{"lastUpdated":"2026-10-13T02:20:21.800Z","sourceStatus":{"CISA KEV":{"last_success":"2026-10-13T02:10:26.861Z","last_attempt":"2026-10-13T02:10:26.861Z","error":null,"in_progress":false},"NVD":{"last_success":"2026-10-13T01:20:27.019Z","last_attempt":"2026-10-13T01:20:27.019Z","error":null,"in_progress":false},"GitHub Advisories":{"last_success":"2026-10-13T02:20:21.800Z","last_attempt":"2026-10-13T02:20:21.800Z","error":null,"in_progress":false},"CERT/CC":{"last_success":"2026-10-13T02:10:26.630Z","last_attempt":"2026-10-13T02:10:26.630Z","error":null,"in_progress":false},"SecurityWeek":{"last_success":"2026-10-13T02:10:26.699Z","last_attempt":"2026-10-13T02:10:26.699Z","error":null,"in_progress":false},"The Hacker News":{"last_success":"2026-10-13T02:10:26.995Z","last_attempt":"2026-10-13T02:10:26.995Z","error":null,"in_progress":false},"Krebs on Security":{"last_success":"2026-10-13T02:10:26.716Z","last_attempt":"2026-10-13T02:10:26.716Z","error":null,"in_progress":false},"CyberScoop":{"last_success":"2026-10-13T02:10:26.785Z","last_attempt":"2026-10-13T02:10:26.785Z","error":null,"in_progress":false},"CVEProject":{"last_success":"2026-10-13T00:30:46.008Z","last_attempt":"2026-10-13T01:00:45.574Z","error":null,"in_progress":true},"EPSS":{"last_success":"2026-10-12T21:50:25.867Z","last_attempt":"2026-10-13T02:20:27.203Z","error":null,"in_progress":true}},"filters":{"source":"","category":"","vendor":"","search":""},"count":1000,"totalMatching":4182,"articles":[{"id":"CVE-2026-87689","title":"CVE-2026-87689 — The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store through Msf::WebServi","summary":"The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store through Msf::WebServices::CredentialServlet. Every mutating and read route in this servlet calls warden.authenticate! before processing a request, except the update_credential (PUT) and delete_credentials (DELETE) handlers for /api/v1/credentials, which omit the authentication call entirely. Because these handlers call directly into lib/msf/core/db_manager/cred.rb, which performs no authorization check of its own, any client able to reach the web service on its default 0.0.0.0:8080 listener can read, modify, or permanently delete every stored credential record — including passwords, hashes, and private keys stored for a shared team engagement — without presenting any authentication. All published versions of Metasploit Framework through 6.5.4 are affected.","source":"CVEProject","date":"2026-10-13T00:53:00.847Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-87689","topic":"New vulnerabilities","affected":[{"vendor":"Rapid7","product":"Metasploit Framework"}],"aliases":["CVE-2026-87689"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-87689"],"sources":["CVEProject"],"topics":["New vulnerabilities"],"references":[{"source":"CVEProject","url":"https://www.cve.org/CVERecord?id=CVE-2026-87689"}],"epss":null},{"id":"CVE-2026-108945","title":"CVE-2026-108945 — A vulnerability was detected in iMoonLab yolov13 up to 73289949533efac82bb5f72ec19b746618656bd2. Affected","summary":"A vulnerability was detected in iMoonLab yolov13 up to 73289949533efac82bb5f72ec19b746618656bd2. Affected by this issue is the function eval of the file ultralytics/nn/autobackend.py of the component AutoBackend Model Loading. Performing a manipulation of the argument imgsz/names/kpt_shape results in code injection. The attack must be initiated from a local position. The project was informed of the problem early through an issue report but has not responded yet.","source":"CVEProject","date":"2026-10-13T00:45:11.214Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-108945","topic":"New vulnerabilities","affected":[{"vendor":"iMoonLab","product":"yolov13"}],"aliases":["CVE-2026-108945"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-108945"],"sources":["CVEProject"],"topics":["New vulnerabilities"],"references":[{"source":"CVEProject","url":"https://www.cve.org/CVERecord?id=CVE-2026-108945"}],"epss":null},{"id":"CVE-2026-108944","title":"CVE-2026-108944 — A security vulnerability has been detected in repository RAE up to a4d18c4db766419cbe7cb8c02cd9f7ceb0ec90","summary":"A security vulnerability has been detected in repository RAE up to a4d18c4db766419cbe7cb8c02cd9f7ceb0ec9041. Affected by this vulnerability is the function get_obj_from_str of the file src/utils/model_utils.py of the component Config-Driven Model Instantiation. Such manipulation of the argument Target leads to code injection. The attack must be carried out locally. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.","source":"CVEProject","date":"2026-10-13T00:30:43.395Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-108944","topic":"New vulnerabilities","affected":[{"vendor":"repository","product":"RAE"}],"aliases":["CVE-2026-108944"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-108944"],"sources":["CVEProject"],"topics":["New vulnerabilities"],"references":[{"source":"CVEProject","url":"https://www.cve.org/CVERecord?id=CVE-2026-108944"}],"epss":null},{"id":"CVE-2026-89117","title":"CVE-2026-89117 — SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL","summary":"SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed in a user's browser when the crafted URL is visited, leading to theft of session information, manipulation of portal content, or user redirection. This results in a low impact on confidentiality and integrity. There is no impact on availability.","source":"CVEProject","date":"2026-10-13T00:26:50.732Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-89117","topic":"New vulnerabilities","affected":[{"vendor":"SAP_SE","product":"SAP NetWeaver Enterprise Portal"}],"aliases":["CVE-2026-89117"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-89117"],"sources":["CVEProject"],"topics":["New vulnerabilities"],"references":[{"source":"CVEProject","url":"https://www.cve.org/CVERecord?id=CVE-2026-89117"}],"epss":null},{"id":"CVE-2026-89116","title":"CVE-2026-89116 — The affected code used child_process.execSync with a shell string for generator installation and uninstal","summary":"The affected code used child_process.execSync with a shell string for generator installation and uninstallation. This allowed an attacker to execute arbitrary OS commands with the developer's privileges by manipulating the ApplicationWizard.installationLocation VS Code workspace configuration value. Because the value was passed directly to the shell without sanitisation, a malicious workspace repository could craft a settings.json that injects OS commands when a developer opens the project and triggers a generator installation.","source":"CVEProject","date":"2026-10-13T00:26:39.614Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-89116","topic":"New vulnerabilities","affected":[{"vendor":"SAP_SE","product":"SAP yeoman-ui"}],"aliases":["CVE-2026-89116"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-89116"],"sources":["CVEProject"],"topics":["New vulnerabilities"],"references":[{"source":"CVEProject","url":"https://www.cve.org/CVERecord?id=CVE-2026-89116"}],"epss":null},{"id":"CVE-2026-89113","title":"CVE-2026-89113 — SAP Commerce Cloud does not sufficiently validate certain user-supplied input before it is incorporated i","summary":"SAP Commerce Cloud does not sufficiently validate certain user-supplied input before it is incorporated into a database query. An authenticated user could send specially crafted requests to affected functionality to inject arbitrary SQL commands. Successful exploitation could allow the user to read, modify or delete sensitive data from the application's database, resulting in a high impact on confidentiality, integrity and availability of the application.","source":"CVEProject","date":"2026-10-13T00:26:24.587Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-89113","topic":"New vulnerabilities","affected":[{"vendor":"SAP_SE","product":"SAP Commerce Cloud (OOTB Code)"}],"aliases":["CVE-2026-89113"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-89113"],"sources":["CVEProject"],"topics":["New vulnerabilities"],"references":[{"source":"CVEProject","url":"https://www.cve.org/CVERecord?id=CVE-2026-89113"}],"epss":null},{"id":"CVE-2026-89112","title":"CVE-2026-89112 — The admin API endpoint used to retrieve CLA signature records does not consistently enforce the required ","summary":"The admin API endpoint used to retrieve CLA signature records does not consistently enforce the required authorization checks when the target organisation is specified using an organisation ID.An authenticated user with limited privileges could potentially access CLA signature records containing contributor information belonging to an organisation they are not authorized to administer.","source":"CVEProject","date":"2026-10-13T00:26:06.824Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-89112","topic":"New vulnerabilities","affected":[{"vendor":"SAP_SE","product":"CLA-Assistant"}],"aliases":["CVE-2026-89112"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-89112"],"sources":["CVEProject"],"topics":["New vulnerabilities"],"references":[{"source":"CVEProject","url":"https://www.cve.org/CVERecord?id=CVE-2026-89112"}],"epss":null},{"id":"CVE-2026-89111","title":"CVE-2026-89111 — The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP application","summary":"The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated.","source":"CVEProject","date":"2026-10-13T00:24:28.269Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-89111","topic":"New vulnerabilities","affected":[{"vendor":"SAP_SE","product":"SAP Cloud"}],"aliases":["CVE-2026-89111"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-89111"],"sources":["CVEProject"],"topics":["New vulnerabilities"],"references":[{"source":"CVEProject","url":"https://www.cve.org/CVERecord?id=CVE-2026-89111"}],"epss":null},{"id":"CVE-2026-89110","title":"CVE-2026-89110 — SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal function","summary":"SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. An attacker with low privileges could invoke internal operations on a preconfigured remote system. Depending on the remote connection configuration, this could lead to a full compromise of the remote system. This results in a high impact on confidentiality, integrity and availability.","source":"CVEProject","date":"2026-10-13T00:24:17.290Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-89110","topic":"New vulnerabilities","affected":[{"vendor":"SAP_SE","product":"SAP NetWeaver Visual Composer"}],"aliases":["CVE-2026-89110"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-89110"],"sources":["CVEProject"],"topics":["New vulnerabilities"],"references":[{"source":"CVEProject","url":"https://www.cve.org/CVERecord?id=CVE-2026-89110"}],"epss":null},{"id":"CVE-2026-89108","title":"CVE-2026-89108 — SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries wit","summary":"SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative functionality. An attacker with MII administrator privileges could submit a specially crafted request to provision an account with elevated privileges on the underlying Java application server. Successful exploitation could allow the attacker to gain administrative control over the underlying system, extending the impact beyond the vulnerable application. This results in a high impact on confidentiality, integrity and availability.","source":"CVEProject","date":"2026-10-13T00:24:05.048Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-89108","topic":"New vulnerabilities","affected":[{"vendor":"SAP_SE","product":"SAP Manufacturing Integration and Intelligence (Configuration Service)"}],"aliases":["CVE-2026-89108"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-89108"],"sources":["CVEProject"],"topics":["New vulnerabilities"],"references":[{"source":"CVEProject","url":"https://www.cve.org/CVERecord?id=CVE-2026-89108"}],"epss":null},{"id":"CVE-2026-89107","title":"CVE-2026-89107 — SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validate input processed by rule","summary":"SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validate input processed by rule definition functionality that utilizes a domain-specific scripting language. An authenticated attacker with specific business privileges could submit specially crafted input, which is interpreted as executable ABAP code by the rule processing logic. Successful exploitation could allow the attacker to execute ABAP arbitrary code into the system, resulting in full compromise of the affected system and high impact on confidentiality, integrity, and availability of the system.","source":"CVEProject","date":"2026-10-13T00:23:52.510Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-89107","topic":"New vulnerabilities","affected":[{"vendor":"SAP_SE","product":"SAP S/4HANA (Manage Substitution/Validation Rules)"}],"aliases":["CVE-2026-89107"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-89107"],"sources":["CVEProject"],"topics":["New vulnerabilities"],"references":[{"source":"CVEProject","url":"https://www.cve.org/CVERecord?id=CVE-2026-89107"}],"epss":null},{"id":"CVE-2026-89106","title":"CVE-2026-89106 — SAP UI5 does not perform sufficient input validation under certain configurations. An attacker with low p","summary":"SAP UI5 does not perform sufficient input validation under certain configurations. An attacker with low privileges could submit specially crafted content that is later rendered in a victim's browser. This vulnerability has a low impact on confidentiality and integrity. There is no impact on availability.","source":"CVEProject","date":"2026-10-13T00:23:40.341Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-89106","topic":"New vulnerabilities","affected":[{"vendor":"SAP_SE","product":"SAPUI5"}],"aliases":["CVE-2026-89106"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-89106"],"sources":["CVEProject"],"topics":["New vulnerabilities"],"references":[{"source":"CVEProject","url":"https://www.cve.org/CVERecord?id=CVE-2026-89106"}],"epss":null},{"id":"CVE-2026-89105","title":"CVE-2026-89105 — The HybridTokenAuthenticator component of the SAP/cloud-security-services-integration-library accepts tok","summary":"The HybridTokenAuthenticator component of the SAP/cloud-security-services-integration-library accepts tokens from unintended ambient IAS/XSUAA bindings, potentially allowing unauthorized access. This vulnerability allows an attacker to gain unauthorized access to the system by using tokens that should not be accepted, leading to a breach of security.","source":"CVEProject","date":"2026-10-13T00:23:29.772Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-89105","topic":"New vulnerabilities","affected":[{"vendor":"SAP_SE","product":"SAP/cloud-security-services-integration-library"}],"aliases":["CVE-2026-89105"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-89105"],"sources":["CVEProject"],"topics":["New vulnerabilities"],"references":[{"source":"CVEProject","url":"https://www.cve.org/CVERecord?id=CVE-2026-89105"}],"epss":null},{"id":"CVE-2026-76976","title":"CVE-2026-76976 — Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP do not sufficiently sanit","summary":"Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP do not sufficiently sanitize user-supplied content in certain functionality, allowing an authenticated attacker to send malicious content to another user. If the victim interacts with the affected content, malicious scripts could be executed in the victim's browser context. This vulnerability has a low impact on the confidentiality and integrity of the data and no impact on the availability of the application.","source":"CVEProject","date":"2026-10-13T00:23:12.283Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-76976","topic":"New vulnerabilities","affected":[{"vendor":"SAP_SE","product":"SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML)"}],"aliases":["CVE-2026-76976"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-76976"],"sources":["CVEProject"],"topics":["New vulnerabilities"],"references":[{"source":"CVEProject","url":"https://www.cve.org/CVERecord?id=CVE-2026-76976"}],"epss":null},{"id":"CVE-2026-76975","title":"CVE-2026-76975 — Due to a DOM-Based Cross-Site Scripting (XSS) vulnerability, an unauthenticated attacker could generate a","summary":"Due to a DOM-Based Cross-Site Scripting (XSS) vulnerability, an unauthenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated user accesses this link, client-side code reads the attacker-controlled input and writes it into the DOM without proper sanitization, causing attacker-supplied script to execute in the victim�s browser context. This could allow the attacker to access or modify information within the victim�s browser scope, impacting confidentiality and integrity, while availability remains unaffected.","source":"CVEProject","date":"2026-10-13T00:22:58.885Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-76975","topic":"New vulnerabilities","affected":[{"vendor":"SAP_SE","product":"SAPUI5 (Support Assistant Overlay)"}],"aliases":["CVE-2026-76975"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-76975"],"sources":["CVEProject"],"topics":["New vulnerabilities"],"references":[{"source":"CVEProject","url":"https://www.cve.org/CVERecord?id=CVE-2026-76975"}],"epss":null},{"id":"CVE-2026-76972","title":"CVE-2026-76972 — Due to a Cross-Site Scripting (XSS) vulnerability in SAP Manufacturing Integration and Intelligence, an a","summary":"Due to a Cross-Site Scripting (XSS) vulnerability in SAP Manufacturing Integration and Intelligence, an attacker could store malicious content that is later rendered by the application. If an authenticated victim accesses a page that displays this stored content, the injected input is processed during web page generation, resulting in the execution of malicious content in the victim�s browser context. This could allow the attacker to access or modify information within the victim�s browser scope. Successful exploitation could allow the attacker to access session information, modify rendered page content and disrupt the victim's use of the application, resulting in a low impact on confidentiality, integrity and availability.","source":"CVEProject","date":"2026-10-13T00:22:44.389Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-76972","topic":"New vulnerabilities","affected":[{"vendor":"SAP_SE","product":"SAP Manufacturing Integration and Intelligence"}],"aliases":["CVE-2026-76972"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-76972"],"sources":["CVEProject"],"topics":["New vulnerabilities"],"references":[{"source":"CVEProject","url":"https://www.cve.org/CVERecord?id=CVE-2026-76972"}],"epss":null},{"id":"CVE-2026-58249","title":"CVE-2026-58249 — SAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in specially crafted request","summary":"SAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in specially crafted requests handled by an internal protocol component. An unauthenticated attacker could send a malicious request that triggers a memory-handling error, causing the affected process to crash. Successful exploitation can therefore result in a high impact on the availability of the affected application. There is no impact on the confidentiality or integrity of the application.","source":"CVEProject","date":"2026-10-13T00:22:31.616Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-58249","topic":"New vulnerabilities","affected":[{"vendor":"SAP_SE","product":"SAP NetWeaver and SAP Web Dispatcher (Internet Communication Manager)"}],"aliases":["CVE-2026-58249"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-58249"],"sources":["CVEProject"],"topics":["New vulnerabilities"],"references":[{"source":"CVEProject","url":"https://www.cve.org/CVERecord?id=CVE-2026-58249"}],"epss":null},{"id":"CVE-2026-58242","title":"CVE-2026-58242 — SAP Cloud Connector contains an improper authorization check, which could be exploited by a low-privilege","summary":"SAP Cloud Connector contains an improper authorization check, which could be exploited by a low-privileged attacker through specially crafted requests. Exploitation requires the attacker to be on an adjacent network. Successful exploitation could allow the attacker to obtain limited information about internal systems, resulting in low impact on confidentiality. There is no impact on integrity and availability.","source":"CVEProject","date":"2026-10-13T00:22:03.970Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-58242","topic":"New vulnerabilities","affected":[{"vendor":"SAP_SE","product":"SAP Cloud Connector"}],"aliases":["CVE-2026-58242"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-58242"],"sources":["CVEProject"],"topics":["New vulnerabilities"],"references":[{"source":"CVEProject","url":"https://www.cve.org/CVERecord?id=CVE-2026-58242"}],"epss":null},{"id":"CVE-2026-108943","title":"CVE-2026-108943 — A weakness has been identified in ModelTC LightX2V up to 0.5.0. Affected is the function AutoTokenizer.fr","summary":"A weakness has been identified in ModelTC LightX2V up to 0.5.0. Affected is the function AutoTokenizer.from_pretrained of the file lightx2v/models/runners/cosmos3/cosmos3_runner.py of the component Tokenizer. This manipulation of the argument auto_map causes code injection. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.","source":"CVEProject","date":"2026-10-13T00:15:19.805Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-108943","topic":"New vulnerabilities","affected":[{"vendor":"ModelTC","product":"LightX2V"}],"aliases":["CVE-2026-108943"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-108943"],"sources":["CVEProject"],"topics":["New vulnerabilities"],"references":[{"source":"CVEProject","url":"https://www.cve.org/CVERecord?id=CVE-2026-108943"}],"epss":null},{"id":"CVE-2026-108942","title":"CVE-2026-108942 — A security flaw has been discovered in philz1337x clarity-upscaler up to cfbdb842c6c839c8e97741722b8cf9a4","summary":"A security flaw has been discovered in philz1337x clarity-upscaler up to cfbdb842c6c839c8e97741722b8cf9a4b7662d98. This impacts the function create_html_for_item of the file modules/ui_extra_networks.py of the component Extra Networks Card Rendering. The manipulation of the argument Description results in cross site scripting. The attack can be executed remotely. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. All versions in the repository are affected, as the codebase is based on AUTOMATIC1111/stable-diffusion-webui v1.7.0 code. Upstream AUTOMATIC1111/stable-diffusion-webui (v1.8.0, released March 1, 2024) contains the fix. The project was informed of the problem early through an issue report but has not responded yet.","source":"CVEProject","date":"2026-10-13T00:00:13.139Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-108942","topic":"New vulnerabilities","affected":[{"vendor":"philz1337x","product":"clarity-upscaler"}],"aliases":["CVE-2026-108942"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-108942"],"sources":["CVEProject"],"topics":["New vulnerabilities"],"references":[{"source":"CVEProject","url":"https://www.cve.org/CVERecord?id=CVE-2026-108942"}],"epss":null},{"id":"CVE-2026-108941","title":"CVE-2026-108941 — A vulnerability was identified in Linketic CityGaussian up to 2.0. This affects the function parse_cfg_ar","summary":"A vulnerability was identified in Linketic CityGaussian up to 2.0. This affects the function parse_cfg_args of the file internal/utils/common.py of the component Sidecar Parsing. The manipulation of the argument cfg_args leads to code injection. The attack can only be performed from a local environment. The project was informed of the problem early through an issue report but has not responded yet.","source":"CVEProject","date":"2026-10-12T23:45:18.670Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-108941","topic":"New vulnerabilities","affected":[{"vendor":"Linketic","product":"CityGaussian"}],"aliases":["CVE-2026-108941"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-108941"],"sources":["CVEProject"],"topics":["New vulnerabilities"],"references":[{"source":"CVEProject","url":"https://www.cve.org/CVERecord?id=CVE-2026-108941"}],"epss":null},{"id":"CVE-2026-93892","title":"CVE-2026-93892 — IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtai","summary":"IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to exposure of session tokens in the HTML response.","source":"NVD","date":"2026-10-12T23:17:45.797Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93892","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-93892"],"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-93892"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93892"}],"epss":null},{"id":"CVE-2026-93891","title":"CVE-2026-93891 — IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtai","summary":"IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection flaw.","source":"NVD","date":"2026-10-12T23:17:45.663Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93891","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-93891"],"cvss":{"score":7.