PraisonAI's wide-open API lets attackers run OS commands, no auth required

A validation bug in Zscaler Client Connector on Android and ChromeOS lets an attacker bypass Zscaler security controls. That means traffic that should be inspected or blocked can slip through unfiltered. CVSS 8.1, so the potential impact is significant for any environment relying on Zscaler for endpoint enforcement on mobile or ChromeOS devices.

Affected estate

Anyone managing Zscaler Client Connector deployments on Android or ChromeOS devices

How to check

Check the ZCC app version on enrolled devices via your MDM console or the Zscaler admin portal under Client Connector > Enrolled Devices.

Included because

security control bypass; CVSS 8.1; affects managed endpoint fleet

Action

Push the latest Zscaler Client Connector update to all Android and ChromeOS endpoints via MDM or the Zscaler update policy.

Why it matters

An attacker can bypass Zscaler inspection and policy enforcement, leaving endpoints and traffic unprotected.

Source

Zscaler advisory

A race condition in the ZPA tunnel handler in Zscaler Client Connector can corrupt the heap, crashing the client and potentially letting an attacker run code in the ZCC process. Exploitation requires winning a race, which raises the difficulty, but a successful hit could give an attacker code execution with the privileges of the Zscaler client process. CVSS 8.1.

Affected estate

Anyone running Zscaler Client Connector with ZPA (Zscaler Private Access) tunnels enabled

How to check

Verify the installed ZCC version via `zscaler-client-connector --version` or check the Zscaler admin portal under Client Connector > Enrolled Devices.

Included because

potential code execution; heap corruption; CVSS 8.1; common enterprise VPN client

Action

Deploy the patched ZCC version from the Zscaler download portal to all endpoints.

Why it matters

A heap corruption bug in the VPN tunnel handler can crash the client or allow code execution, undermining your zero-trust connectivity.

Source

Zscaler advisory

GIMP's Paint Shop Pro (.psp) file loader has a heap buffer overflow triggered by a crafted compressed selection channel. An attacker who tricks a user into opening a malicious PSP file can crash GIMP or potentially run code. This requires user interaction: someone has to open the file. CVSS 7.8.

Affected estate

Anyone with GIMP installed, especially on workstations where users open files from external or untrusted sources

How to check

Run `gimp --version` or check Help > About in the app. Cross-reference against the GIMP security advisory for the fixed version.

Included because

code execution via file open; user interaction required; CVSS 7.8; common desktop application

Action

Update GIMP to the latest release via your package manager (apt, dnf, brew, Winget) or the official download page.

Why it matters

Opening a malicious PSP file can give an attacker code execution on the workstation.

GIMP's ICO file loader has an integer overflow when parsing an embedded PNG image, which leads to a heap buffer overflow. An attacker sends a crafted .ico file, the user opens it in GIMP, and the attacker gets a crash or code execution. User interaction is required. CVSS 7.8. ICO files are common enough (favicons, icon sets) that this could catch someone off guard.

Affected estate

Anyone with GIMP installed, particularly designers or web developers who routinely handle ICO files

How to check

Run `gimp --version` or check Help > About. Compare against the GIMP advisory for the fixed version number.

Included because

code execution via file open; user interaction required; CVSS 7.8; common desktop application

Action

Update GIMP to the latest release via your package manager or the official download page.

Why it matters

A malicious ICO file can trigger a heap overflow, potentially letting an attacker run code on the workstation.