Threat Intelligence Database

CVE-2026-91091 is a medium severity memory corruption vulnerability in the GPAC software, specifically in the function gf_node_list_insert_child within the Node Insertion component. This vulnerability affects GPAC versions up to commit f1219cde. The flaw allows remote attackers to cause memory corruption, and public exploit code is available. The issue is resolved by upgrading to GPAC version abi-16.23.

Cisco has released a patch for a critical zero-day vulnerability in its Secure Email Gateway product that has been actively exploited by threat actors. Customers are urged to apply the patch promptly to mitigate the risk. No detailed technical information or CVSS score is available at this time.

CVE-2026-91090 is a stack-based buffer overflow vulnerability in the GPAC multimedia framework affecting the function gf_node_activate_ex in scenegraph/base_scenegraph.c. The issue affects GPAC versions up to commit f1219cde. Exploitation requires local access and involves low complexity with limited privileges. The vulnerability has a low CVSS score of 2.4. Upgrading to version abi-16.23 resolves the issue.

CVE-2026-91089 is a use-after-free vulnerability in the GPAC multimedia framework affecting the function gf_node_get_name_and_id in scenegraph/base_scenegraph.c. This vulnerability allows remote attackers to exploit the flaw, potentially leading to memory corruption. An exploit has been publicly disclosed. The issue is addressed by upgrading to GPAC version abi-16.23, which contains the patch identified by commit 49dee5cad329cfed310c1682703df7daa47df31a.

CVE-2026-91778 is a high-severity vulnerability in Octopus Deploy's Octopus Server where users with certain scoped permissions can execute arbitrary scripts on a worker without proper authorization. This occurs due to incorrect permission validation during script execution, allowing actions beyond the user's intended privileges.

The Job Postings plugin for WordPress, developed by blueglassch, contains a stored cross-site scripting (XSS) vulnerability in the 'position_button' parameter. This affects all versions up to and including 2.8.1. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises from insufficient input sanitization and output escaping.

CVE-2026-91088 is a heap-based buffer overflow vulnerability in the GPAC project's URL Handler component, specifically in the gf_url_concatenate_ex function of utils/url.c. This vulnerability affects GPAC versions up to commit f1219cde. Exploitation requires local access with low privileges and user interaction. The issue is addressed by upgrading to GPAC version abi-16.23.

CVE-2026-91087 is a use-after-free vulnerability in the GPAC multimedia framework affecting the gf_mo_get_od_id function in compositor/media_object.c. This flaw can be triggered remotely and may lead to memory corruption. An exploit is publicly available. The issue is resolved by upgrading to GPAC version abi-16.24.

CVE-2026-91086 is a heap-based buffer overflow vulnerability in the GPAC MPEG Video Reframer component, specifically in the mpgviddmx_process function. This vulnerability affects GPAC versions up to commit f1219cde. The flaw can be exploited remotely and has been publicly disclosed. A patch is available in version abi-16.23, which addresses this issue. Users are advised to upgrade to this version to mitigate the risk.

CVE-2026-91005 is a medium severity vulnerability in SourceCodester Online Faculty Clearance System version 1.0. It involves an unrestricted file upload flaw in the move_uploaded_file function within production/edit_picture.php, allowing remote attackers to upload arbitrary files. An exploit for this vulnerability has been publicly disclosed.