoint, which executes scripts via GroovyClassLoader without authentication, leading to remote code execution.

DeepInfer versions through 0.1.0 have a path traversal vulnerability in the unauthenticated /profile endpoint. This flaw allows remote attackers to create arbitrary directories via the output_dir parameter. Exploitation can include cross-site GET requests from an operator's browser to write chrome trace files, potentially exhausting disk space or inodes and using error messages as a filesystem oracle.

Thelia versions prior to 3.1.0 have a stored cross-site scripting (XSS) vulnerability in the ForSomeCustomers::getSummary() function. This flaw allows unauthenticated attackers to inject malicious scripts via unescaped customer names during registration. When administrators view coupons related to these customers, the injected scripts execute, potentially stealing CSRF tokens and enabling attackers to create administrator accounts.

The Thelia Page Module versions prior to 2.0.4 contain a cross-site request forgery (CSRF) vulnerability. This flaw allows remote attackers to delete page tags, documents, and images by exploiting back-office delete routes that lack CSRF tokens and permission checks. Attackers can trick logged-in administrators into visiting crafted GET requests that sequentially delete TheliaLibrary images and associated files across pages, products, and categories.

ShowDoc versions from 2.8.14 up to but not including 3.9.6 contain a code injection vulnerability in the Mock feature. Authenticated users can exploit this flaw to execute arbitrary shell commands with root privileges in the official Docker image by leveraging mockjs templates evaluated via eval(). This vulnerability has a high severity rating with a CVSS score of 8.8.

Highflame ramparts versions 0.8.1 through 0.8.10 have a security scan bypass vulnerability. This flaw allows attackers to hide malicious payloads by exploiting the way the software skips nested directories and .pyc files during scanning. Specifically, attackers can place an unchecked-hash .pyc file under scripts/<subdir>/__pycache__/ which ramparts ignores, but CPython executes when the skill runs. This can lead to unauthorized code execution without detection.

FFmpeg versions 5.0 through 9.0.2 have a path traversal vulnerability in the IMF demuxer. This flaw allows attackers to open files outside the intended package by supplying crafted IMF packages with unvalidated ASSETMAP Path elements containing '..' or absolute paths. Exploitation can lead to probing local MXF files for existence and size or triggering server-side requests.