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-93891"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93891"}],"epss":null},{"id":"CVE-2026-92832","title":"CVE-2026-92832 — IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker to obtain sensitive inform","summary":"IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker to obtain sensitive information due to cleartext transmission of sensitive information.","source":"NVD","date":"2026-10-12T23:17:45.533Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92832","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-92832"],"cvss":{"score":5.1,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-92832"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92832"}],"epss":null},{"id":"CVE-2026-85457","title":"CVE-2026-85457 — IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to execute arbitrary code","summary":"IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow.","source":"NVD","date":"2026-10-12T23:17:45.167Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85457","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-85457"],"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-85457"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85457"}],"epss":null},{"id":"CVE-2026-84418","title":"CVE-2026-84418 — IBM DataStage on Cloud Pak for Data 5.4.0.0 can allow a man-in-the-middle attacker to present a forged TL","summary":"IBM DataStage on Cloud Pak for Data 5.4.0.0 can allow a man-in-the-middle attacker to present a forged TLS certificate, intercept the connection, and capture the IAM bearer Authorization header automatically attached by the session adapter. The captured token grants full platform-scope tenant API access, enabling the attacker to read and manipulate the victim's DataStage projects, flows, assets, and pipeline definitions. This is client-side SDK code running on the user's own machine, so exploitation requires an external network interceptor rather than a co-tenant in the shared cluster.","source":"NVD","date":"2026-10-12T23:17:45.013Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84418","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-84418"],"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-84418"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84418"}],"epss":null},{"id":"CVE-2026-82110","title":"CVE-2026-82110 — IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitr","summary":"IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of pathname during a path traversal.","source":"NVD","date":"2026-10-12T23:17:42.533Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82110","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-82110"],"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-82110"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82110"}],"epss":null},{"id":"CVE-2026-82108","title":"CVE-2026-82108 — IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitr","summary":"IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.","source":"NVD","date":"2026-10-12T23:17:42.317Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82108","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-82108"],"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-82108"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82108"}],"epss":null},{"id":"CVE-2026-82103","title":"CVE-2026-82103 — IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensiti","summary":"IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an exposure of sensitive information to an unauthorized actor.","source":"NVD","date":"2026-10-12T23:17:42.110Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82103","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-82103"],"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-82103"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82103"}],"epss":null},{"id":"CVE-2026-82101","title":"CVE-2026-82101 — IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial","summary":"IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service due to a path traversal vulnerability.","source":"NVD","date":"2026-10-12T23:17:41.897Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82101","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-82101"],"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-82101"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82101"}],"epss":null},{"id":"CVE-2026-82096","title":"CVE-2026-82096 — IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitr","summary":"IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.","source":"NVD","date":"2026-10-12T23:17:41.680Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82096","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-82096"],"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-82096"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82096"}],"epss":null},{"id":"CVE-2026-75782","title":"CVE-2026-75782 — IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker to gain elevated privilege","summary":"IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker to gain elevated privileges due to a misconfigured PATH environment variable.","source":"NVD","date":"2026-10-12T23:17:39.000Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75782","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-75782"],"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-75782"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75782"}],"epss":null},{"id":"CVE-2026-75621","title":"CVE-2026-75621 — IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker to obtain sensitive inform","summary":"IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker to obtain sensitive information due to excessive permissions assigned to a service account.","source":"NVD","date":"2026-10-12T23:17:38.797Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75621","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-75621"],"cvss":{"score":6.2,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-75621"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75621"}],"epss":null},{"id":"CVE-2026-75095","title":"CVE-2026-75095 — IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a remote attacker to cause a denial of serv","summary":"IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.","source":"NVD","date":"2026-10-12T23:17:38.630Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75095","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-75095"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-75095"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75095"}],"epss":null},{"id":"CVE-2026-75076","title":"CVE-2026-75076 — IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a remote attacker to obtain sensitive infor","summary":"IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a remote attacker to obtain sensitive information due to the exposure of JavaScript source map files.","source":"NVD","date":"2026-10-12T23:17:38.500Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75076","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-75076"],"cvss":{"score":4.3,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-75076"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75076"}],"epss":null},{"id":"CVE-2026-75063","title":"CVE-2026-75063 — IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to execute arbitrary Java","summary":"IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to execute arbitrary JavaScript due to improper output encoding.","source":"NVD","date":"2026-10-12T23:17:38.373Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75063","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-75063"],"cvss":{"score":5.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-75063"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75063"}],"epss":null},{"id":"CVE-2026-75061","title":"CVE-2026-75061 — IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to traverse directories on the system. ","summary":"IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing \"dot dot\" sequences (/../) to write arbitrary files on the system.","source":"NVD","date":"2026-10-12T23:17:38.223Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75061","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-75061"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-75061"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75061"}],"epss":null},{"id":"CVE-2026-19627","title":"CVE-2026-19627 — IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to read arbitrary host files and overwr","summary":"IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to read arbitrary host files and overwrite certain application files due to improper validation of file paths.","source":"NVD","date":"2026-10-12T23:17:37.237Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19627","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-19627"],"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-19627"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19627"}],"epss":null},{"id":"CVE-2026-19622","title":"CVE-2026-19622 — IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to bypass authentication and escalate p","summary":"IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to bypass authentication and escalate privileges due to improper validation of sub-requests.","source":"NVD","date":"2026-10-12T23:17:37.107Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19622","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-19622"],"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-19622"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19622"}],"epss":null},{"id":"CVE-2026-19620","title":"CVE-2026-19620 — IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to gain unauthorized administrative acc","summary":"IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to gain unauthorized administrative access due to improper authentication.","source":"NVD","date":"2026-10-12T23:17:36.980Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19620","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-19620"],"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-19620"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19620"}],"epss":null},{"id":"CVE-2026-18541","title":"CVE-2026-18541 — IBM Planning Analytics 2.0, and 2.1 is vulnerable to stored cross-site scripting. This vulnerability allo","summary":"IBM Planning Analytics 2.0, and 2.1 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.","source":"NVD","date":"2026-10-12T23:17:36.710Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18541","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-18541"],"cvss":{"score":6.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-18541"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18541"}],"epss":null},{"id":"CVE-2026-17475","title":"CVE-2026-17475 — IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to delete folders and app","summary":"IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to delete folders and applications belonging to other users due to improper functional level access control.","source":"NVD","date":"2026-10-12T23:17:36.443Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17475","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-17475"],"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-17475"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17475"}],"epss":null},{"id":"CVE-2026-109675","title":"CVE-2026-109675 — Frappe Suite before commit 2697564a9c46da6acc614743eaf9915fe5238f4f contains a broken access control vuln","summary":"Frappe Suite before commit 2697564a9c46da6acc614743eaf9915fe5238f4f contains a broken access control vulnerability in the get_mailboxes and get_quota APIs that allows authenticated mail users to access other users' data. Attackers can supply another user's JMAP account ID to read mailbox names, message counts, automation rules with sender addresses, and storage quota usage.","source":"NVD","date":"2026-10-12T23:17:35.543Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109675","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109675"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109675"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109675"}],"epss":null},{"id":"CVE-2026-109674","title":"CVE-2026-109674 — Frappe ERPNext before 15.98.0 and 16.x before 16.6.0 contains an SQL injection vulnerability in some endp","summary":"Frappe ERPNext before 15.98.0 and 16.x before 16.6.0 contains an SQL injection vulnerability in some endpoints caused by missing input validation. Remote authenticated attackers can send specially crafted requests to the affected endpoints to manipulate database queries and extract sensitive information from the database.","source":"NVD","date":"2026-10-12T23:17:35.380Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109674","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109674"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109674"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109674"}],"epss":null},{"id":"CVE-2026-109673","title":"CVE-2026-109673 — Frappe ERPNext before 15.103.0 and 16.x before 16.12.0 contains a stored cross-site scripting vulnerabili","summary":"Frappe ERPNext before 15.103.0 and 16.x before 16.12.0 contains a stored cross-site scripting vulnerability because the names of certain records are not properly neutralized when rendered on some dashboards, tools, and portals. Authenticated attackers can craft malicious record names that execute scripts in other users' browsers, enabling data access, modification, and token theft, especially against privileged users.","source":"NVD","date":"2026-10-12T23:17:35.210Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109673","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109673"],"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109673"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109673"}],"epss":null},{"id":"CVE-2026-109672","title":"CVE-2026-109672 — Frappe ERPNext before 15.118.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in ","summary":"Frappe ERPNext before 15.118.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated users can query these endpoints to read financial data beyond what their assigned role permits.","source":"NVD","date":"2026-10-12T23:17:35.040Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109672","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109672"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109672"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109672"}],"epss":null},{"id":"CVE-2026-109671","title":"CVE-2026-109671 — Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a stored cross-site scripting vulnerabili","summary":"Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a stored cross-site scripting vulnerability in a profile field that is rendered without escaping into portal pages. Low-privilege attackers can store malicious script in the field that executes in the browser of any administrator viewing those pages, enabling administrator account takeover.","source":"NVD","date":"2026-10-12T23:17:34.873Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109671","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109671"],"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109671"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109671"}],"epss":null},{"id":"CVE-2026-109670","title":"CVE-2026-109670 — Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a stored cross-site scripting vulnerabili","summary":"Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a stored cross-site scripting vulnerability caused by record names being rendered without escaping. Attackers with write access to item master data can store malicious script in a record name that executes in the browser of any operator who opens the affected page.","source":"NVD","date":"2026-10-12T23:17:34.697Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109670","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109670"],"cvss":{"score":5.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109670"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109670"}],"epss":null},{"id":"CVE-2026-109669","title":"CVE-2026-109669 — Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in ","summary":"Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on record status changes. Authenticated low-privileged users can call these endpoints to modify data beyond their permitted role, bypassing intended role-based access restrictions.","source":"NVD","date":"2026-10-12T23:17:34.530Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109669","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109669"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109669"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109669"}],"epss":null},{"id":"CVE-2026-109668","title":"CVE-2026-109668 — Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in ","summary":"Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that handle party records, allowing authenticated users to modify data beyond their permitted role. Attackers with low-privileged accounts can send requests to these endpoints to make unauthorized changes to party records.","source":"NVD","date":"2026-10-12T23:17:34.370Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109668","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109668"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109668"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109668"}],"epss":null},{"id":"CVE-2026-109667","title":"CVE-2026-109667 — Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege escalation vulnerability in a","summary":"Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege escalation vulnerability in a record-creation endpoint that takes the record type from the request and inserts the record with permission checks disabled. Any authenticated user, including one holding no operational role, can supply a privileged record type to create privileged accounts and take full control of the site.","source":"NVD","date":"2026-10-12T23:17:34.210Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109667","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109667"],"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109667"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109667"}],"epss":null},{"id":"CVE-2026-109666","title":"CVE-2026-109666 — Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in ","summary":"Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks on inventory records. Authenticated users can send requests to these endpoints to modify inventory data beyond what their assigned role permits.","source":"NVD","date":"2026-10-12T23:17:34.043Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109666","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109666"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109666"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109666"}],"epss":null},{"id":"CVE-2026-109665","title":"CVE-2026-109665 — Frappe ERPNext before 15.108.0 and 16.x before 16.18.0 contains a missing authorization vulnerability in ","summary":"Frappe ERPNext before 15.108.0 and 16.x before 16.18.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated low-privileged users can call these endpoints to deactivate master records, modifying data beyond their permitted role.","source":"NVD","date":"2026-10-12T23:17:33.880Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109665","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109665"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109665"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109665"}],"epss":null},{"id":"CVE-2026-109664","title":"CVE-2026-109664 — Frappe ERPNext before 15.112.0 contains a missing authorization vulnerability that allows authenticated u","summary":"Frappe ERPNext before 15.112.0 contains a missing authorization vulnerability that allows authenticated users with a common operational role to modify records beyond their permissions due to missing validation in certain endpoints. Attackers holding this role can call the affected endpoints to change a field on record types outside their role's permissions, tampering with data they should not control.","source":"NVD","date":"2026-10-12T23:17:33.717Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109664","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109664"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109664"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109664"}],"epss":null},{"id":"CVE-2026-109663","title":"CVE-2026-109663 — Frappe ERPNext before 15.113.0 and 16.x before 16.22.0 contains an SQL injection vulnerability caused by ","summary":"Frappe ERPNext before 15.113.0 and 16.x before 16.22.0 contains an SQL injection vulnerability caused by missing input validation in some endpoints. Authenticated remote attackers can send specially crafted requests to these endpoints to manipulate database queries and extract sensitive information from the database.","source":"NVD","date":"2026-10-12T23:17:33.550Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109663","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109663"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109663"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109663"}],"epss":null},{"id":"CVE-2026-109662","title":"CVE-2026-109662 — Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerabili","summary":"Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability in a public portal form that accepts unauthenticated submissions and stores content later rendered with insufficient neutralisation. Unauthenticated attackers can submit crafted markup that executes in the browser sessions of staff who review the stored record.","source":"NVD","date":"2026-10-12T23:17:33.387Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109662","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109662"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109662"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109662"}],"epss":null},{"id":"CVE-2026-109661","title":"CVE-2026-109661 — Frappe ERPNext before 15.116.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in ","summary":"Frappe ERPNext before 15.116.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks, exposing financial data. Authenticated attackers with low-privileged accounts can query these endpoints to read financial data beyond their permitted role.","source":"NVD","date":"2026-10-12T23:17:33.213Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109661","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109661"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109661"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109661"}],"epss":null},{"id":"CVE-2026-109660","title":"CVE-2026-109660 — Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 has certain endpoints that do not enforce proper a","summary":"Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 has certain endpoints that do not enforce proper authorization checks on operations that modify production records. An authenticated low-privileged user can send requests to these endpoints to modify production data beyond what their assigned role permits.","source":"NVD","date":"2026-10-12T23:17:33.047Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109660","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109660"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109660"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109660"}],"epss":null},{"id":"CVE-2026-109659","title":"CVE-2026-109659 — Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a missing authorization vulnerability in ","summary":"Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated users can call these endpoints to read financial data beyond what their assigned role permits.","source":"NVD","date":"2026-10-12T23:17:32.877Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109659","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109659"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109659"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109659"}],"epss":null},{"id":"CVE-2026-109658","title":"CVE-2026-109658 — Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in ","summary":"Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can call these endpoints to read data, including personal data, beyond what their assigned role permits.","source":"NVD","date":"2026-10-12T23:17:32.710Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109658","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109658"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109658"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109658"}],"epss":null},{"id":"CVE-2026-109657","title":"CVE-2026-109657 — Frappe ERPNext 16.x before 16.27.0 contains a stored cross-site scripting vulnerability that allows users","summary":"Frappe ERPNext 16.x before 16.27.0 contains a stored cross-site scripting vulnerability that allows users with edit rights to inject script through a record name rendered without escaping. Attackers can set a malicious record name so the script runs in the browser of any colleague who opens the page.","source":"NVD","date":"2026-10-12T23:17:32.547Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109657","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109657"],"cvss":{"score":5.