Weekly briefing

SecurityAdvanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Non-Administrator Account Takeover via Front-End User Update Action

SecurityAdvanced Custom Fields: Extended < 0.9.2.8 - Unauthenticated RCE via Front-End Post Update Action

SecurityAesGcmCryptor.Open passes attacker-controlled nonce to cipher.AEAD.Open without length check, causing panic on wrong-size IV

SecurityAider through 0.86.2 Command Execution via Repository .aider.conf.yml Settings

SecurityAn OS command injection vulnerability in the /htdocs/web/diagnostic.php endpoint of D-Link DAP1160L A1_FW101WWb04 allows attackers to execute arbitrary commands via injecting arbitrary shell metacharacters.

SecurityAn issue in @justice8096/sagemath-mcp-server 1.0.1 allows a remote attacker to execute arbitrary code via the escapeShellString and sanitizeCode functions.

SecurityAn issue in @rog0x/mcp-docker-tools 1.0.1 allows a remote attacker to execute arbitrary code via the handleImageList function.

SecurityAn issue in @rog0x/mcp-git-tools 1.0.1 allows a remote attacker to execute arbitrary code via the resolveBaseBranch function.

SecurityAn issue in Nitro Software, Inc Nitro PDF Pro for macOS v.14.7 allows a local attacker to execute arbitrary code via a crafted PDF

SecurityAnti-Spam by CleanTalk <= 6.89.1 - Unauthenticated Stored Cross-Site Scripting via 'user_email' Registration Parameter

SecurityAuthentication Bypass via IP Spoofing in CGM CLININET rsyncd

SecurityAuthentication Source Verification Issue in Okta Access Gateway

SecurityAutotune: kruize/autotune: kruize/autotune: datasources credential disclosure

SecurityBaserow 2.2.0 through 2.3.3 - SQL injection in formula index() JSONB array extraction2 source records

Advisory content revised · 2 entries

• Baserow 2.2.0 through 2.3.3 - SQL injection in formula index() JSONB array extraction

  Advisory content revised

  CVE-2026-19754

  Assessment context

  Advisory content revised; observed by ChangeIntel, not the original publication date.

• Baserow 2.2.0 through 2.3.3 - SQL injection in formula index() JSONB array extraction

  Advisory content revised

  CVE-2026-19754

  Assessment context

  Advisory content revised; observed by ChangeIntel, not the original publication date.

SecurityBlueSpiceUserManager: Missing authorization in REST endpoints for blocking and unblocking users

SecurityBluetooth: ISO: Reject concurrent BIS listener setup

SecurityBluetooth: ISO: Serialize concurrent connect calls

SecurityBluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown

SecurityBluetooth: RFCOMM: connect the session socket without rfcomm_mutex

SecurityBluetooth: RFCOMM: free the skb when the DLC has no owner

SecurityBluetooth: SCO: serialise sco_conn lifetime against sco_recv_scodata()

SecurityBluetooth: hci_sock: Serialize dead-device detachment

SecurityBluetooth: hci_sync: Fix command skb lifetime during scan setup

SecurityCacti: Authenticated RCE on Data Input