The Post Snippets WordPress plugin through 4.2.4 does not properly escape variable values substituted into snippets before outputting them, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when the content is viewed.
CVE-2026-108539 is a use-after-free vulnerability in the GPAC multimedia framework, specifically in the gf_fq_pop function of the MP4Box component. This flaw affects GPAC version 26.07 and can be triggered remotely by manipulating input, potentially leading to memory corruption. The vulnerability has a medium severity rating with a CVSS score of 5.3. Exploit code is publicly available, but no vendor response or patch has been provided as of the publication date.
CVE-2026-108538 is a use-after-free vulnerability in the GPAC multimedia framework, specifically in the function gf_mx_v within utils/os_thread.c of the MP4Box component. This flaw affects GPAC version 26.07 and can be exploited remotely without user interaction. The vulnerability has a medium severity with a CVSS 4.0 base score of 5.3. Public exploit code has been disclosed, but no vendor response or patch is currently available.
CVE-2026-108523 is a server-side request forgery (SSRF) vulnerability in Studio-Saelix Sencho versions 0.94.0 and 0.94.1. The flaw exists in the git-sources Browse API Endpoint, specifically in the outboundTarget.ts file, where manipulation of the repo_url argument can lead to SSRF. The vendor states that repository access is a privileged administrative function and disputes the CVE's characterization of the behavior as a privilege-boundary bypass. The vendor has hardened repository access with DNS validation, rejection of certain network targets, disabled redirects, and strict SSH host-key verification. The vulnerability has a CVSS 4.0 score of 5.3 (medium severity). A patch identified by commit 79b86ddcd4aefdd6941f098e35990ab397b13c72 is available to address the issue.
CVE-2026-108522 is an improper authentication vulnerability in Studio-Saelix Sencho versions 0.94.0 and 0.94.1. It affects the /api/auth/login endpoint where manipulation of the X-Forwarded-For header allows attackers to bypass authentication controls remotely. The issue arises because the login limiter trusted client-supplied X-Forwarded-For data without verifying the proxy source. A patch is available that restricts acceptance of forwarding headers to explicitly configured proxy CIDRs and adds a failed-attempt limit based on normalized account identity.
ImageMagick on Windows versions through 7.1.2-33 and 6.9.13-58 has an uncontrolled search path vulnerability in the NTGhostscriptEXE() function. This function launches the Ghostscript executable gswin64c.exe by its bare name when Ghostscript is not registered. An attacker can exploit this by placing a malicious gswin64c.exe in the working directory, causing it to be executed with ImageMagick's privileges during conversion of PDF, PostScript, or EPS files.
The MultiVendorX WordPress plugin versions up to 5.0.19 contain an incorrect authorization vulnerability that allows users with the store_owner role to modify marketplace-wide settings via a REST API endpoint. This flaw permits unauthorized changes to commission, payout, and onboarding settings by sending POST requests to the settings endpoint, bypassing proper authorization checks.
Studio-Saelix Sencho versions 0.97.0 and 0.97.1 contain a server-side request forgery (SSRF) vulnerability in the isValidRemoteUrl function of the Add Remote Node API Endpoint. This vulnerability allows an authenticated user with node-management permission to configure the node API URL to initiate server-side requests. The vulnerability has been publicly disclosed, but exploitation does not allow arbitrary internal response exfiltration. The CVSS 4.0 base score is 5.1, indicating a medium severity level.
This content is a discussion post about interviewing for a Software Engineer position on the AI Security Product team at Obsidian Security. It includes a job description and company background but does not describe any specific security vulnerability or threat.
CoreShop versions up to 1.5.5 contain an authorization bypass vulnerability in the OrderController. Authenticated customers can manipulate user-controlled IDs to act on orders belonging to other customers. This includes confirming receipt of others' orders and overwriting return tracking details by supplying crafted parameters in OrderConfirm or SendReship functions.
ConvertX versions up to 0.19.0 have an arbitrary file read vulnerability. Authenticated users can exploit this by uploading a specially crafted reStructuredText document that includes an absolute file path. The vulnerability arises because the Pandoc converter is invoked without the --sandbox flag, allowing the inclusion and reading of arbitrary server files in the conversion output.
A NULL pointer dereference vulnerability exists in the SSL_CIPHER_find() function when handling an unknown cipher ID in Microsoft software version 3.0. This can cause the affected software to crash or behave unexpectedly due to improper handling of null references.
A vulnerability exists in the TS_RESP_verify_response() function due to missing validation of ASN1_TYPE data. This issue affects Microsoft product version 3.0. No CVSS score or detailed impact information is provided. No patch or remediation details are available at this time.
A heap out-of-bounds write vulnerability exists in the BIO_f_linebuffer component affecting Microsoft product version 3.0. This flaw involves improper handling of short writes, potentially leading to memory corruption.
CVE-2025-66199 is a vulnerability in Microsoft software version 3.0 involving excessive memory allocation triggered by the TLS 1.3 CompressedCertificate feature. This flaw relates to improper handling of memory resources during TLS certificate compression, potentially leading to resource exhaustion. No CVSS score or detailed impact metrics are provided. No patch or remediation details are currently available.
CVE-2026-108708 is a missing authorization vulnerability in Wukong_HRM version 0. This flaw allows any authenticated low-privileged employee to gain HR administrator privileges improperly, enabling them to access sensitive data such as payslips, salary records, and bank cards. Additionally, they can edit bank card information and delete employees, departments, and contracts across the company.
Wukong_HRM version 0 contains an authentication bypass vulnerability in the ParamAspect component. This flaw allows unauthenticated attackers to access all HRM API endpoints by omitting the AUTH-TOKEN header. Exploitation grants attackers HR administrator privileges, enabling them to read sensitive employee data such as payslips and salary history, download attachments, and modify or delete company-wide HR records. The vulnerability has a critical CVSS 4.0 score of 9.3.