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109657"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109657"}],"epss":null},{"id":"CVE-2026-109656","title":"CVE-2026-109656 — Frappe ERPNext before 15.118.2 and 16.x before 16.30.0 contains a missing authorization vulnerability in ","summary":"Frappe ERPNext before 15.118.2 and 16.x before 16.30.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on item master data. Authenticated attackers with low-privileged accounts can call these endpoints to read item master data beyond their permitted role.","source":"NVD","date":"2026-10-12T23:17:32.387Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109656","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109656"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109656"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109656"}],"epss":null},{"id":"CVE-2026-109655","title":"CVE-2026-109655 — Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in ","summary":"Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper role-based authorization checks. Authenticated low-privileged users can send requests to these endpoints to modify inventory records beyond their permitted role.","source":"NVD","date":"2026-10-12T23:17:32.220Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109655","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109655"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109655"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109655"}],"epss":null},{"id":"CVE-2026-109654","title":"CVE-2026-109654 — Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in ","summary":"Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in which certain endpoints fail to verify that the caller may read a document before sending transactional email about it. Authenticated attackers can call these endpoints to trigger transactional email for documents they are not permitted to read.","source":"NVD","date":"2026-10-12T23:17:32.053Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109654","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109654"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109654"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109654"}],"epss":null},{"id":"CVE-2026-109653","title":"CVE-2026-109653 — Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerabili","summary":"Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability because record fields are rendered into an HTML attribute context without escaping. A low-privilege user can store a malicious payload in a record field that executes in the browser of any privileged user who opens the affected page, enabling account takeover.","source":"NVD","date":"2026-10-12T23:17:31.890Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109653","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109653"],"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109653"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109653"}],"epss":null},{"id":"CVE-2026-109652","title":"CVE-2026-109652 — Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a server-side template injection vulnerab","summary":"Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a server-side template injection vulnerability because user-controlled message fields are not validated before template rendering, allowing expressions to run in an unrestricted context. Authenticated attackers holding a common operational role can inject template expressions to read and write arbitrary database data, delete documents, send outbound requests from the server, and send mail from the site.","source":"NVD","date":"2026-10-12T23:17:31.723Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109652","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109652"],"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109652"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109652"}],"epss":null},{"id":"CVE-2026-109651","title":"CVE-2026-109651 — Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a server-side request forgery vulnerabili","summary":"Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a server-side request forgery vulnerability caused by a configuration field, writable by common operational roles, that accepts an arbitrary outbound request destination without validation. Authenticated attackers can set the field to hosts of their choosing, making the server issue requests to addresses reachable only from inside the deployment's network.","source":"NVD","date":"2026-10-12T23:17:31.563Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109651","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109651"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109651"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109651"}],"epss":null},{"id":"CVE-2026-109650","title":"CVE-2026-109650 — Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a missing authorization vulnerability in ","summary":"Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated low-privileged users can send requests to these endpoints to read personal data beyond what their assigned role permits.","source":"NVD","date":"2026-10-12T23:17:31.390Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109650","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109650"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109650"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109650"}],"epss":null},{"id":"CVE-2026-109649","title":"CVE-2026-109649 — Frappe ERPNext before 15.102.0 and 16.x before 16.11.0 contains an SQL injection vulnerability in some en","summary":"Frappe ERPNext before 15.102.0 and 16.x before 16.11.0 contains an SQL injection vulnerability in some endpoints due to missing input validation, allowing manipulation of database queries. Authenticated attackers can send specially crafted requests to the affected endpoints to extract sensitive information from the database.","source":"NVD","date":"2026-10-12T23:17:31.213Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109649","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109649"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109649"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109649"}],"epss":null},{"id":"CVE-2026-109648","title":"CVE-2026-109648 — Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some en","summary":"Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated attackers can send specially crafted requests to inject SQL into database queries and extract sensitive information from the underlying database.","source":"NVD","date":"2026-10-12T23:17:31.050Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109648","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109648"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109648"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109648"}],"epss":null},{"id":"CVE-2026-109647","title":"CVE-2026-109647 — Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in multipl","summary":"Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in multiple endpoints caused by missing input validation. Authenticated attackers can send specially crafted requests to these endpoints to manipulate database queries and extract sensitive information from the ERPNext database.","source":"NVD","date":"2026-10-12T23:17:30.823Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109647","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109647"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109647"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109647"}],"epss":null},{"id":"CVE-2026-109646","title":"CVE-2026-109646 — Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some en","summary":"Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated low-privileged attackers can send specially crafted requests to these endpoints to inject SQL and extract sensitive information from the database.","source":"NVD","date":"2026-10-12T23:17:30.580Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109646","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109646"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109646"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109646"}],"epss":null},{"id":"CVE-2026-109645","title":"CVE-2026-109645 — Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in ","summary":"Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated attackers can send requests to these endpoints to create records and modify data beyond their permitted role, bypassing intended role-based access restrictions.","source":"NVD","date":"2026-10-12T23:17:30.397Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109645","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109645"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109645"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109645"}],"epss":null},{"id":"CVE-2026-109644","title":"CVE-2026-109644 — Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in ","summary":"Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks on valuation data. Authenticated low-privileged users can query these endpoints to read valuation information beyond what their assigned role permits.","source":"NVD","date":"2026-10-12T23:17:30.220Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109644","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109644"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109644"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109644"}],"epss":null},{"id":"CVE-2026-109643","title":"CVE-2026-109643 — Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a missing authorization vulnerability in ","summary":"Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a missing authorization vulnerability in certain project-related endpoints that fail to enforce permission checks. Authenticated low-privileged users can call these endpoints directly to read project data beyond what their assigned role permits.","source":"NVD","date":"2026-10-12T23:17:30.057Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109643","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109643"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109643"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109643"}],"epss":null},{"id":"CVE-2026-109642","title":"CVE-2026-109642 — Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in ","summary":"Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can query these endpoints to read data beyond what their assigned role permits.","source":"NVD","date":"2026-10-12T23:17:29.890Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109642","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109642"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109642"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109642"}],"epss":null},{"id":"CVE-2026-109641","title":"CVE-2026-109641 — Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in ","summary":"Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce authorization checks. Unauthenticated remote attackers can call these endpoints to create records and enumerate availability even when an administrator has disabled the corresponding feature.","source":"NVD","date":"2026-10-12T23:17:29.720Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109641","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109641"],"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109641"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109641"}],"epss":null},{"id":"CVE-2026-109640","title":"CVE-2026-109640 — Frappe ERPNext before 16.22.0 contains a missing authorization vulnerability that allows authenticated us","summary":"Frappe ERPNext before 16.22.0 contains a missing authorization vulnerability that allows authenticated users to modify records by invoking endpoints lacking proper authorization checks. Attackers can call these endpoints to perform operations on records beyond their permitted role, resulting in unauthorized modification of data.","source":"NVD","date":"2026-10-12T23:17:29.560Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109640","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109640"],"cvss":{"score":7.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109640"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109640"}],"epss":null},{"id":"CVE-2026-109639","title":"CVE-2026-109639 — Frappe ERPNext before 15.102.0 and 16.x before 16.8.0 contains an SQL injection vulnerability in some end","summary":"Frappe ERPNext before 15.102.0 and 16.x before 16.8.0 contains an SQL injection vulnerability in some endpoints due to missing input validation, allowing manipulation of database queries. Authenticated attackers with low privileges can send specially crafted requests to the affected endpoints to extract sensitive information from the database.","source":"NVD","date":"2026-10-12T23:17:29.390Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109639","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109639"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109639"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109639"}],"epss":null},{"id":"CVE-2026-109638","title":"CVE-2026-109638 — Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a SQL injection vulnerability in some end","summary":"Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Authenticated attackers can send specially crafted requests to these endpoints to manipulate database queries and extract sensitive information from the database.","source":"NVD","date":"2026-10-12T23:17:29.223Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109638","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109638"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109638"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109638"}],"epss":null},{"id":"CVE-2026-109637","title":"CVE-2026-109637 — Frappe ERPNext before 16.14.0 contains a missing authorization vulnerability that allows authenticated us","summary":"Frappe ERPNext before 16.14.0 contains a missing authorization vulnerability that allows authenticated users to modify master data beyond their permitted role. Attackers can send requests to certain endpoints lacking proper authorization checks to make unauthorized changes to master data records.","source":"NVD","date":"2026-10-12T23:17:29.060Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109637","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109637"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109637"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109637"}],"epss":null},{"id":"CVE-2026-109636","title":"CVE-2026-109636 — Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability bec","summary":"Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks. Authenticated attackers with low-privileged accounts can call these endpoints to read financial data beyond their permitted role.","source":"NVD","date":"2026-10-12T23:17:28.900Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109636","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109636"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109636"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109636"}],"epss":null},{"id":"CVE-2026-109635","title":"CVE-2026-109635 — Frappe ERPNext before 15.105.0 and 16.x before 16.15.0 contains a missing authorization vulnerability in ","summary":"Frappe ERPNext before 15.105.0 and 16.x before 16.15.0 contains a missing authorization vulnerability in certain document creation endpoints that fail to verify that the requesting portal user belongs to the target party. Authenticated portal users can send requests to these endpoints to create documents on behalf of parties other than their own.","source":"NVD","date":"2026-10-12T23:17:28.580Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109635","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109635"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109635"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109635"}],"epss":null},{"id":"CVE-2026-109634","title":"CVE-2026-109634 — Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection vulnerability in some en","summary":"Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated attackers with high privileges can send specially crafted requests to these endpoints to inject SQL and extract sensitive information from the database.","source":"NVD","date":"2026-10-12T23:17:28.400Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109634","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109634"],"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109634"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109634"}],"epss":null},{"id":"CVE-2026-109633","title":"CVE-2026-109633 — Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a stored cross-site scripting vulnerabili","summary":"Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a stored cross-site scripting vulnerability because content submitted through a public-facing booking page is stored without neutralization. Unauthenticated attackers can submit crafted content that is rendered as raw HTML in a privileged user's session, executing script to act as that user and take over the account.","source":"NVD","date":"2026-10-12T23:17:28.220Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109633","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109633"],"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109633"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109633"}],"epss":null},{"id":"CVE-2026-109632","title":"CVE-2026-109632 — Frappe ERPNext before 15.121.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in ","summary":"Frappe ERPNext before 15.121.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can call these endpoints directly to read data beyond what their assigned role permits.","source":"NVD","date":"2026-10-12T23:17:28.040Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109632","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109632"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109632"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109632"}],"epss":null},{"id":"CVE-2026-109631","title":"CVE-2026-109631 — Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection vulnerability in some en","summary":"Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection vulnerability in some endpoints that lack input validation, allowing crafted input to alter database queries. Authenticated attackers with low privileges can send specially crafted requests to these endpoints to extract sensitive information from the database.","source":"NVD","date":"2026-10-12T23:17:27.870Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109631","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109631"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109631"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109631"}],"epss":null},{"id":"CVE-2026-109630","title":"CVE-2026-109630 — Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in ","summary":"Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated attackers can call these endpoints to read data beyond what their assigned role permits.","source":"NVD","date":"2026-10-12T23:17:27.700Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109630","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109630"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109630"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109630"}],"epss":null},{"id":"CVE-2026-109629","title":"CVE-2026-109629 — Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in ","summary":"Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in an endpoint that sends transactional email through the site's configured outgoing account without checking the caller's authorization. Any authenticated user can supply arbitrary recipient lists and message content to send attacker-controlled messages carrying the organisation's sending identity.","source":"NVD","date":"2026-10-12T23:17:27.527Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109629","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109629"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109629"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109629"}],"epss":null},{"id":"CVE-2026-109628","title":"CVE-2026-109628 — Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in ","summary":"Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper role checks when modifying record status. Authenticated low-privileged attackers can invoke these endpoints to alter data beyond their permitted role, compromising data integrity.","source":"NVD","date":"2026-10-12T23:17:27.360Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109628","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109628"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109628"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109628"}],"epss":null},{"id":"CVE-2026-109627","title":"CVE-2026-109627 — Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in ","summary":"Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated low-privileged users can request these endpoints directly to read financial data beyond what their assigned role permits.","source":"NVD","date":"2026-10-12T23:17:27.187Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109627","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109627"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109627"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109627"}],"epss":null},{"id":"CVE-2026-109626","title":"CVE-2026-109626 — Frappe ERPNext before 16.34.2 contains an SQL injection vulnerability caused by missing input validation ","summary":"Frappe ERPNext before 16.34.2 contains an SQL injection vulnerability caused by missing input validation in multiple endpoints. Authenticated attackers with low privileges can send specially crafted requests to these endpoints to inject SQL and extract sensitive information from the database.","source":"NVD","date":"2026-10-12T23:17:27.023Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109626","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109626"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109626"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109626"}],"epss":null},{"id":"CVE-2026-109625","title":"CVE-2026-109625 — Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in ","summary":"Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce role-based authorization checks. Authenticated users can request these endpoints to read financial data beyond the permissions granted by their assigned role.","source":"NVD","date":"2026-10-12T23:17:26.860Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109625","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109625"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109625"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109625"}],"epss":null},{"id":"CVE-2026-109624","title":"CVE-2026-109624 — Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in ","summary":"Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated low-privileged users can request these endpoints to read personal data beyond what their assigned role permits.","source":"NVD","date":"2026-10-12T23:17:26.697Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109624","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109624"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109624"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109624"}],"epss":null},{"id":"CVE-2026-109623","title":"CVE-2026-109623 — Frappe ERPNext before 15.121.1 and 16.x before 16.34.2 contains a missing authorization vulnerability in ","summary":"Frappe ERPNext before 15.121.1 and 16.x before 16.34.2 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated attackers can send requests to these endpoints to modify documents and data beyond what their assigned role permits.","source":"NVD","date":"2026-10-12T23:17:26.530Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109623","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109623"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109623"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109623"}],"epss":null},{"id":"CVE-2026-109622","title":"CVE-2026-109622 — Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in ","summary":"Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can send requests to the affected endpoints to modify data beyond their permitted role, compromising data integrity.","source":"NVD","date":"2026-10-12T23:17:26.363Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109622","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109622"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109622"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109622"}],"epss":null},{"id":"CVE-2026-109621","title":"CVE-2026-109621 — Frappe ERPNext before 15.120.0 and 16.x before 16.23.0 contains an authorization bypass in an endpoint th","summary":"Frappe ERPNext before 15.120.0 and 16.x before 16.23.0 contains an authorization bypass in an endpoint that honours a caller-supplied flag disabling its own permission enforcement. Authenticated attackers can set this flag when calling the endpoint to skip permission checks and read party records beyond their permitted role.","source":"NVD","date":"2026-10-12T23:17:26.190Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109621","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109621"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109621"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109621"}],"epss":null},{"id":"CVE-2026-109617","title":"CVE-2026-109617 — Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in ","summary":"Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks during document creation. Authenticated low-privileged users can send requests to these endpoints to create documents against records beyond their permitted role, bypassing role-based permission restrictions.","source":"NVD","date":"2026-10-12T23:17:26.023Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109617","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109617"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109617"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109617"}],"epss":null},{"id":"CVE-2026-109616","title":"CVE-2026-109616 — Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in ","summary":"Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can send requests to these endpoints to modify data beyond what their assigned role permits.","source":"NVD","date":"2026-10-12T23:17:25.857Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109616","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109616"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109616"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109616"}],"epss":null},{"id":"CVE-2026-109615","title":"CVE-2026-109615 — Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in ","summary":"Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks during document creation. Authenticated low-privileged users can call these endpoints to create documents against records beyond their permitted role, bypassing role-based access controls.","source":"NVD","date":"2026-10-12T23:17:25.687Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109615","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109615"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109615"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109615"}],"epss":null},{"id":"CVE-2026-109614","title":"CVE-2026-109614 — Frappe ERPNext before 16.34.0 contains a missing authorization vulnerability that allows authenticated us","summary":"Frappe ERPNext before 16.34.0 contains a missing authorization vulnerability that allows authenticated users to read financial data beyond their permitted role. Attackers can query endpoints lacking proper authorization checks to access sensitive financial records they should not be able to view.","source":"NVD","date":"2026-10-12T23:17:25.527Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109614","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109614"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109614"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109614"}],"epss":null},{"id":"CVE-2026-109613","title":"CVE-2026-109613 — Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in ","summary":"Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on document status modification. Authenticated low-privileged users can call these endpoints to modify data beyond their permitted role, bypassing intended role-based access restrictions.","source":"NVD","date":"2026-10-12T23:17:25.353Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109613","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109613"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109613"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109613"}],"epss":null},{"id":"CVE-2026-109612","title":"CVE-2026-109612 — Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a stored cross-site scripting vulnerabili","summary":"Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a stored cross-site scripting vulnerability in a report view that interpolates stored record names into markup without escaping. Authenticated users able to create records can store crafted record names that execute script in the session of any user who later opens the report.","source":"NVD","date":"2026-10-12T23:17:25.157Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109612","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109612"],"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109612"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109612"}],"epss":null},{"id":"CVE-2026-109611","title":"CVE-2026-109611 — Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in ","summary":"Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated users can call these endpoints to modify data beyond what their assigned role permits.","source":"NVD","date":"2026-10-12T23:17:24.997Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109611","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109611"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109611"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109611"}],"epss":null},{"id":"CVE-2026-109610","title":"CVE-2026-109610 — Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a missing authorization vulnerability bec","summary":"Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks. Authenticated low-privileged users can call these endpoints to modify documents and data beyond what their assigned role permits.","source":"NVD","date":"2026-10-12T23:17:24.830Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109610","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109610"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109610"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109610"}],"epss":null},{"id":"CVE-2026-109609","title":"CVE-2026-109609 — Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection vulnerability in some en","summary":"Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection vulnerability in some endpoints that lack input validation. Authenticated attackers with low privileges can send specially crafted requests to these endpoints to inject SQL and extract sensitive information from the ERPNext database.","source":"NVD","date":"2026-10-12T23:17:24.660Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109609","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109609"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109609"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109609"}],"epss":null},{"id":"CVE-2026-109608","title":"CVE-2026-109608 — Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection vulnerability in several","summary":"Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection vulnerability in several endpoints that lack input validation. Any authenticated user, including one with no assigned roles, can send specially crafted requests to read other users' sensitive information and escalate to a privileged account.","source":"NVD","date":"2026-10-12T23:17:24.497Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109608","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109608"],"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109608"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109608"}],"epss":null},{"id":"CVE-2026-109604","title":"CVE-2026-109604 — Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerabili","summary":"Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability because a tool view interpolates stored record names into markup without escaping. An authenticated user able to create such records can give them malicious names, executing script in the session of any user who later opens that tool.","source":"NVD","date":"2026-10-12T23:17:24.327Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109604","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109604"],"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109604"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109604"}],"epss":null},{"id":"CVE-2026-109603","title":"CVE-2026-109603 — Frappe Framework 15.x before 15.107.3 and 16.x before 16.17.0 relies on a vulnerable pdfkit library (CVE-","summary":"Frappe Framework 15.x before 15.107.3 and 16.x before 16.17.0 relies on a vulnerable pdfkit library (CVE-2025-26240) for PDF generation, enabling server-side request forgery and local file inclusion. Authenticated attackers can supply crafted content to PDF rendering to make the server fetch internal resources or embed local server files in generated PDFs.","source":"NVD","date":"2026-10-12T23:17:24.153Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109603","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109603"],"cvss":{"score":4.8,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109603"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109603"}],"epss":null},{"id":"CVE-2026-109602","title":"CVE-2026-109602 — Frappe before 15.118.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability in da","summary":"Frappe before 15.118.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability in dashboard chart filters because jQuery renders entered filter values as rich text. Authenticated attackers can store malicious filter values that execute scripts in the browsers of users who view the dashboard chart.","source":"NVD","date":"2026-10-12T23:17:23.987Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109602","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109602"],"cvss":{"score":5.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109602"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109602"}],"epss":null},{"id":"CVE-2026-109601","title":"CVE-2026-109601 — Frappe Framework before 15.117.0 and 16.x before 16.30.0 contains an arbitrary file read vulnerability in","summary":"Frappe Framework before 15.117.0 and 16.x before 16.30.0 contains an arbitrary file read vulnerability in the handling of attributes in outgoing email HTML. Attackers who can supply outgoing email content can set an attribute value referencing a local file path to expose sensitive server files.","source":"NVD","date":"2026-10-12T23:17:23.823Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109601","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109601"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109601"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109601"}],"epss":null},{"id":"CVE-2026-109600","title":"CVE-2026-109600 — Frappe Framework before 15.118.0 and 16.x before 16.31.0 does not check whether a user account is disable","summary":"Frappe Framework before 15.118.0 and 16.x before 16.31.0 does not check whether a user account is disabled before sending Document Follow email notifications. A disabled user who previously followed documents continues to receive email updates about activity on those documents after their access should have been revoked.","source":"NVD","date":"2026-10-12T23:17:23.653Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109600","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109600"],"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109600"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109600"}],"epss":null},{"id":"CVE-2026-109599","title":"CVE-2026-109599 — Frappe before 15.113.3 and 16.x before 16.25.0 contains a missing authorization vulnerability in which ce","summary":"Frappe before 15.113.3 and 16.x before 16.25.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can send requests to these endpoints to modify records beyond what their assigned role permits.","source":"NVD","date":"2026-10-12T23:17:23.493Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109599","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109599"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109599"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109599"}],"epss":null},{"id":"CVE-2026-109598","title":"CVE-2026-109598 — Frappe Framework before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability i","summary":"Frappe Framework before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in the whitelisted send_sms API endpoint, which does not verify that the caller is permitted to send SMS messages. Users lacking the required permissions can invoke send_sms to send arbitrary SMS messages that impersonate the Company.","source":"NVD","date":"2026-10-12T23:17:23.333Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109598","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109598"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109598"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109598"}],"epss":null},{"id":"CVE-2026-109597","title":"CVE-2026-109597 — Hugo from v0.60.0 before v0.167.0 contains a stored cross-site scripting vulnerability that allows Markdo","summary":"Hugo from v0.60.0 before v0.167.0 contains a stored cross-site scripting vulnerability that allows Markdown content authors to inject HTML by supplying crafted explicit heading IDs. Attackers can break out of the unescaped href attribute in .TableOfContents or .Fragments.ToHTML output to inject elements with event handlers into rendered pages.","source":"NVD","date":"2026-10-12T23:17:23.183Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109597","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109597"],"cvss":{"score":5.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109597"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109597"}],"epss":null},{"id":"CVE-2026-109596","title":"CVE-2026-109596 — Hugo from v0.162.0 before v0.167.0 contains an improper link resolution vulnerability that lets malicious","summary":"Hugo from v0.162.0 before v0.167.0 contains an improper link resolution vulnerability that lets malicious themes or modules expose files outside their root via nested-mount ancestor directories. Attackers controlling a theme can place a symlink or NTFS junction at a virtual ancestor directory, causing resources.Match to list and publish local files during builds.","source":"NVD","date":"2026-10-12T23:17:23.033Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109596","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109596"],"cvss":{"score":6.7,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109596"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109596"}],"epss":null},{"id":"CVE-2026-109595","title":"CVE-2026-109595 — Hugo from v0.84.0 before v0.167.0 contains a path traversal vulnerability that allows malicious themes or","summary":"Hugo from v0.84.0 before v0.167.0 contains a path traversal vulnerability that allows malicious themes or modules to read files outside the project root via ESBuild's fallback resolver in js.Build, js.Batch, and css.Build. Attackers can ship relative imports or symlinks pointing outside the project to bundle any file readable by the build user into published JavaScript or CSS output.","source":"NVD","date":"2026-10-12T23:17:22.887Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109595","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109595"],"cvss":{"score":6.7,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109595"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109595"}],"epss":null},{"id":"CVE-2026-109574","title":"CVE-2026-109574 — Hugo before v0.167.0 contains a path traversal vulnerability in css.Sass that allows malicious themes or ","summary":"Hugo before v0.167.0 contains a path traversal vulnerability in css.Sass that allows malicious themes or modules to read files outside the project root through the Sass compiler's import fallback. Attackers can ship stylesheets with relative, absolute, or symlinked @import or @use targets to compile readable files into the published site CSS.","source":"NVD","date":"2026-10-12T23:17:22.730Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109574","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109574"],"cvss":{"score":6.7,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109574"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109574"}],"epss":null},{"id":"CVE-2026-109573","title":"CVE-2026-109573 — phpMyFAQ before 4.1.9 contains an SQL injection vulnerability in PdoMysql::escape(), which escapes single","summary":"phpMyFAQ before 4.1.9 contains an SQL injection vulnerability in PdoMysql::escape(), which escapes single quotes with backslashes that are treated literally when MySQL or MariaDB runs in NO_BACKSLASH_ESCAPES mode. Unauthenticated attackers can send a Unicode right single quotation mark in the search parameter of api/autocomplete, which is normalized to an ASCII quote, to read credentials and configuration secrets, modify records, or drop tables.","source":"NVD","date":"2026-10-12T23:17:22.557Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109573","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109573"],"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109573"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109573"}],"epss":null},{"id":"CVE-2026-109572","title":"CVE-2026-109572 — Open WebUI from 0.8.6 before 0.11.4 contains a privilege escalation vulnerability in the terminal proxy t","summary":"Open WebUI from 0.8.6 before 0.11.4 contains a privilege escalation vulnerability in the terminal proxy that allows authenticated users to reach the Terminals administrator API with the shared key attached. Attackers can send requests through /api/v1/terminals/{server_id}/{path} to list or stop other users' terminals and modify terminal policies, injecting environment variables into other users' terminals.","source":"NVD","date":"2026-10-12T23:17:22.407Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109572","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109572"],"cvss":{"score":7.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109572"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109572"}],"epss":null},{"id":"CVE-2026-108938","title":"CVE-2026-108938 — A flaw has been found in code-projects Matrimonial System 1.0. This issue affects some unknown processing","summary":"A flaw has been found in code-projects Matrimonial System 1.0. This issue affects some unknown processing of the file db/matrimony.sql. This manipulation causes files or directories accessible. The attack can be initiated remotely. The exploit has been published and may be used.","source":"NVD","date":"2026-10-12T23:17:22.220Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108938","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108938"],"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108938"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108938"}],"epss":null},{"id":"CVE-2026-108937","title":"CVE-2026-108937 — A vulnerability was detected in code-projects Online Ticket Reservation System 1.0. This vulnerability af","summary":"A vulnerability was detected in code-projects Online Ticket Reservation System 1.0. This vulnerability affects unknown code of the file /database/medallion.sql. The manipulation results in file and directory information exposure. It is possible to launch the attack remotely. The exploit is now public and may be used.","source":"NVD","date":"2026-10-12T23:17:22.037Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108937","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108937"],"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108937"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108937"}],"epss":null},{"id":"CVE-2026-108936","title":"CVE-2026-108936 — A security vulnerability has been detected in Edimax BR-6208AC 1.32. This affects an unknown part of the ","summary":"A security vulnerability has been detected in Edimax BR-6208AC 1.32. This affects an unknown part of the file /goform/formQoS of the component QoS Page. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-12T23:17:21.860Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108936","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108936"],"cvss":{"score":1.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108936"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108936"}],"epss":null},{"id":"CVE-2026-108935","title":"CVE-2026-108935 — A weakness has been identified in Edimax BR-6208AC 1.32. Affected by this issue is some unknown functiona","summary":"A weakness has been identified in Edimax BR-6208AC 1.32. Affected by this issue is some unknown functionality of the file /goform/formPortFw of the component Port Forwarding Page. Executing a manipulation can lead to cross site scripting. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-12T23:17:21.680Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108935","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108935"],"cvss":{"score":1.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108935"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108935"}],"epss":null},{"id":"CVE-2026-102627","title":"CVE-2026-102627 — IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to execu","summary":"IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of file paths during archive extraction.","source":"NVD","date":"2026-10-12T23:17:19.457Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102627","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-102627"],"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-102627"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102627"}],"epss":null},{"id":"CVE-2025-71432","title":"CVE-2025-71432 — Frappe ERPNext before 14.92.1 and 15.x before 15.83.0 contains a reflected cross-site scripting vulnerabi","summary":"Frappe ERPNext before 14.92.1 and 15.x before 15.83.0 contains a reflected cross-site scripting vulnerability due to missing input validation on a certain page, allowing arbitrary JavaScript to execute in authenticated sessions. Remote attackers can lure a logged-in user into opening a crafted URL to run injected script and take over the victim's account.","source":"NVD","date":"2026-10-12T23:17:19.297Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71432","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2025-71432"],"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2025-71432"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71432"}],"epss":null},{"id":"CVE-2025-71431","title":"CVE-2025-71431 — Frappe before 14.99.2 and 15.x before 15.86.0 contains an LDAP injection vulnerability because certain en","summary":"Frappe before 14.99.2 and 15.x before 15.86.0 contains an LDAP injection vulnerability because certain endpoints do not sanitize user-supplied parameters before using them in LDAP queries. Attackers can supply crafted LDAP filter syntax through these parameters to alter the resulting directory queries.","source":"NVD","date":"2026-10-12T23:17:19.127Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71431","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2025-71431"],"cvss":{"score":6.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2025-71431"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71431"}],"epss":null},{"id":"CVE-2025-71430","title":"CVE-2025-71430 — Frappe before 14.99.10 and 15.x before 15.91.1 contains a stored cross-site scripting vulnerability in th","summary":"Frappe before 14.99.10 and 15.x before 15.91.1 contains a stored cross-site scripting vulnerability in the leaderboard page because user names are rendered without proper neutralization. Authenticated attackers can set a crafted user name that executes arbitrary JavaScript in the browsers of other users who view the leaderboard.","source":"NVD","date":"2026-10-12T23:17:18.957Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71430","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2025-71430"],"cvss":{"score":5.