FreeBSD-SA-26:71.sound

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:71.sound Security Advisory The FreeBSD Project Topic: TOCTOU race between sound4 buffer resizing and mmap Category: core Module: sound Announced: 2026-10-14...

simple-git 3.36.0 Command Execution

simple-git versions through version 3.36.0 contain a command execution issue that bypasses unsafe operation checks through abbreviated Git long options...

PT-2026-113555

A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid Inbox-compatible JWT to execute arbitrary operating system commands as the ds service account. The Document Builder API improperly processes user-controlled...

PT-2026-113722

External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin for EC-CUBE 4 series "AmazonPay Plugin". If exploited, the user may be redirected to an arbitrary website during the ordering process. As a result, user's account information may be obtained...

PT-2026-113596

The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 8.10.2.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it...

PT-2026-113652

Akamai GPA Guardicore Platform Agent client on all platforms before 7.4 improperly validates JWT tokens used for seeding. By convincing a user to interact with a malicious link, an attacker can use a spoofed JWT token to inject arbitrary parameters into the client software, resulting in...

PT-2026-113710

The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.10.0 This is due to the wp ajax nopriv simpleform wp register AJAX action lacking any capability check for role...

PT-2026-113639

Improper neutralization of special elements in the NetBird client SSH configuration manager client/ssh/config/manager.go in NetBird versions 0.60.0 through 0.74.6 allows a malicious or compromised peer to execute arbitrary commands on other NetBird client hosts. The client writes a system-wide...

PT-2026-113693

The YITH WooCommerce Popup WordPress plugin before 1.60.0 does not check the capability of the requesting user before deleting post meta, allowing users with the Contributor role and above to delete arbitrary post meta from any post, including content owned by higher-privileged users...

PT-2026-113636

The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.4.5 via the 'Last referrers' meta box on the plugin's Overview admin page. This is due to insufficient output escaping of the visitor-supplied query string that the plugin record...

PT-2026-113629

The Avada Fusion Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.16.1 via the 'argslink target' parameter. This makes it possible for unauthenticated attackers to extract arbitrary user meta values for any user ID, including...

PT-2026-113628

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute in all versions up to, and including, 7.5.54.7212 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

PT-2026-113700

Koha is vulnerable to OS command injection in the Task Scheduler deletion path. The tools/scheduler.pl handler accepts the jobid request parameter for op=cud-delete and passes it to C4::Scheduler::remove at job without validating it. Schedule::At::remove substitutes the supplied job ID into an at...

CVE-2026-50218

Akamai GPA Guardicore Platform Agent client on all platforms before 7.4 improperly validates JWT tokens used for seeding. By convincing a user to interact with a malicious link, an attacker can use a spoofed JWT token to inject arbitrary parameters into the client software, resulting in...

PT-2026-113608

Epic Games Unreal Engine versions up to and including 5.8.0 ship with an insecure default configuration for the LaunchURL Blueprint node UKismetSystemLibrary::LaunchURL. The URL scheme filter FURLRequestFilter is empty by default, which permits all URL schemes. On Windows, this results in a call ...

PT-2026-113591

The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Privilege Escalation via Log Re-execution in all versions up to, and including, 2.10.6 The vulnerability exists because IntegrationHandler::executeWithCapture stores...

PT-2026-113553

Multiple Kasa devices contain an improper authentication vulnerability in the local device-management protocol. An unauthenticated adjacent attacker may send management instructions to an affected device without adequate authentication or authorization, allowing modification of the device state o...

PT-2026-113554

Hyland Desktop Host for Windows before 25.1.1 is vulnerable to local privilege escalation. This is caused by a privileged service running from the %PROGRAMDATA%HylandDesktopHostbin folder with weak permissions. A local user can exploit this to escalate privileges...

Bisheng has authentication bypass vulnerabilities

Overview Bisheng contains three vulnerabilities: a pre-authentication account takeover mechanism via a legacy single sign-on SSO endpoint; an Insecure Direct Object Reference IDOR vulnerability that exposes cross-user workflow data; and prior to version 2.5.0, authenticated attackers could perfor...

The Unseen Credential Surface: How AI Agents Expose Secrets

The Unseen Credential Surface: How AI Agents Expose Secrets By Haowei Ren · October 14, 2026 There is a quiet assumption behind every AI agent: that when it "just runs a command for you," it handles your credentials as carefully as a good engineer would. It does not. This is not due to malicious...