The vulnerability of the setcred() function in the operating system kernel of FreeBSD allows a perpetrator to execute arbitrary code, increase their privileges, or cause service failures.

The vulnerability of the setcred function in the operating system kernel of FreeBSD is related to buffer overflow in the stack. Exploiting this vulnerability can allow an attacker to execute arbitrary code, increase their privileges, or cause service failures...

GHSA-FQW6-GF59-QR4W containerd user ID handling bypass allows runAsNonRoot evasion

Impact A bug was found in containerd where containers launched with a numeric User directive that cannot be parsed as a 32-bit integer are incorrectly treated as a username. If a crafted image provides an /etc/passwd file mapping this large numeric string to root, the container ultimately runs as...

containerd user ID handling bypass allows runAsNonRoot evasion

Impact A bug was found in containerd where containers launched with a numeric User directive that cannot be parsed as a 32-bit integer are incorrectly treated as a username. If a crafted image provides an /etc/passwd file mapping this large numeric string to root, the container ultimately runs as...

GHSA-RQ6V-X3J8-7QGF Amazon SageMaker Python SDK is missing integrity verification in its Triton inference handler

Summary Amazon SageMaker Python SDK is an open-source library for training and deploying machine learning models on Amazon SageMaker. An issue exists where, under certain circumstances, the Triton inference handler deserializes model artifacts without performing integrity verification, allowing...

Amazon SageMaker Python SDK is missing integrity verification in its Triton inference handler

Summary Amazon SageMaker Python SDK is an open-source library for training and deploying machine learning models on Amazon SageMaker. An issue exists where, under certain circumstances, the Triton inference handler deserializes model artifacts without performing integrity verification, allowing...

Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK ModelBuilder/Serve path

Summary Amazon SageMaker Python SDK is an open-source library for training and deploying machine learning models on Amazon SageMaker. An issue exists where, under certain circumstances, the ModelBuilder/Serve component stores an HMAC signing key in cleartext as a container environment variable,...

GHSA-7HH5-PRP2-MFH5 Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK ModelBuilder/Serve path

Summary Amazon SageMaker Python SDK is an open-source library for training and deploying machine learning models on Amazon SageMaker. An issue exists where, under certain circumstances, the ModelBuilder/Serve component stores an HMAC signing key in cleartext as a container environment variable,...

Wordfence Intelligence Weekly WordPress Vulnerability Report (May 11, 2026 to May 17, 2026)

Last week, there were 78 vulnerabilities disclosed in 62 WordPress Plugins and 2 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 59 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities i...

MAL-2026-4703 Malicious code in veteran (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 70a20dd9f8d6a9df01d766c25693711d90e4303e3c68fa371f0b842f83c485b4 On npm install, the package's postinstall hook install.js, registered via package.json line 10 "postinstall": "node install.js" downloads a...

Malicious code in veteran (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 70a20dd9f8d6a9df01d766c25693711d90e4303e3c68fa371f0b842f83c485b4 On npm install, the package's postinstall hook install.js, registered via package.json line 10 "postinstall": "node install.js" downloads a...

gdal:s101_fuzzer: Heap-buffer-overflow in DDFSubfieldDefn::GetDataLength

Project: https://github.com/OSGeo/gdal.git Detailed Report: https://oss-fuzz.com/testcase?key=6679072620216320 Project: gdal Fuzzing Engine: afl Fuzz Target: s101fuzzer Job Type: aflasangdal Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x77c5c9ce0f00 Crash State:...

openbabel:fuzz_convert: Stack-buffer-overflow in OpenBabel::MCDLFormat::getMCDL

Project: https://github.com/openbabel/openbabel.git Detailed Report: https://oss-fuzz.com/testcase?key=4918021742460928 Project: openbabel Fuzzing Engine: afl Fuzz Target: fuzzconvert Job Type: aflasanopenbabel Platform Id: linux Crash Type: Stack-buffer-overflow WRITE 4 Crash Address:...

PT-2026-42689

Name of the Vulnerable Software and Affected Versions js-cookie versions prior to 3.0.7 Description The internal assign function copies properties using a for...in loop and plain assignment. When a source object is created via JSON.parse, the proto member is treated as an own enumerable property...

PT-2026-42691

Name of the Vulnerable Software and Affected Versions Twig versions 3.24.0 through 3.24.x Description The object-destructuring assignment syntax generates a call to the getAttribute function within CoreExtension where the $sandboxed argument is hardcoded to false. This occurs regardless of whethe...

PT-2026-45158

Name of the Vulnerable Software and Affected Versions Twig affected versions not specified Description SandboxNodeVisitor fails to fully enforce SecurityPolicy::checkMethodAllowed for implicit toString calls because the set of wrapped AST nodes in CheckToStringNode is incomplete. This allows a...

PT-2026-42440

Name of the Vulnerable Software and Affected Versions Honeywell Control Network Module CNM versions 100.1, 101.1, 110.1, and 110.2 Description The web interface contains a command injection flaw. An attacker can use command delimiters to execute arbitrary commands, which may lead to Remote Code...

PT-2026-42397

Name of the Vulnerable Software and Affected Versions FreeBSD libcasper3 affected versions not specified Description libcasper3 communicates with helper processes via UNIX domain sockets and utilizes the select2 system call to wait for available data. The software fails to verify if the socket...

PT-2026-42656

Name of the Vulnerable Software and Affected Versions UniFi OS affected versions not specified Description An improper input validation issue in UniFi OS allows a malicious actor with network access and high privileges to execute a command injection. Approximately 100,000 UniFi endpoints are...

PT-2026-42400

Name of the Vulnerable Software and Affected Versions fusefs affected versions not specified Description When a fusefs file system implements extended attributes, the kernel may send a FUSE LISTXATTR message to the userspace daemon to retrieve the list of extended attributes for a file. The FUSE...

PT-2026-42403

Name of the Vulnerable Software and Affected Versions FreeBSD bsdinstall/bsdconfig affected versions not specified Description When bsdinstall or bsdconfig are prompted to scan for nearby Wi-Fi networks, they compile a list of network names and use the bsddialog1 function to prompt the user for...