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2025-71430"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71430"}],"epss":null},{"id":"CVE-2024-58391","title":"CVE-2024-58391 — Frappe before 14.58.0 and 15.x before 15.4.0 contains a cross-site scripting vulnerability in printview b","summary":"Frappe before 14.58.0 and 15.x before 15.4.0 contains a cross-site scripting vulnerability in printview because printview parameters are not escaped before being rendered. Remote attackers can craft a malicious printview URL that, when visited by a victim, injects HTML and executes script in the victim's browser session.","source":"NVD","date":"2026-10-12T23:17:18.307Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-58391","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2024-58391"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2024-58391"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-58391"}],"epss":null},{"id":"CVE-2024-58390","title":"CVE-2024-58390 — Frappe before 14.81.4 and 15.x before 15.41.0 contains an improper privilege management vulnerability inv","summary":"Frappe before 14.81.4 and 15.x before 15.41.0 contains an improper privilege management vulnerability involving a certain document action that permits escalation from the Website User role to System Manager. Authenticated attackers with Website User access can combine this document action with additional steps to obtain administrative System Manager privileges in the Frappe application.","source":"NVD","date":"2026-10-12T23:17:18.140Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-58390","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2024-58390"],"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2024-58390"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-58390"}],"epss":null},{"id":"CVE-2023-54412","title":"CVE-2023-54412 — Frappe before 13.46.3 and 14.x before 14.21.1 contains an improper access control vulnerability in Email ","summary":"Frappe before 13.46.3 and 14.x before 14.21.1 contains an improper access control vulnerability in Email Template permissions that allows any authenticated non-guest user to create and edit any Email Template. Attackers with low-privileged accounts, including self-registered users when signup is enabled, can modify Email Templates used by the application.","source":"NVD","date":"2026-10-12T23:17:17.953Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-54412","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2023-54412"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2023-54412"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-54412"}],"epss":null},{"id":"CVE-2023-54411","title":"CVE-2023-54411 — Frappe framework before 13.32.0 uses weak authentication for print view access, because the print view ke","summary":"Frappe framework before 13.32.0 uses weak authentication for print view access, because the print view key can be derived from data exposed by other whitelisted API endpoints. Attackers can generate a valid key to view documents through the print view without proper permissions.","source":"NVD","date":"2026-10-12T23:17:17.783Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-54411","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2023-54411"],"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2023-54411"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-54411"}],"epss":null},{"id":"CVE-2023-54410","title":"CVE-2023-54410 — Frappe before 13.22.0 contains an improper authorization vulnerability that allows authenticated users to","summary":"Frappe before 13.22.0 contains an improper authorization vulnerability that allows authenticated users to rename documents by exploiting a missing permission check. Attackers can invoke the document rename functionality on documents they lack permission to modify, altering records without proper authorization.","source":"NVD","date":"2026-10-12T23:17:17.620Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-54410","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2023-54410"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2023-54410"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-54410"}],"epss":null},{"id":"CVE-2023-54409","title":"CVE-2023-54409 — Frappe before 13.46.1 and 14.x before 14.20.0 contains a cross-site scripting vulnerability because the h","summary":"Frappe before 13.46.1 and 14.x before 14.20.0 contains a cross-site scripting vulnerability because the html2text function weakly sanitizes user input. Authenticated attackers can supply crafted HTML that is insufficiently sanitized by html2text, executing scripts in the browsers of users who view the rendered content.","source":"NVD","date":"2026-10-12T23:17:17.440Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-54409","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2023-54409"],"cvss":{"score":5.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2023-54409"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-54409"}],"epss":null},{"id":"CVE-2023-54408","title":"CVE-2023-54408 — Frappe before 13.52.0 and 14.x before 14.31.0 contains an HTML injection vulnerability caused by weak esc","summary":"Frappe before 13.52.0 and 14.x before 14.31.0 contains an HTML injection vulnerability caused by weak escaping of user-supplied content rendered in pages. Attackers can submit crafted HTML that bypasses the insufficient escaping and is rendered in the browsers of users who view it, enabling cross-site scripting.","source":"NVD","date":"2026-10-12T23:17:17.273Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-54408","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2023-54408"],"cvss":{"score":5.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2023-54408"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-54408"}],"epss":null},{"id":"CVE-2023-54407","title":"CVE-2023-54407 — Frappe 14.x before 14.45.0 contains an information disclosure vulnerability that allows users with error ","summary":"Frappe 14.x before 14.45.0 contains an information disclosure vulnerability that allows users with error log access to view secrets stored in local variables captured in tracebacks. Attackers who can read error logs can extract plaintext secrets such as credentials or keys exposed in traceback local variables.","source":"NVD","date":"2026-10-12T23:17:17.110Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-54407","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2023-54407"],"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2023-54407"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-54407"}],"epss":null},{"id":"CVE-2023-54406","title":"CVE-2023-54406 — Frappe before 14.59.0 and 15.x before 15.5.0 contains a sandbox flaw where the frappe.flags.in_safe_exec ","summary":"Frappe before 14.59.0 and 15.x before 15.5.0 contains a sandbox flaw where the frappe.flags.in_safe_exec global flag can become False during Server Script execution when one server script triggers another. Authenticated high-privileged users can craft a Server Script that triggers other server scripts, such as by saving a document, so the remaining code runs without safe execution protections.","source":"NVD","date":"2026-10-12T23:17:16.930Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-54406","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2023-54406"],"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2023-54406"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-54406"}],"epss":null},{"id":"CVE-2026-92876","title":"CVE-2026-92876 — IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 could allow a remote attacker to cau","summary":"IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 could allow a remote attacker to cause a denial of service due to uncontrolled recursion.","source":"NVD","date":"2026-10-12T22:17:05.947Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92876","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-92876"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-92876"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92876"}],"epss":null},{"id":"CVE-2026-90921","title":"CVE-2026-90921 — IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to ","summary":"IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to improper handling of malformed frames, resulting in termination of the host process.","source":"NVD","date":"2026-10-12T22:17:05.813Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90921","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-90921"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-90921"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90921"}],"epss":null},{"id":"CVE-2026-90920","title":"CVE-2026-90920 — IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to execute arbitrary code due to imp","summary":"IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to execute arbitrary code due to improper control of code generation.","source":"NVD","date":"2026-10-12T22:17:05.683Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90920","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-90920"],"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-90920"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90920"}],"epss":null},{"id":"CVE-2026-90912","title":"CVE-2026-90912 — IBM Maximo AI Service 9.1.0, and 9.2.0 SaaS could allow a remote attacker to cause a denial of service du","summary":"IBM Maximo AI Service 9.1.0, and 9.2.0 SaaS could allow a remote attacker to cause a denial of service due to uncontrolled recursion.","source":"NVD","date":"2026-10-12T22:17:05.550Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90912","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-90912"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-90912"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90912"}],"epss":null},{"id":"CVE-2026-90911","title":"CVE-2026-90911 — IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to ","summary":"IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.","source":"NVD","date":"2026-10-12T22:17:05.417Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90911","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-90911"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-90911"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90911"}],"epss":null},{"id":"CVE-2026-84312","title":"CVE-2026-84312 — Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GetCasdoorUri uses the configu","summary":"Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GetCasdoorUri uses the configured Casdoor application name as a constant OAuth state value and CasdoorCallback does not compare the submitted state with a value bound to the initiating browser session. An unauthenticated attacker can cause a victim's browser to complete an attacker-controlled Casdoor authorization flow, and the callback can mint a Nginx UI session for the identity returned by that authorization code. This issue is fixed in version 2.4.1.","source":"NVD","date":"2026-10-12T22:17:05.263Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84312","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-84312"],"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-84312"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84312"}],"epss":null},{"id":"CVE-2026-54459","title":"CVE-2026-54459 — FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. P","summary":"FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.14.0, FileRise authenticates requests to the file creation and share-link creation handlers but does not enforce the server-side CSRF token check used by adjacent state-changing operations. The POST endpoints /api/file/createFile.php and /api/file/createShareLink.php invoke FileController::createFile and FileController::createShareLink without rejecting a missing or invalid X-CSRF-Token header. A request issued with a logged-in user's session can create an empty file or create a share link with that user's permissions, although the default SameSite=Lax session cookie reduces ordinary cross-site POST reachability. This issue is fixed in version 3.14.0.","source":"NVD","date":"2026-10-12T22:17:04.780Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54459","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-54459"],"cvss":{"score":4.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-54459"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54459"}],"epss":null},{"id":"CVE-2026-53922","title":"CVE-2026-53922 — odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In commit cfddd56 and earl","summary":"odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In commit cfddd56 and earlier, an unauthenticated host on the same link can first obtain two bindings through normal DHCPv6 SOLICIT and REQUEST exchanges and then send a crafted RENEW containing multiple IA_NA options. An earlier matched IA consumes most of the response buffer, an unmatched IA causes the build_ia() status branch to write and return a NOBINDING response larger than the remaining space, and a subsequent matched IA is processed after dhcpv6_ia_handle_IAs() subtracts that over-return from an unsigned size_t. The resulting underflow disables subsequent length checks and permits attacker-controlled IA_ADDR serialization beyond the 512-byte stack buffer pdbuf in handle_client_request(). The stack canary terminates odhcpd, and sustained packets can rep","source":"NVD","date":"2026-10-12T22:17:04.623Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53922","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-53922"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-53922"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53922"}],"epss":null},{"id":"CVE-2026-49484","title":"CVE-2026-49484 — Code for IBM i is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi ","summary":"Code for IBM i is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform. Prior to 3.0.1, src/ui/views/objectBrowser.ts stores Object Browser downloads and the edit-save flow content in the shared /tmp directory without reliable cleanup. On systems where /tmp is accessible to other local accounts, file contents remain readable after download or editing operations. This issue is fixed in version 3.0.1.","source":"NVD","date":"2026-10-12T22:17:04.480Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49484","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-49484"],"cvss":{"score":5.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-49484"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49484"}],"epss":null},{"id":"CVE-2026-49483","title":"CVE-2026-49483 — Code for IBMi is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi p","summary":"Code for IBMi is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform. Prior to 3.0.1, IBMi components implementing IBMiComponent were accepted after checking that a procedure existed without reliably verifying component integrity. Components installed with broad public permissions allow another local account to alter a program such as GETMBRINFO. A later connection can execute the altered program under the connecting account because the LONG_COMMENT marker alone does not establish integrity. This issue is fixed in version 3.0.1.","source":"NVD","date":"2026-10-12T22:17:04.320Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49483","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-49483"],"cvss":{"score":8.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-49483"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49483"}],"epss":null},{"id":"CVE-2026-44828","title":"CVE-2026-44828 — Qexo is an open source online editor for static blogs. From 4.0.0 until 4.2.0, Qexo exposes /api/init_ste","summary":"Qexo is an open source online editor for static blogs. From 4.0.0 until 4.2.0, Qexo exposes /api/init_step/ through init_step_api without authentication, authorization, or a setup-completion guard. An unauthenticated requester with a valid CSRF token obtained from a public page can submit the first initialization step and reset the INIT setting, causing the instance to re-enter the setup flow. The setup response and /init/ page can expose stored PROVIDER configuration, including service credentials, in frontend content. This issue is fixed in version 4.2.0.","source":"NVD","date":"2026-10-12T22:17:04.160Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44828","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-44828"],"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-44828"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44828"}],"epss":null},{"id":"CVE-2026-41210","title":"CVE-2026-41210 — Moonlight Qt is a GameStream client for Windows, macOS, Linux, and Steam Link. In version 6.1.0 and earli","summary":"Moonlight Qt is a GameStream client for Windows, macOS, Linux, and Steam Link. In version 6.1.0 and earlier, after a victim initiates a streaming session to a malicious host, the host can send a crafted H.264 SPS NAL when Moonlight selects a decoder path that does not advertise CAPABILITY_REFERENCE_FRAME_INVALIDATION_AVC. The SPS fixup path in app/streaming/video/ffmpeg.cpp parses the server-provided data with h264bitstream, where attacker-controlled seq_parameter_set_id is used to index the 32-entry sps_table without validation. A value of 32 or greater causes an out-of-bounds write and remote heap corruption in the Moonlight client. The demonstrated impact is a reliable client crash, while code execution is not established. This issue is fixed in version 6.2.0.","source":"NVD","date":"2026-10-12T22:17:03.997Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41210","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-41210"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-41210"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41210"}],"epss":null},{"id":"CVE-2026-108934","title":"CVE-2026-108934 — A security flaw has been discovered in Edimax BR-6208AC 1.32. Affected by this vulnerability is an unknow","summary":"A security flaw has been discovered in Edimax BR-6208AC 1.32. Affected by this vulnerability is an unknown functionality of the file /goform/formUrlb of the component HTTP Blocking Page. Performing a manipulation results in cross site scripting. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-12T22:17:03.810Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108934","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108934"],"cvss":{"score":1.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108934"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108934"}],"epss":null},{"id":"CVE-2026-108933","title":"CVE-2026-108933 — A vulnerability was identified in Edimax BR-6208AC 1.32. Affected is an unknown function of the file /gof","summary":"A vulnerability was identified in Edimax BR-6208AC 1.32. Affected is an unknown function of the file /goform/formFilter. Such manipulation leads to cross site scripting. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-12T22:17:03.630Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108933","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108933"],"cvss":{"score":1.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108933"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108933"}],"epss":null},{"id":"CVE-2026-108932","title":"CVE-2026-108932 — A vulnerability was determined in Netcore NR268 1.7.121109. This impacts the function eval of the file fi","summary":"A vulnerability was determined in Netcore NR268 1.7.121109. This impacts the function eval of the file filter_hosts_dump.cgi of the component DHCP Hostname Handler. This manipulation of the argument Hostname causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-12T22:17:03.430Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108932","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108932"],"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108932"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108932"}],"epss":null},{"id":"CVE-2026-104140","title":"CVE-2026-104140 — QGIS is a free, open source, cross-platform geographic information system. Prior to 3.44.12 and 4.0.0 thr","summary":"QGIS is a free, open source, cross-platform geographic information system. Prior to 3.44.12 and 4.0.0 through 4.2.3, QGIS Server renders feature data in WFS3 (OGC API Features) HTML responses without HTML escaping. Attacker-controlled feature.properties values from a published writable vector layer reach resources/server/api/ogc/templates/wfs3/getFeatures.html through QgsServerOgcApiHandler::htmlDump and the if_nullptr_null_str callback. A user who opens an items HTML page can execute stored markup or script in the QGIS Server origin, which can expose the viewer's session data or issue authenticated requests with the viewer's privileges. This issue is fixed in version 3.44.12.","source":"NVD","date":"2026-10-12T22:17:03.273Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104140","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-104140"],"cvss":{"score":6.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-104140"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104140"}],"epss":null},{"id":"CVE-2026-103658","title":"CVE-2026-103658 — GNU Aspell 0.60.8.2 (first vulnerable version is not known) contains a heap-based buffer overflow write (","summary":"GNU Aspell 0.60.8.2 (first vulnerable version is not known) contains a heap-based buffer overflow write (CWE-122) in its read-only dictionary loader. String::reserve() in common/string.hpp computes its capacity check with a signed int ((int)s + 1), so a requested size of 0x7FFFFFFF wraps negative and the backing buffer is never grown. ReadOnlyDict::load() in modules/speller/default/readonly_ws.cpp passes the unvalidated 32-bit size fields from a .rws dictionary header into this path, so a crafted .rws file with a valid endian marker (12345678) and an oversized length field (e.g. lang_name_size = 0x7FFFFFFF) causes attacker-controlled data to be written out of bounds past an undersized heap allocation. An attacker who induces a victim to load a malicious dictionary — for example via aspell dump master <file> — can corrupt heap memory, resu","source":"NVD","date":"2026-10-12T22:17:03.143Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103658","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-103658"],"cvss":{"score":5.9,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","source":"98a01053-8a31-4f6d-9aa9-252be161adc6"},"read":false,"kev":false,"recordIds":["CVE-2026-103658"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103658"}],"epss":null},{"id":"CVE-2026-102596","title":"CVE-2026-102596 — Nango is an open-source platform for connecting agents and products to third-party APIs. Prior to 0.70.9,","summary":"Nango is an open-source platform for connecting agents and products to third-party APIs. Prior to 0.70.9, on accounts with RBAC enabled through a plan with has_rbac=true, two private flow-read routes, GET /api/v1/integrations/:providerConfigKey/flows and GET /api/v1/flow/:flowName, apply webAuth but omit can({ action: 'read', resource: 'flow', scopedBy: envScope }). A same-team user with the development_full_access role can therefore request env=prod and read production integration flow metadata or named flow configuration despite being denied by guarded production routes. Both controllers use res.locals.environment from the authenticated account, so the issue bypasses the production role boundary but does not cross tenant boundaries. This issue is fixed in version 0.70.9 and managed-1.5.11-0.70.8-aae30d044d7e229807d51a3957c212f3fb689e1a","source":"NVD","date":"2026-10-12T22:17:02.960Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102596","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-102596"],"cvss":{"score":4.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-102596"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102596"}],"epss":null},{"id":"CVE-2026-102539","title":"CVE-2026-102539 — Super Productivity is an advanced todo list app with integrated timeboxing and time tracking capabilities","summary":"Super Productivity is an advanced todo list app with integrated timeboxing and time tracking capabilities. From 17.3.0 until 18.13.1, the SuperSync end-to-end encryption setup calls sync(true) before a user sets an encryption password, causing the operation-upload path to transmit and store all user operations in plaintext. The exposed operations can include private task content and connected issue-provider credentials, including reusable passwords, API tokens, and app passwords. Users who complete E2EE setup have the plaintext operations deleted, while users who leave the password-setting step can leave the data stored indefinitely. The Disable SuperSync action did not remove plaintext that had already been uploaded. Routing and causal metadata remain plaintext by design and are not part of this vulnerability. This issue is fixed in vers","source":"NVD","date":"2026-10-12T22:17:01.967Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102539","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-102539"],"cvss":{"score":5.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-102539"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102539"}],"epss":null},{"id":"https://cyberscoop.com/?p=91070","title":"Flock can now issue CVEs for its own products. Should we trust it?","source":"CyberScoop","date":"2026-10-12T22:11:50.000Z","summary":"Flock joined the CVE Program as a CNA, giving the company authority to assign IDs to vulnerabilities in its own surveillance cameras and license plate readers.  