Threats affecting pkg:bitnami/joomla

A vulnerability was identified in Sunwood-ai-labs github-kanban-mcp-server up to 0.4.0. Impacted is the function handleListIssues of the file src/handlers/issue-handlers.ts. Such manipulation of the argument state/labels leads to os command injection. The attack can be launched remotely. Upgrading to version 0.4.1 is recommended to address this issue. The name of the patch is 253d93bbdf7ee9fe42bd8fdf15feea93ae59cbae. It is suggested to upgrade the affected component.

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Magepeople inc. WpEvently mage-eventpress allows Code Injection.This issue affects WpEvently: from n/a through 5.7.9.

Mattermost versions 11.7.x <= 11.7.10 fail to restrict which built-in roles can be assigned to a team member via the API, which allows a team admin to grant a team member permissions beyond those permitted by the configured permission scheme via the {{update-team-member-roles}} REST API.. Mattermost Advisory ID: MMSA-2026-00734

Syncplify Server! before 8.8.0 contains a path traversal vulnerability that allows attackers with a symbolic link placed inside a user's home folder to access files outside the virtual filesystem root because confinement is enforced only against the requested path and not the on-disk destination of the link. Attackers can leverage a symlink or, on Windows, a directory junction that points outside the jail to read or access restricted files beyond the intended home-folder boundary.

Syncplify Server! before 8.8.0 contains an access control bypass vulnerability that allows authenticated SFTP users to evade per-path permission overrides by exploiting case-insensitive filesystem path resolution and 8.3 short names. Attackers can address a protected directory using alternate capitalization or its 8.3 short name to perform file uploads and downloads that the configured override is intended to deny, resulting in unauthorized file access.

Arm Keil MDK-Middleware 8.0.0-8.3.0 may allow DHCPv6 Option-Walk Over-Reads and Unintended Data Retransmission

Arm Keil MDK-Middleware 8.3.0 may allow out-of-bounds reads and writes to the FTP Server RX Buffer

A vulnerability was determined in DeepSeek Harness up to 0.2.0-rc.2. This issue affects some unknown processing of the file packages/client/connection/src/browser-auth.ts of the component Browser Auth. This manipulation causes improper authorization. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Arm Keil MDK-Middleware 8.0.0-8.3.0 may allow pre-authentication out-of-bounds read in SNMP processing

OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated remote code execution vulnerability where the DockerWorkspace and Apptainer workspace launchers bind the sandbox agent server to all network interfaces (0.0.0.0) with an empty session_api_keys list, disabling authentication by default. Attackers who can reach the published container port can send unauthenticated HTTP and WebSocket requests to execute arbitrary shell commands as root in the sandbox, access the mounted workspace, and read plaintext secrets from the secrets store.

A vulnerability was found in DeepSeek Harness up to 0.1.0-rc.5. This vulnerability affects the function createContext of the file packages/extensions/cordis-host-runner/src/sandbox.ts. The manipulation results in sandbox issue. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.

**UNSUPPORTED WHEN ASSIGNED**  Authorization bypass in Apache Vysper, all versions. Apache Vysper is an XMPP (Jabber) server library. Its XEP-0077 (In-Band Registration) implementation is missing an authentication check, allowing any authenticated user to compromise other accounts. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative.

CVE-2026-115721 is a high-severity vulnerability in Apache Vysper, an XMPP server library. It involves unbounded resource allocation during XML parsing, which can lead to an out-of-memory condition. This affects all versions of Apache Vysper. The project is retired and no fixes will be released. Users are advised to migrate to alternative solutions.

Open5GS versions 2.6.1 through 2.8.0 have an out-of-bounds read vulnerability in the parse_scheme_output() function during SUCI de-concealment. This flaw arises from incomplete length validation, allowing remote unauthenticated UEs or SBI peers to submit a crafted SUCI with a 42-byte scheme output to a UDM, causing a heap over-read beyond the buffer.

Open5GS versions 1.3.0 through 2.8.0 have a heap out-of-bounds write vulnerability in the parse_multipart() function. This flaw allows unauthenticated attackers to corrupt memory by sending a crafted multipart/related request with an empty multipart boundary to the SBI interface of any network function, causing a buffer overflow and potential crash.

CVE-2026-116542 is a vulnerability in netty-tcnative versions before 2.0.84.Final that allows remote unauthenticated clients to spoof SNI hostnames by exploiting improper handling of Unicode encoding in JNI NewStringUTF decoding. Attackers can use overlong encodings in the ClientHello server_name field to manipulate SNI-based certificate selection, access control decisions, and logging.

CVE-2026-116541 is a denial of service vulnerability in netty-tcnative versions before 2.0.84.Final. The flaw occurs in the tcn_write_to_bytebuffer BIO write callback, which incorrectly calculates bytes consumed. This can be exploited by remote TLS 1.3 peers sending queued post-handshake records such as NewSessionTicket or KeyUpdate, causing truncated flights, connection failures, or JVM process aborts.

A use-after-free vulnerability exists in netty-tcnative versions 2.0.66.Final through 2.0.83.Final when built against OpenSSL 3.x. The flaw occurs during TLS session ticket key rotation, where OpenSSL may read freed HMAC keys, potentially causing crashes or corruption in ticket processing.

CVE-2026-116539 is a heap buffer overflow vulnerability in netty-tcnative before version 2.0.84.Final. It occurs in the tcn_write_to_bytebuffer BIO callback due to improper handling of the ring buffer write index. Remote TLS peers can exploit this during handshake, renegotiation, or post-handshake messages to trigger an out-of-bounds memory copy, causing the JVM process to crash.

HtmlSanitizer versions before 9.2.1039 and prereleases before 10.0.1037-beta contain a cross-site scripting (XSS) vulnerability. The function SanitizeDom(string) does not sanitize attributes on the html and body wrapper elements, allowing attackers to inject a second html or body tag with event handlers such as onload. This can lead to script execution when the application renders the serialized document or body outer HTML. The vulnerability has a low CVSS score of 2.3 and is fixed in versions 9.2.1039 and 10.0.1037-beta.