Threat Intelligence Database

CVE-2026-108539 is a use-after-free vulnerability in GPAC version 26.07.0 affecting the gf_fq_pop function in the MP4Box component. This flaw can be triggered remotely and may lead to memory corruption. Exploit code is publicly available. The vendor has not responded to the disclosure and no patch information is provided. The CVSS 4.0 score rates this vulnerability as medium severity.

CVE-2026-108538 is a use-after-free vulnerability in the GPAC multimedia framework, specifically in the function gf_mx_v within utils/os_thread.c of the MP4Box component. This vulnerability affects GPAC version 26.07 and can be exploited remotely without user interaction. The vulnerability has a medium severity score of 5.3 and public exploit code has been disclosed. The vendor has not responded to the disclosure and no official patch or remediation guidance is currently available.

CVE-2026-108523 is a server-side request forgery (SSRF) vulnerability in Studio-Saelix Sencho versions 0.94.0 and 0.94.1. It affects the git-sources Browse API Endpoint, specifically the outboundTarget.ts file, where manipulation of the repo_url argument can lead to SSRF. The vendor disputes the severity of the issue, noting that repository access is a privileged administrative function and that no privilege boundary bypass is demonstrated. The vendor has implemented hardening measures including DNS pinning, rejection of certain network targets, disabling redirects and proxy routing, and strict SSH host-key verification. The vulnerability has a CVSS 4.0 score of 5.3 (medium severity). A patch identified by commit 79b86ddcd4aefdd6941f098e35990ab397b13c72 is available to address the issue.

CVE-2026-108522 is an improper authentication vulnerability in Studio-Saelix Sencho versions 0.94.0 and 0.94.1. It arises from the login endpoint improperly trusting the client-supplied X-Forwarded-For header without a trusted proxy boundary, allowing attackers to manipulate this header to bypass authentication controls. The vulnerability can be exploited remotely. A patch is available that changes the handling of forwarding headers to accept them only from explicitly configured proxy CIDRs and adds a separate failed-attempt limit keyed by normalized account identity.

Studio-Saelix Sencho versions 0.97.0 and 0.97.1 contain a server-side request forgery (SSRF) vulnerability in the isValidRemoteUrl function of the Add Remote Node API Endpoint. This vulnerability allows an authenticated user with node-management permission to configure the node API URL and initiate server-side requests. The vulnerability has been publicly disclosed, but exploitation does not allow arbitrary internal response exfiltration. The CVSS 4.0 score is 5.1, indicating medium severity.

This content is a discussion post about interviewing for a Software Engineer position on the AI Security Product team at Obsidian Security. It includes a job description and company background but does not describe any specific security vulnerability or threat.

CoreShop versions up to 1.5.5 have an authorization bypass vulnerability in the OrderController. Authenticated customers can manipulate user-controlled IDs to act on other customers' orders, including confirming receipt and overwriting return tracking details. This allows unauthorized actions on orders that do not belong to the attacker.

ConvertX versions up to 0.19.0 have an arbitrary file read vulnerability due to the invocation of Pandoc without sandboxing. Authenticated users can exploit this by uploading a specially crafted reStructuredText document that includes an absolute file path, allowing them to read arbitrary server files in the conversion output.

CVE-2026-108708 is a missing authorization vulnerability in Wukong_HRM (WuKongOpenSource) present through commit 186115e. The flaw causes the EmployeeAspect component to assign every authenticated user the HR administrator role, and EmployeeUtil data-scope checks return all employees without restriction. This allows any authenticated low-privileged employee to access sensitive HR data including payslips, salary records, bank cards, and personal information. Additionally, such users can edit bank cards and delete employees, departments, and contracts across the company.

CVE-2026-108707 is a critical authentication bypass vulnerability in Wukong_HRM through commit 186115e. It allows unauthenticated attackers to access all HRM API endpoints by omitting the AUTH-TOKEN header. Exploitation grants HR administrator privileges, enabling attackers to read sensitive employee data, download attachments, and modify or delete company HR records.