The post Flock can now issue CVEs for its own products.","url":"https://cyberscoop.com/flock-cve-numbering-authority-cna/","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://cyberscoop.com/?p=91070"],"sources":["CyberScoop"],"topics":["Cyber news"],"affected":[],"references":[{"source":"CyberScoop","url":"https://cyberscoop.com/flock-cve-numbering-authority-cna/"}],"epss":null},{"id":"CVE-2026-97691","title":"CVE-2026-97691 — Convex is an open-source reactive database for application developers. Prior to the self-hosted image pub","summary":"Convex is an open-source reactive database for application developers. Prior to the self-hosted image published on August 10, 2026 and local deployment binary precompiled-2026-08-10-c0cb7ae, a malicious user can, in rare cases, perform unauthorized reading of deployment information from a Convex deployment. The maintainer has intentionally withheld the affected component and technical mechanism to protect self-hosted deployments that have not been updated, and no evidence of exploitation is known. Convex cloud deployments were patched automatically. This issue is fixed in the self-hosted image published on August 10, 2026 and local binary precompiled-2026-08-10-c0cb7ae.","source":"NVD","date":"2026-10-12T21:17:24.610Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97691","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-97691"],"cvss":{"score":4.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-97691"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97691"}],"epss":null},{"id":"CVE-2026-96266","title":"CVE-2026-96266 — IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in host firmware co","summary":"IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in host firmware configuration parsing. An attacker with authenticated service-level access to the FSP can write specially crafted configuration data to cause memory corruption in the host firmware boot stage during system IPL, compromising the host firmware boot stack and the hypervisor subsequently loaded by it. Successful exploitation results in a confidentiality, integrity, and availability impact to the managed system.","source":"NVD","date":"2026-10-12T21:17:24.330Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96266","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-96266"],"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-96266"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96266"}],"epss":null},{"id":"CVE-2026-96265","title":"CVE-2026-96265 — IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service proc","summary":"IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to read or modify arbitrary regions of Hostboot memory, compromising the host firmware boot stack and the hypervisor subsequently loaded by it. Successful exploitation results in a confidentiality, integrity, and availability impact to the managed system.","source":"NVD","date":"2026-10-12T21:17:24.190Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96265","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-96265"],"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-96265"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96265"}],"epss":null},{"id":"CVE-2026-96264","title":"CVE-2026-96264 — IBM Power Systems Firmware FW1060.00 through FW1060.81  is affected by a vulnerability in the service pro","summary":"IBM Power Systems Firmware FW1060.00 through FW1060.81  is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to overflow host firmware runtime attribute storage, allowing arbitrary code to be executed in the host firmware runtime. This gives the attacker full access to the managed system's memory and hardware interfaces, resulting in a confidentiality, integrity, and availability impact to the managed system.","source":"NVD","date":"2026-10-12T21:17:24.053Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96264","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-96264"],"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-96264"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96264"}],"epss":null},{"id":"CVE-2026-96263","title":"CVE-2026-96263 — IBM Power Systems Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 throug","summary":"IBM Power Systems Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81 is affected by a vulnerability in the host firmware boot process image validation path. An attacker with service access to the service processor can supply a maliciously crafted code update image, allowing arbitrary code to be executed on the host system. Successful exploitation could result in a confidentiality, integrity, and availability impact to the affected host system.","source":"NVD","date":"2026-10-12T21:17:23.893Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96263","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-96263"],"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-96263"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96263"}],"epss":null},{"id":"CVE-2026-96262","title":"CVE-2026-96262 — IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service proc","summary":"IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to overflow host firmware runtime attribute storage, allowing arbitrary code to be executed in the host firmware runtime. This gives the attacker full access to the managed system's memory and hardware interfaces, resulting in a confidentiality, integrity, and availability impact to the managed system.","source":"NVD","date":"2026-10-12T21:17:23.753Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96262","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-96262"],"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-96262"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96262"}],"epss":null},{"id":"CVE-2026-96261","title":"CVE-2026-96261 — IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in host firmware co","summary":"IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in host firmware configuration parsing. An attacker with authenticated service-level access to the service processor can write specially crafted configuration data, causing the host firmware boot stack to crash with possible memory corruption during system initialisation, resulting in an integrity and availability impact to the managed system.","source":"NVD","date":"2026-10-12T21:17:23.620Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96261","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-96261"],"cvss":{"score":7.3,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-96261"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96261"}],"epss":null},{"id":"CVE-2026-92120","title":"CVE-2026-92120 — OAuth1 Request Replay Attack vulnerability in Apache Allura.\n\n\n\nThis issue affects Apache Allura: through","summary":"OAuth1 Request Replay Attack vulnerability in Apache Allura.\n\n\n\nThis issue affects Apache Allura: through 1.21.0.\n\n\n\nUsers are recommended to upgrade to version 1.22.0 which fixes the issue.","source":"NVD","date":"2026-10-12T21:17:23.490Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92120","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-92120"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-92120"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92120"}],"epss":null},{"id":"CVE-2026-92119","title":"CVE-2026-92119 — REST API Mass Assignment vulnerability in Apache Allura.\n\n\n\nThis issue affects Apache Allura: through 1.2","summary":"REST API Mass Assignment vulnerability in Apache Allura.\n\n\n\nThis issue affects Apache Allura: through 1.21.0.\n\n\n\nUsers are recommended to upgrade to version 1.22.0, which fixes the issue.","source":"NVD","date":"2026-10-12T21:17:23.363Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92119","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-92119"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-92119"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92119"}],"epss":null},{"id":"CVE-2026-92116","title":"CVE-2026-92116 — OAuth1 callback validation vulnerability in Apache Allura.\n\n\n\nThis issue affects Apache Allura: through 1","summary":"OAuth1 callback validation vulnerability in Apache Allura.\n\n\n\nThis issue affects Apache Allura: through 1.21.0.\n\n\n\nUsers are recommended to upgrade to version 1.22.0, which fixes the issue.","source":"NVD","date":"2026-10-12T21:17:23.240Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92116","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-92116"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-92116"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92116"}],"epss":null},{"id":"CVE-2026-84360","title":"CVE-2026-84360 — Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the HTTP configuration mutatio","summary":"Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the HTTP configuration mutation routes require RequireSecureSession, but /mcp and /mcp_message require only ordinary authentication before exposing nginx_config_add and nginx_config_modify. An OTP-enabled user with a normal JWT but no valid X-Secure-Session-ID can therefore create or modify Nginx configuration and trigger reload behavior through MCP, bypassing the intended step-up control. This issue is fixed in version 2.4.1.","source":"NVD","date":"2026-10-12T21:17:22.960Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84360","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-84360"],"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-84360"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84360"}],"epss":null},{"id":"CVE-2026-84321","title":"CVE-2026-84321 — Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GenerateShortToken creates sta","summary":"Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GenerateShortToken creates standalone short-token records without a long Token value, but DeleteUserTokens invalidates cached entries only when the long Token field is nonempty. A revoked short token can therefore remain in the short_token cache and authenticate again if the associated account is re-enabled before the cache entry expires because GetTokenUserByShortToken reads the surviving entry, restoring access to HTTP or WebSocket routes that accept short-token authentication. This issue is fixed in version 2.4.1.","source":"NVD","date":"2026-10-12T21:17:22.817Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84321","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-84321"],"cvss":{"score":5.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-84321"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84321"}],"epss":null},{"id":"CVE-2026-84320","title":"CVE-2026-84320 — Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.3, Nginx UI validates an automati","summary":"Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.3, Nginx UI validates an automatic backup's storage_path, but AutoBackup.GetName returns a user-controlled name without rejecting path separators or parent-directory components, and downstream filename formatting embeds that result in the final archive filename. An authenticated user who can create or modify an automatic backup can cause filepath.Join to resolve the generated archive path outside the validated storage directory, allowing backup archives to be written with the Nginx UI process privileges. For encrypted configuration backups, the adjacent encryption key file can also be written outside the validated directory. This issue is fixed in version 2.4.3.","source":"NVD","date":"2026-10-12T21:17:22.663Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84320","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-84320"],"cvss":{"score":6.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-84320"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84320"}],"epss":null},{"id":"CVE-2026-84319","title":"CVE-2026-84319 — Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the regular HTTP configuration","summary":"Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the regular HTTP configuration API rejects restricted Nginx directives such as load_module, js_import, and js_content. However, the MCP configuration interface allows a secondary authenticated user to write and apply equivalent restricted configuration content. This allows the user to load ngx_http_js_module.so, import attacker-controlled JavaScript, reload Nginx, and execute NJS in the Nginx worker context. This issue is fixed in version 2.4.1.","source":"NVD","date":"2026-10-12T21:17:22.517Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84319","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-84319"],"cvss":{"score":8.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-84319"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84319"}],"epss":null},{"id":"CVE-2026-84318","title":"CVE-2026-84318 — Nginx UI is a web user interface for the Nginx web server. From 2.0.0-rc.6 until 2.4.1, the MCP tool ngin","summary":"Nginx UI is a web user interface for the Nginx web server. From 2.0.0-rc.6 until 2.4.1, the MCP tool nginx_config_add writes nginx configuration files to disk and triggers an nginx reload without calling config.ValidateConfigFile. The identical flow in the REST API (POST /api/configs) does call that function and correctly rejects dangerous directives. An authenticated attacker can exploit this gap to write config files containing any blocked directive (perl, js_import, load_module, user root, etc.), bypassing nginx-ui's entire security layer. On a server with the nginx Perl, njs, or Lua module loaded, this is post-authentication Remote Code Execution. This issue is fixed in version 2.4.1.","source":"NVD","date":"2026-10-12T21:17:22.360Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84318","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-84318"],"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-84318"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84318"}],"epss":null},{"id":"CVE-2026-84317","title":"CVE-2026-84317 — Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, internal/config/validation.go ","summary":"Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, internal/config/validation.go (ValidateConfigFile) is a security control that blocks dangerous nginx directives — js_*, perl_*, load_module of the njs/perl modules, and user root. It is enforced on three of the four config-write paths: api/config/add.go, api/config/modify.go, and mcp/config/config_modify.go. The fourth path — the MCP tool nginx_config_add (mcp/config/config_add.go) — does NOT call it: it writes the caller-supplied content straight to disk and reloads nginx. An authenticated MCP caller (or an MCP agent induced via prompt injection) can therefore inject exactly the directives the control is meant to block, leading to nginx code execution on deployments where the njs/perl module is available (e.g. the official Docker image). This issue is fixed in ver","source":"NVD","date":"2026-10-12T21:17:22.213Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84317","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-84317"],"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-84317"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84317"}],"epss":null},{"id":"CVE-2026-84316","title":"CVE-2026-84316 — Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, config.ValidateConfigDirective","summary":"Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, config.ValidateConfigDirectives splits configuration by newline and checks only the first directive token on each line even though Nginx permits multiple semicolon-separated directives on one line. An authenticated caller can place a benign directive first and a restricted load_module, js_import, perl, or user root directive later on the same line, or can use an unrestricted include directive to load restricted content. These mechanisms bypass validation on REST, nginx_config_modify, site, and stream write paths; when an executable module is available, the injected configuration can execute code in the Nginx worker context. This issue is fixed in version 2.4.1.","source":"NVD","date":"2026-10-12T21:17:22.067Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84316","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-84316"],"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-84316"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84316"}],"epss":null},{"id":"CVE-2026-84315","title":"CVE-2026-84315 — Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, Nginx UI does not apply Requir","summary":"Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, Nginx UI does not apply RequireSecureSession to multiple authenticated mutation routes even though OTP-enabled users are expected to present a fresh X-Secure-Session-ID for sensitive actions. A stolen authenticated session can therefore create or alter automatic backups, DNS credentials and records, certificates and ACME users, Nginx control settings, and site or stream automation without completing the OTP or passkey step-up. This issue is fixed in version 2.4.1.","source":"NVD","date":"2026-10-12T21:17:21.900Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84315","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-84315"],"cvss":{"score":8.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-84315"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84315"}],"epss":null},{"id":"CVE-2026-84314","title":"CVE-2026-84314 — Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the POST /api/users/:id user-m","summary":"Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the POST /api/users/:id user-management endpoint permits an authenticated user to change another user's password without passing RequireSecureSession, even though the self-service password-change path requires that step-up. An attacker with an authenticated account can change the initial administrator's password, invalidate existing administrator tokens, and then authenticate as the administrator. This issue is fixed in version 2.4.1.","source":"NVD","date":"2026-10-12T21:17:21.753Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84314","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-84314"],"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-84314"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84314"}],"epss":null},{"id":"CVE-2026-84313","title":"CVE-2026-84313 — Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, POST /api/otp_enroll and POST ","summary":"Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, POST /api/otp_enroll and POST /api/finish_passkey_register are registered outside RequireSecureSession and accept a normal authenticated session without verifying the current password. An attacker with a stolen JWT can bind an attacker-controlled TOTP secret when the victim has not already enabled TOTP, or can register an attacker-controlled passkey because that path has no equivalent existing-enrollment guard. These changes create persistent account access that can survive a password change and interfere with the legitimate user's authentication. This issue is fixed in version 2.4.1.","source":"NVD","date":"2026-10-12T21:17:21.597Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84313","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-84313"],"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-84313"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84313"}],"epss":null},{"id":"CVE-2026-78673","title":"CVE-2026-78673 — IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to ","summary":"IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to improper input validation.","source":"NVD","date":"2026-10-12T21:17:21.463Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78673","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-78673"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-78673"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78673"}],"epss":null},{"id":"CVE-2026-75881","title":"CVE-2026-75881 — IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 could allow a remote attacker to cau","summary":"IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 could allow a remote attacker to cause a denial of service due to an infinite parsing loop when processing certain inputs.","source":"NVD","date":"2026-10-12T21:17:21.337Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75881","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-75881"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-75881"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75881"}],"epss":null},{"id":"CVE-2026-58462","title":"CVE-2026-58462 — Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.","summary":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.","source":"NVD","date":"2026-10-12T21:17:21.260Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58462","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-58462"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-58462"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58462"}],"epss":null},{"id":"CVE-2026-53997","title":"CVE-2026-53997 — Netherman Portal del Hermano (portaldelhermano.es) before 2026-10-06 contains a broken authentication vul","summary":"Netherman Portal del Hermano (portaldelhermano.es) before 2026-10-06 contains a broken authentication vulnerability in its password-recovery flow at the POST /password/create-access and POST /password/email endpoints, allowing unauthenticated attackers to take over any member account across all tenants by exploiting the lack of rate limiting and distinct error messages that act as oracles for each of the four identity-verification factors (DNI, date of birth, phone number, last four IBAN digits). Attackers can confirm the DNI via the oracle, brute-force the date of birth and IBAN digits, obtain the phone number through open-source intelligence, then submit an attacker-controlled email field so the password reset link is delivered to them, enabling full account takeover including profile data, full IBAN, and fiscal documents.","source":"NVD","date":"2026-10-12T21:17:17.400Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53997","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-53997"],"cvss":{"score":9.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-53997"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53997"}],"epss":null},{"id":"CVE-2026-41508","title":"CVE-2026-41508 — OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.4.0 until 3.","summary":"OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.4.0 until 3.8.0, the multipart processor in internal/bodyprocessors/multipart.go treats io.ErrUnexpectedEOF as nonfatal without setting MULTIPART_STRICT_ERROR. A remote attacker can submit a truncated multipart body that produces io.ErrUnexpectedEOF, causing parsing to stop without raising the strict-error signal used by the recommended defensive rule. Rules 200002 and 200003 do not fire, allowing multipart parser-disagreement payloads to reach a backend that interprets the truncated body differently. This issue is fixed in version 3.8.0.","source":"NVD","date":"2026-10-12T21:17:17.240Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41508","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-41508","GHSA-R3RM-QPHW-HH76"],"cvss":{"score":5.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-41508","GHSA-r3rm-qphw-hh76"],"sources":["NVD","GitHub Advisories"],"topics":["New vulnerabilities","Code & supply chain"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41508"},{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-r3rm-qphw-hh76"}],"epss":null},{"id":"CVE-2026-41504","title":"CVE-2026-41504 — OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.","summary":"OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the Native audit-log formatter in internal/auditlog/formats.go writes attacker-influenced request and response fields without neutralizing carriage returns or line feeds. When SecAuditLogFormat Native is enabled, injected line breaks can create forged lines inside a transaction record. An attacker who controls request or response body, header, error-message, or matched-rule data can inject carriage returns and line feeds that appear as forged audit lines within a transaction record. The forged content can mislead operators and line-oriented SIEM processing, although the unpredictable transaction boundary prevents straightforward impersonation of a separate complete session. This issue is fixed in version 3.8.0.","source":"NVD","date":"2026-10-12T21:17:17.080Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41504","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-41504","GHSA-PRPW-WWV7-XJJR"],"cvss":{"score":5.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-41504","GHSA-prpw-wwv7-xjjr"],"sources":["NVD","GitHub Advisories"],"topics":["New vulnerabilities","Code & supply chain"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41504"},{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-prpw-wwv7-xjjr"}],"epss":null},{"id":"CVE-2026-18537","title":"CVE-2026-18537 — IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to imp","summary":"IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper input validation due to an unsanitised container image reference in a Kubernetes operator template.","source":"NVD","date":"2026-10-12T21:17:16.940Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18537","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-18537"],"cvss":{"score":8.