CVE-2020-26978 affects multiple packages. Using techniques that built on the slipstream research, a malicious webpage could have exposed both an internal network's hosts as well as services running on the user's local machine. See references for individual vulnerability details.