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-18537"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18537"}],"epss":null},{"id":"CVE-2026-18533","title":"CVE-2026-18533 — IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to imp","summary":"IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper input validation due to an unsanitised container image configuration in a Kubernetes operator template.","source":"NVD","date":"2026-10-12T21:17:16.793Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18533","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-18533"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-18533"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18533"}],"epss":null},{"id":"CVE-2026-18529","title":"CVE-2026-18529 — IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to com","summary":"IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to command injection due to improper sanitisation of a user-controlled value passed to a shell command in a Kubernetes operator task.","source":"NVD","date":"2026-10-12T21:17:16.653Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18529","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-18529"],"cvss":{"score":8.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-18529"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18529"}],"epss":null},{"id":"CVE-2026-18517","title":"CVE-2026-18517 — IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 IBM Maximo Applicati","summary":"IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 IBM Maximo Application Suite — Location Service for Esri Component is vulnerable to unintended network egress due to a misconfigured Kubernetes NetworkPolicy.","source":"NVD","date":"2026-10-12T21:17:16.517Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18517","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-18517"],"cvss":{"score":7.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-18517"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18517"}],"epss":null},{"id":"CVE-2026-18513","title":"CVE-2026-18513 — IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to imp","summary":"IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper access control due to a schema-less Custom Resource Definition.","source":"NVD","date":"2026-10-12T21:17:16.380Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18513","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-18513"],"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-18513"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18513"}],"epss":null},{"id":"CVE-2026-16678","title":"CVE-2026-16678 — IBM Power Systems Firmware FW1110.00 through FW1110.31, FW1120.00 through FW1120.01, and FW1060.00 throug","summary":"IBM Power Systems Firmware FW1110.00 through FW1110.31, FW1120.00 through FW1120.01, and FW1060.00 through FW1060.81 could allow a remote authenticated attacker to cause a denial of service by exhausting connection resources due to improper resource management.","source":"NVD","date":"2026-10-12T21:17:15.630Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16678","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-16678"],"cvss":{"score":4.5,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-16678"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16678"}],"epss":null},{"id":"CVE-2026-109571","title":"CVE-2026-109571 — Fire-Boltt BSW013 smartwatch firmware through V0.0.8 contains a missing authentication vulnerability that","summary":"Fire-Boltt BSW013 smartwatch firmware through V0.0.8 contains a missing authentication vulnerability that allows unpaired BLE devices to subscribe to the Heart Rate Measurement characteristic (0x2A37). Attackers within Bluetooth range can receive the wearer's live heart rate readings without pairing, bonding, or any confirmation on the watch.","source":"NVD","date":"2026-10-12T21:17:13.960Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109571","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109571"],"cvss":{"score":2.3,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109571"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109571"}],"epss":null},{"id":"CVE-2026-109570","title":"CVE-2026-109570 — Fire-Boltt BSW013 smartwatch firmware through V0.0.8 contains a missing authentication vulnerability that","summary":"Fire-Boltt BSW013 smartwatch firmware through V0.0.8 contains a missing authentication vulnerability that allows unpaired attackers to inject notifications by writing to the proprietary BLE command characteristic. Attackers within Bluetooth range can craft commands protected only by a CRC-16/ARC checksum to vibrate the watch and display spoofed alert text for phishing.","source":"NVD","date":"2026-10-12T21:17:13.810Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109570","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109570"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109570"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109570"}],"epss":null},{"id":"CVE-2026-109569","title":"CVE-2026-109569 — sandboxed.sh through 1.3.0 contains a container escape vulnerability that allows code in container worksp","summary":"sandboxed.sh through 1.3.0 contains a container escape vulnerability that allows code in container workspaces to access the host filesystem because nsenter attaches without --root. Agent-run code in a container workspace can resolve absolute paths on the host to read and modify host files, bypassing documented isolation.","source":"NVD","date":"2026-10-12T21:17:13.653Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109569","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109569"],"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109569"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109569"}],"epss":null},{"id":"CVE-2026-109568","title":"CVE-2026-109568 — Shaark 1.2.13 through 1.2.44 contains a missing authorization vulnerability in the Link, Story, Chest and","summary":"Shaark 1.2.13 through 1.2.44 contains a missing authorization vulnerability in the Link, Story, Chest and Album API controllers that skips ownership checks. Authenticated non-admin users can send PUT or DELETE requests to /api/{link,story,chest,album}/{id} with numeric IDs to overwrite or delete other users' content, including private items.","source":"NVD","date":"2026-10-12T21:17:13.500Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109568","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109568"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109568"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109568"}],"epss":null},{"id":"CVE-2026-109567","title":"CVE-2026-109567 — Rapyd Admin from 9.0.0 before 9.20.0 contains an improper privilege management vulnerability in the Users","summary":"Rapyd Admin from 9.0.0 before 9.20.0 contains an improper privilege management vulnerability in the UsersEdit Livewire component that allows users with the edit users permission to assign themselves the admin role. Attackers holding roles such as the shipped operator role can submit the admin role ID for their own account, lifting tenant scoping, bypassing per-record authorization, and enabling impersonation.","source":"NVD","date":"2026-10-12T21:17:13.347Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109567","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109567"],"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109567"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109567"}],"epss":null},{"id":"CVE-2026-109566","title":"CVE-2026-109566 — Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerability that allows remote u","summary":"Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerability that allows remote unauthenticated attackers to gain super-admin access through an AuthSeeder-created admin@laravel account with password admin. The account is seeded by the setup installer and silently re-created on every rpd:make run, letting attackers log in as a global super admin bypassing per-record authorization and tenant scoping.","source":"NVD","date":"2026-10-12T21:17:13.190Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109566","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109566"],"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109566"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109566"}],"epss":null},{"id":"CVE-2026-109565","title":"CVE-2026-109565 — Rapyd Admin from 9.4.0 before 9.20.0 contains a stored cross-site scripting vulnerability that allows una","summary":"Rapyd Admin from 9.4.0 before 9.20.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through self-registered display names. Attackers can register with an HTML or JavaScript name rendered unescaped in the Activity log Author filter, executing in an administrator's session.","source":"NVD","date":"2026-10-12T21:17:13.023Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109565","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109565"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109565"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109565"}],"epss":null},{"id":"CVE-2026-109564","title":"CVE-2026-109564 — LearnHouse before 1.4.0 contains a missing authorization vulnerability in POST /api/v1/playgrounds/{uuid}","summary":"LearnHouse before 1.4.0 contains a missing authorization vulnerability in POST /api/v1/playgrounds/{uuid}/duplicate that skips the read-access and draft checks enforced by get_playground. Authenticated users with playground creation rights, such as Instructors, who know a RESTRICTED or unpublished playground UUID can copy its html_content and republish it publicly.","source":"NVD","date":"2026-10-12T21:17:12.863Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109564","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109564"],"cvss":{"score":2.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109564"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109564"}],"epss":null},{"id":"CVE-2026-109563","title":"CVE-2026-109563 — N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number p","summary":"N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that backtracks quadratically on long digit runs. Attackers can supply untrusted Turtle or N3 input containing long runs of digits that do not end a number, blocking the Node.js event loop and causing denial of service.","source":"NVD","date":"2026-10-12T21:17:12.713Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109563","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109563"],"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109563"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109563"}],"epss":null},{"id":"CVE-2026-109562","title":"CVE-2026-109562 — SnapOtter 1.15.10 through 2.2.0 contains a missing authorization vulnerability that allows any authentica","summary":"SnapOtter 1.15.10 through 2.2.0 contains a missing authorization vulnerability that allows any authenticated principal to call the /api/v1/upload, /api/v1/preview and /api/v1/preview/generate handlers without permission checks. Attackers holding even a settings:read-scoped API key can stage arbitrary files outside storage quota, served unauthenticated via /api/v1/download, and feed crafted input to image and video decoders.","source":"NVD","date":"2026-10-12T21:17:12.560Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109562","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109562"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109562"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109562"}],"epss":null},{"id":"CVE-2026-109561","title":"CVE-2026-109561 — goose from 1.28.0 before 1.44.0 contains an authorization bypass vulnerability that allows tools to run w","summary":"goose from 1.28.0 before 1.44.0 contains an authorization bypass vulnerability that allows tools to run without user approval in Manual Approval mode because persisted read-only annotations are never cleared by update_goose_mode. After a session uses Smart Approval mode, prompt-injected calls to tools annotated readOnlyHint: true execute without prompting, bypassing the user's selected approval mode in PermissionInspector::inspect.","source":"NVD","date":"2026-10-12T21:17:12.403Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109561","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109561"],"cvss":{"score":2.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109561"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109561"}],"epss":null},{"id":"CVE-2026-109560","title":"CVE-2026-109560 — Continue CLI (@continuedev/cli) through 1.5.47 contains a permission bypass vulnerability that allows att","summary":"Continue CLI (@continuedev/cli) through 1.5.47 contains a permission bypass vulnerability that allows attackers to run unapproved commands by chaining them after allowed Bash prefix rules. Attackers can inject instructions into repository files or fetched pages so the agent appends commands after ;, && or | to execute code as the user.","source":"NVD","date":"2026-10-12T21:17:12.243Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109560","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109560"],"cvss":{"score":7.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109560"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109560"}],"epss":null},{"id":"CVE-2026-109559","title":"CVE-2026-109559 — EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that lets attackers load a","summary":"EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that lets attackers load arbitrary origins in the main window via string-prefix URL matching. Attackers can embed a link using userinfo syntax after the dev-server prefix, for example in a note-template preview, to obtain the edgeeverDesktop bridge including session token, sidecar RPC, and ACP channels.","source":"NVD","date":"2026-10-12T21:17:12.090Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109559","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109559"],"cvss":{"score":8.4,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109559"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109559"}],"epss":null},{"id":"CVE-2026-109558","title":"CVE-2026-109558 — EdgeEver 1.6.0 through 1.112.0 contains a stored cross-site scripting vulnerability in TemplatesPane.tsx ","summary":"EdgeEver 1.6.0 through 1.112.0 contains a stored cross-site scripting vulnerability in TemplatesPane.tsx that renders template contentMarkdown with raw HTML via dangerouslySetInnerHTML without sanitization. Attackers can write templates containing HTML event handlers through an API or MCP token to run script on preview and access the privileged window.edgeeverDesktop bridge.","source":"NVD","date":"2026-10-12T21:17:11.940Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109558","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109558"],"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109558"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109558"}],"epss":null},{"id":"CVE-2026-109557","title":"CVE-2026-109557 — EdgeEver through 1.112.0 contains a stored cross-site scripting vulnerability in setMemoDragPreview that ","summary":"EdgeEver through 1.112.0 contains a stored cross-site scripting vulnerability in setMemoDragPreview that allows attackers to inject script through notebook names or memo titles. Attackers can set malicious names via MCP create_notebook, rename_notebook or create_memo tools, running script on drag with access to the desktop bridge's session token.","source":"NVD","date":"2026-10-12T21:17:11.790Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109557","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109557"],"cvss":{"score":8.4,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109557"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109557"}],"epss":null},{"id":"CVE-2026-109556","title":"CVE-2026-109556 — EdgeEver Desktop 1.92.0 through 1.112.0 contains a remote code execution vulnerability in the desktop:acp","summary":"EdgeEver Desktop 1.92.0 through 1.112.0 contains a remote code execution vulnerability in the desktop:acp-probe IPC handler, which lacks a sender check and spawns a caller-supplied input.path executable. Attackers with script execution in a renderer, such as via template-preview or drag-preview stored cross-site scripting, can call probeAcpAdapter to launch local executables with the user's privileges.","source":"NVD","date":"2026-10-12T21:17:11.617Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109556","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109556"],"cvss":{"score":7.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109556"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109556"}],"epss":null},{"id":"CVE-2026-109427","title":"CVE-2026-109427 — Telegram-Stremio through 5.1.0 contains a broken object-level authorization vulnerability that allows aut","summary":"Telegram-Stremio through 5.1.0 contains a broken object-level authorization vulnerability that allows authenticated token holders to access arbitrary chat messages by forging unsigned, unauthenticated stream IDs decoded via encode_string/decode_string functions. Attackers can craft or enumerate sequential msg_id values and set a global flag in the stream_handler endpoint to route requests through the operator's personal Userbot account, exposing private channels, groups, and Saved Messages, while the unauthenticated thumb_handler endpoint further discloses thumbnails from those same chats without any token validation.","source":"NVD","date":"2026-10-12T21:17:11.460Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109427","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109427"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109427"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109427"}],"epss":null},{"id":"CVE-2026-109426","title":"CVE-2026-109426 — Telegram-Stremio through 5.1.0 contains an insecure storage vulnerability that allows attackers with acce","summary":"Telegram-Stremio through 5.1.0 contains an insecure storage vulnerability that allows attackers with access to the MongoDB database, backups, or logs to recover the operator's authenticated Telegram session string, which is protected only by a keyless, reversible encoding transform rather than actual encryption. Attackers can round-trip the stored value through the repository's own decode_string function with no secret key to obtain a fully authenticated Telegram session, granting complete control of the operator's Telegram account even when two-step verification is enabled.","source":"NVD","date":"2026-10-12T21:17:11.310Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109426","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109426"],"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109426"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109426"}],"epss":null},{"id":"CVE-2026-109380","title":"CVE-2026-109380 — modern-tar 0.3.5 through 0.8.5 contains a memory exhaustion vulnerability that allows attackers to produc","summary":"modern-tar 0.3.5 through 0.8.5 contains a memory exhaustion vulnerability that allows attackers to produce negative entry sizes via non-octal bytes parsed by readOctal(). Attackers can supply a crafted, optionally gzip-compressed, archive to unpackTar() that buffers chunks indefinitely, exhausting process memory and suppressing later entries.","source":"NVD","date":"2026-10-12T21:17:11.153Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109380","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109380"],"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109380"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109380"}],"epss":null},{"id":"CVE-2026-109379","title":"CVE-2026-109379 — Cockpit CMS 2.14.1 contains an observable timing discrepancy vulnerability that allows unauthenticated at","summary":"Cockpit CMS 2.14.1 contains an observable timing discrepancy vulnerability that allows unauthenticated attackers to enumerate accounts due to an incomplete timing fix in /auth/check. Attackers can post login attempts and measure response times, since existing accounts incur two bcrypt operations versus one, revealing valid usernames and email addresses.","source":"NVD","date":"2026-10-12T21:17:11.000Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109379","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109379"],"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109379"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109379"}],"epss":null},{"id":"CVE-2026-109378","title":"CVE-2026-109378 — SPIP before 4.4.18 contains a server-side request forgery vulnerability in recuperer_url() in ecrire/inc/","summary":"SPIP before 4.4.18 contains a server-side request forgery vulnerability in recuperer_url() in ecrire/inc/distant.php that follows up to 10 redirects without re-validating targets with valider_url_distante(). Authenticated attackers can supply a remote URL, such as a syndicated site feed or remote document, that redirects to internal or link-local addresses including cloud metadata endpoints.","source":"NVD","date":"2026-10-12T21:17:10.823Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109378","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109378"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109378"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109378"}],"epss":null},{"id":"CVE-2026-109377","title":"CVE-2026-109377 — ERPNext 9.0.0 through 16.50.0 contains a missing authorization vulnerability that allows authenticated us","summary":"ERPNext 9.0.0 through 16.50.0 contains a missing authorization vulnerability that allows authenticated users to view stock quantities via whitelisted batch methods. Attackers, including customer portal users, can call get_batch_qty, get_batches_by_oldest or get_pos_reserved_batch_qty to list every item batch with per-warehouse quantities.","source":"NVD","date":"2026-10-12T21:17:10.650Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109377","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109377"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109377"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109377"}],"epss":null},{"id":"CVE-2026-109376","title":"CVE-2026-109376 — ERPNext 15.55.0 through 16.50.0 contains an incorrect authorization vulnerability in the get_timesheet_ht","summary":"ERPNext 15.55.0 through 16.50.0 contains an incorrect authorization vulnerability in the get_timesheet_html method that lets authenticated portal users view project Timesheets. The method only checks Project read access, ignoring hide_timesheets and project membership, so attackers can retrieve timesheet names, status, time-log dates and last modifiers.","source":"NVD","date":"2026-10-12T21:17:10.480Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109376","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109376"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109376"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109376"}],"epss":null},{"id":"CVE-2026-109375","title":"CVE-2026-109375 — Vercel deepsec from 0.1.0 before 1.1.17 contains a link following vulnerability in extractTarballLocally ","summary":"Vercel deepsec from 0.1.0 before 1.1.17 contains a link following vulnerability in extractTarballLocally that allows sandboxed code to write files outside the sandbox by planting links in result tarballs. Attackers controlling sandbox code, such as a prompt-injected coding agent, can plant symbolic or hard links in the host data directory to write arbitrary files on the orchestrator host.","source":"NVD","date":"2026-10-12T21:17:10.293Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109375","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109375"],"cvss":{"score":4.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109375"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109375"}],"epss":null},{"id":"CVE-2026-108931","title":"CVE-2026-108931 — A vulnerability was found in Netcore NR268 1.7.121109. This affects the function eval of the file dhcp_dy","summary":"A vulnerability was found in Netcore NR268 1.7.121109. This affects the function eval of the file dhcp_dynamicip_show.cgi of the component DHCP Handler. The manipulation of the argument Hostname results in cross site scripting. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-12T21:17:09.773Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108931","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108931"],"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108931"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108931"}],"epss":null},{"id":"CVE-2026-108930","title":"CVE-2026-108930 — A vulnerability has been found in Netcore NR268 1.7.121109. The impacted element is the function ddns_wan","summary":"A vulnerability has been found in Netcore NR268 1.7.121109. The impacted element is the function ddns_wan_list_show of the file ddns_wan_list_show.cgi of the component DDNS Handler. The manipulation of the argument user_idN/passwordN leads to information disclosure. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-12T21:17:09.590Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108930","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108930"],"cvss":{"score":2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108930"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108930"}],"epss":null},{"id":"CVE-2026-108929","title":"CVE-2026-108929 — A flaw has been found in Netcore NR268 1.7.121109. The affected element is the function execvp of the fil","summary":"A flaw has been found in Netcore NR268 1.7.121109. The affected element is the function execvp of the file /router/DDNSset.cgi of the component DDNS. Executing a manipulation of the argument Hostname can lead to argument injection. The attack can be launched remotely.","source":"NVD","date":"2026-10-12T21:17:09.410Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108929","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108929"],"cvss":{"score":9.4,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108929"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108929"}],"epss":null},{"id":"CVE-2026-108928","title":"CVE-2026-108928 — A security vulnerability has been detected in itsourcecode Online Admission System 1.0. This issue affect","summary":"A security vulnerability has been detected in itsourcecode Online Admission System 1.0. This issue affects some unknown processing of the file /admin/sum.php. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.","source":"NVD","date":"2026-10-12T21:17:09.230Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108928","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108928"],"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108928"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108928"}],"epss":null},{"id":"CVE-2026-108927","title":"CVE-2026-108927 — A weakness has been identified in itsourcecode Baptism Information Management System 1.0. This vulnerabil","summary":"A weakness has been identified in itsourcecode Baptism Information Management System 1.0. This vulnerability affects unknown code of the file pbaptism.php. This manipulation of the argument b_id causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.","source":"NVD","date":"2026-10-12T21:17:09.040Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108927","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108927"],"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108927"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108927"}],"epss":null},{"id":"CVE-2026-106495","title":"CVE-2026-106495 — Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-de","summary":"Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package is affected by improper access control in backend action invocation. An authenticated user could invoke actions that an operator had excluded through action configuration. Existing action permissions and downstream authorization remain enforced. This issue is fixed in version 0.17.8.","source":"NVD","date":"2026-10-12T21:17:08.457Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106495","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-106495"],"cvss":{"score":4.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-106495"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106495"}],"epss":null},{"id":"CVE-2026-105052","title":"CVE-2026-105052 — IBM Maximo Application Suite 8.10, 8.11, 9.0, 9.1, and 9.2 could allow a remote attacker to traverse dire","summary":"IBM Maximo Application Suite 8.10, 8.11, 9.0, 9.1, and 9.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing \"dot dot\" sequences (/../) to view arbitrary files on the system.","source":"NVD","date":"2026-10-12T21:17:08.300Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105052","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-105052"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-105052"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105052"}],"epss":null},{"id":"CVE-2025-71429","title":"CVE-2025-71429 — GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in tools/uvr5/vr.py that ","summary":"GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in tools/uvr5/vr.py that allows unauthenticated attackers to execute commands via output folder paths. Attackers can enter shell substitutions like $(...) in the UVR5 WebUI output folder textboxes with mp3 or m4a export to run commands as the server user.","source":"NVD","date":"2026-10-12T21:17:07.817Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71429","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2025-71429"],"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2025-71429"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71429"}],"epss":null},{"id":"CVE-2024-58389","title":"CVE-2024-58389 — HoloViz Panel from 1.2.2 before 1.9.0 contains an open redirect vulnerability in panel/auth.py that allow","summary":"HoloViz Panel from 1.2.2 before 1.9.0 contains an open redirect vulnerability in panel/auth.py that allows remote attackers to redirect users by supplying an unvalidated next query parameter. BasicLoginHandler and PasswordLoginHandler store the parameter in a next_url cookie, so crafted login links send victims to attacker-controlled external sites after successful login.","source":"NVD","date":"2026-10-12T21:17:06.667Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-58389","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2024-58389"],"cvss":{"score":5.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2024-58389"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-58389"}],"epss":null},{"id":"CVE-2022-51020","title":"CVE-2022-51020 — Flower before 2.2.0 contains a cross-site request forgery vulnerability because Tornado xsrf_cookies is d","summary":"Flower before 2.2.0 contains a cross-site request forgery vulnerability because Tornado xsrf_cookies is disabled and the OAuth session cookie lacks SameSite. Attackers can lure authenticated users to malicious pages that POST to /api/worker/shutdown, /api/worker/pool/restart, or /api/task/revoke to shut down Celery workers, resize pools, and revoke tasks.","source":"NVD","date":"2026-10-12T21:17:06.227Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-51020","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2022-51020"],"cvss":{"score":6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2022-51020"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-51020"}],"epss":null},{"id":"CVE-2021-48012","title":"CVE-2021-48012 — fast-toml through 0.5.4 contains a prototype pollution vulnerability that allows attackers to modify Obje","summary":"fast-toml through 0.5.4 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying TOML containing __proto__, constructor or prototype key segments. Attackers can pass [__proto__] or [constructor.prototype] table headers or __proto__.x dotted keys to parse() to pollute all objects, causing denial of service or authorization bypass.","source":"NVD","date":"2026-10-12T21:17:06.057Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-48012","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2021-48012"],"cvss":{"score":8.8,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2021-48012"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-48012"}],"epss":null},{"id":"CVE-2021-48011","title":"CVE-2021-48011 — Servor 1.0.0 through 4.0.2 contains a path traversal vulnerability that allows unauthenticated remote att","summary":"Servor 1.0.0 through 4.0.2 contains a path traversal vulnerability that allows unauthenticated remote attackers to escape the served root by sending URL-encoded dot segments. Attackers can send %2e%2e/ sequences, which decodeURI() decodes before path.join() in serveStaticFile and serveDirectoryListing, to read arbitrary files and list directories outside the root.","source":"NVD","date":"2026-10-12T21:17:05.903Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-48011","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2021-48011"],"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2021-48011"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-48011"}],"epss":null},{"id":"CVE-2020-37280","title":"CVE-2020-37280 — cbor-sync through 1.0.4 contains a resource exhaustion vulnerability in CBOR.decode that trusts declared ","summary":"cbor-sync through 1.0.4 contains a resource exhaustion vulnerability in CBOR.decode that trusts declared array and map lengths without checking remaining input. Remote attackers can supply a tiny crafted CBOR payload declaring huge lengths to drive billions of iterations, exhausting CPU and process memory.","source":"NVD","date":"2026-10-12T21:17:05.733Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-37280","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2020-37280"],"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2020-37280"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-37280"}],"epss":null},{"id":"CVE-2020-37279","title":"CVE-2020-37279 — easy-pdf-merge 0.1.0 through 0.2.6 contains an OS command injection vulnerability that allows attackers t","summary":"easy-pdf-merge 0.1.0 through 0.2.6 contains an OS command injection vulnerability that allows attackers to execute commands by injecting shell metacharacters into source paths, destination path, or maxHeap option. Attackers can supply file names or options containing double quotes, semicolons, $() or backticks, which child_process.exec() runs through a shell with the Node.js process privileges.","source":"NVD","date":"2026-10-12T21:17:05.570Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-37279","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2020-37279"],"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2020-37279"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-37279"}],"epss":null},{"id":"CVE-2026-96012","title":"CVE-2026-96012 — IBM Db2 Mirror for i 7.4, 7.5, and 7.6 is vulnerable to privilege escalation. An authenticated attacker c","summary":"IBM Db2 Mirror for i 7.4, 7.5, and 7.6 is vulnerable to privilege escalation. An authenticated attacker could craft a malicious request that bypasses additional authorization and input validation checks to execute malicious code. An attacker could exploit this vulnerability to obtain elevated privileges on the system.","source":"NVD","date":"2026-10-12T20:17:10.723Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96012","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-96012"],"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-96012"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96012"}],"epss":null},{"id":"CVE-2026-95838","title":"CVE-2026-95838 — containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd's l","summary":"containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd's layer unpack handler repeatedly traverses directories for certain opaque whiteout configurations. A malicious image layer can trigger repeated directory traversals while opaque whiteouts are processed. Pulling or importing the image can consume CPU, delay container startup, and reduce image-pull concurrency for unrelated deployments. This issue is fixed in versions 1.7.35, 2.0.12, 2.2.8, and 2.3.5.","source":"NVD","date":"2026-10-12T20:17:10.577Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95838","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-95838"],"cvss":{"score":4.6,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-95838"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95838"}],"epss":null},{"id":"CVE-2026-95837","title":"CVE-2026-95837 — containerd is an open-source container runtime. From 2.1.0 until 2.2.7 and 2.3.4, containerd's CRI Create","summary":"containerd is an open-source container runtime. From 2.1.0 until 2.2.7 and 2.3.4, containerd's CRI CreateContainer checkpoint restore is vulnerable because CRIU restores process security state from checkpoint data instead of enforcing the destination ContainerConfig. An attacker who can create a container from a crafted checkpoint can supply restored credentials, capabilities, no_new_privs, and seccomp state. The restored process can run as root with full capabilities and no enforced seccomp filters while CRI status reports the requested configuration. Systems that do not use CRI checkpoint restore are not affected. This issue is fixed in versions 2.2.7 and 2.3.4.","source":"NVD","date":"2026-10-12T20:17:10.420Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95837","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-95837"],"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-95837"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95837"}],"epss":null},{"id":"CVE-2026-41510","title":"CVE-2026-41510 — OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.","summary":"OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, Coraza silently drops arguments after SecArgumentsLimit in internal/corazawaf/transaction.go, while internal/bodyprocessors/urlencoded.go writes ARGS_POST without enforcing the cap. The flaw is triggered when an unauthenticated attacker sends more arguments than SecArgumentsLimit or supplies bodies that expand beyond the configured argument and flattening budgets. An unauthenticated attacker can flood requests with arguments so excess values are silently omitted from ARGS, ARGS_GET, ARGS_NAMES, ARGS_GET_NAMES, ARGS_POST, or ARGS_PATH before security rules inspect them; affected urlencoded and JSON processing can also consume excessive memory. The omission can bypass WAF rules protecting the downstream application, and unbounded or","source":"NVD","date":"2026-10-12T20:17:09.793Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41510","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-41510","GHSA-6R3Q-MJV7-XR8M"],"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-41510","GHSA-6r3q-mjv7-xr8m"],"sources":["NVD","GitHub Advisories"],"topics":["New vulnerabilities","Code & supply chain"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41510"},{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-6r3q-mjv7-xr8m"}],"epss":null},{"id":"CVE-2026-109575","title":"CVE-2026-109575 — In HAProxy Data Plane API 2.2.0 through 3.4.3 (and corresponding Enterprise Edition releases), Server.Con","summary":"In HAProxy Data Plane API 2.2.0 through 3.4.3 (and corresponding Enterprise Edition releases), Server.ConfigureAPI() has process-global authentication logic that improperly drops security controls across multiple transport types. When a TLS Certificate Authority (tls_ca) is configured and a numeric TLS port (tls_port) is specified, the application globally disables Basic authentication on its shared internal request handler. Because this handler is shared concurrently among HTTP, HTTPS, and UNIX domain socket listeners, and mutual TLS (mTLS) client certificate verification (tls.RequireAndVerifyClientCert) is enforced exclusively on the HTTPS server path, all other simultaneously active non-mTLS listeners fail open. Consequently, an unauthenticated attacker capable of reaching an affected HTTP or UNIX management endpoint can completely byp","source":"NVD","date":"2026-10-12T20:17:09.443Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109575","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109575"],"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"cve@mitre.org"},"read":false,"kev":false,"recordIds":["CVE-2026-109575"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109575"}],"epss":null},{"id":"CVE-2026-109425","title":"CVE-2026-109425 — Tink-go (tink-crypto/tink-go) through 2.8.0 contains an input-validation vulnerability where keyset.NewHa","summary":"Tink-go (tink-crypto/tink-go) through 2.8.0 contains an input-validation vulnerability where keyset.NewHandleWithNoSecrets() and ReadWithNoSecrets() skip the structural Validate() step before constructing a keyset.Handle, allowing malformed public or no-secret keysets that violate Tink's keyset invariants to be accepted. Attackers can supply a malformed keyset, such as one with an enabled public key lacking a valid primary key or a DESTROYED key with no KeyData, causing inconsistent downstream validation where functions like jwt.JWKSetFromPublicKeysetHandle() process the invalid handle and produce a JWK set, potentially misleading applications that rely on successful handle construction as proof of keyset integrity.","source":"NVD","date":"2026-10-12T20:17:09.293Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109425","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109425"],"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109425"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109425"}],"epss":null},{"id":"CVE-2026-109424","title":"CVE-2026-109424 — NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a weak","summary":"NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a weak encryption vulnerability where /eapi/ and /xeapi/ API response bodies are decrypted using a fixed, publicly documented AES-128-ECB key with no integrity credential. Attackers who can intercept or originate server responses can construct valid ciphertext under the known key with PKCS#7 padding, enabling the client to accept forged API responses that serve as a prerequisite for further exploitation such as reaching the os.navigateExternal bridge.","source":"NVD","date":"2026-10-12T20:17:09.143Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109424","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109424"],"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109424"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109424"}],"epss":null},{"id":"CVE-2026-109423","title":"CVE-2026-109423 — NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a TLS ","summary":"NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a TLS certificate validation vulnerability that allows a network-adjacent attacker to intercept and decrypt HTTPS traffic by failing to validate the server certificate chain, verify the hostname, or consult any Windows certificate trust store. Attackers can perform a man-in-the-middle attack using a rogue certificate authority to decrypt traffic, capture the MUSIC_U session credential sent in authenticated API requests, and modify server responses in transit, enabling account takeover and transport-layer response forgery.","source":"NVD","date":"2026-10-12T20:17:08.993Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109423","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109423"],"cvss":{"score":9.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109423"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109423"}],"epss":null},{"id":"CVE-2026-109422","title":"CVE-2026-109422 — NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a remo","summary":"NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a remote code execution vulnerability in the renderer-process IPC bridge os.navigateExternal, which passes caller-supplied URLs to ShellExecuteW without validating the URL scheme. An attacker able to inject content into the renderer, such as by forging the /pc/upgrade/get API response using a publicly known AES key over an unvalidated TLS connection, can invoke os.navigateExternal with a file:// URL through an img onerror payload to execute arbitrary local binaries under the logged-in user's account.","source":"NVD","date":"2026-10-12T20:17:08.840Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109422","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109422"],"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109422"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109422"}],"epss":null},{"id":"CVE-2026-108926","title":"CVE-2026-108926 — A security flaw has been discovered in itsourcecode Baptism Information Management System 1.0. This affec","summary":"A security flaw has been discovered in itsourcecode Baptism Information Management System 1.0. This affects an unknown part of the file ebaptism.php. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.","source":"NVD","date":"2026-10-12T20:17:08.660Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108926","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108926"],"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108926"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108926"}],"epss":null},{"id":"CVE-2026-108924","title":"CVE-2026-108924 — A vulnerability was identified in getkirby Kirby up to 4.9.5/5.5.3. Affected by this issue is the functio","summary":"A vulnerability was identified in getkirby Kirby up to 4.9.5/5.5.3. Affected by this issue is the function OptionsQuery::resolve of the file src/Option/OptionsQuery.php of the component Dynamic Option Generation. The manipulation leads to authorization bypass. The attack is possible to be carried out remotely. Upgrading to version 4.9.6 and 5.6.0 can resolve this issue. You should upgrade the affected component.","source":"NVD","date":"2026-10-12T20:17:08.457Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108924","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108924"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108924"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108924"}],"epss":null},{"id":"CVE-2026-108923","title":"CVE-2026-108923 — A vulnerability was determined in 1024-lab smart-admin up to 3.30.0. Affected by this vulnerability is an","summary":"A vulnerability was determined in 1024-lab smart-admin up to 3.30.0. Affected by this vulnerability is an unknown functionality of the file /support/config/queryByKey of the component Support Config Query. Executing a manipulation of the argument configKey can lead to improper access controls. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.","source":"NVD","date":"2026-10-12T20:17:08.220Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108923","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108923"],"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108923"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108923"}],"epss":null},{"id":"CVE-2026-108362","title":"CVE-2026-108362 — Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS conn","summary":"Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior to 0.11.0, TEE attestation evidence in Privasys attested TLS is accepted without requiring an explicitly authorized platform identity. When a network attacker can forge evidence or extract attestation secrets from a compromised unrevoked platform, the verifier accepts valid measurements from a different unrevoked TEE platform as though they came from the intended Attester. The attacker can impersonate the attested TLS endpoint. This issue is fixed in version 0.11.0.","source":"NVD","date":"2026-10-12T20:17:08.073Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108362","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108362"],"cvss":{"score":9.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108362"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108362"}],"epss":null},{"id":"CVE-2026-108361","title":"CVE-2026-108361 — Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS conn","summary":"Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Before 0.9.1, an attacker with local access could modify workload code, data, and configuration at any time after successful connection establishment. Once Evidence was successfully appraised and the connection was established, there was a window of vulnerability from the establishment of the connection to the termination of the connection where an attacker could modify the state of the workload and platform at runtime on the TLS endpoint acting as the Attester. This vulnerability was possible because Privasys/ra-tls-clients performed attestation only once in the lifetime of the connection (at connection establishment time), and the verifying peer continued to believe that the state was the same as in the initial Evidence thro","source":"NVD","date":"2026-10-12T20:17:07.900Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108361","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108361"],"cvss":{"score":7.2,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108361"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108361"}],"epss":null},{"id":"CVE-2026-104774","title":"CVE-2026-104774 — OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.","summary":"OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the t:jsDecode transformation in internal/transformations/js_decode.go:64-70 includes the backslash in the octal buffer, causing ParseInt to fail and return a null byte. The flaw is triggered when a rule relies on t:jsDecode and the request contains JavaScript octal escape sequences. An unauthenticated attacker can encode attack syntax with JavaScript octal escapes so the backend decodes the intended bytes while Coraza rules using t:jsDecode inspect corrupted null-byte output. The mismatch can bypass WAF rules and expose the protected application to attacks such as cross-site scripting or SQL injection. This issue is fixed in version 3.8.0.","source":"NVD","date":"2026-10-12T20:17:07.617Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104774","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-104774","GHSA-PC5Q-QFXP-GGQV"],"cvss":{"score":5.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-104774","GHSA-pc5q-qfxp-ggqv"],"sources":["NVD","GitHub Advisories"],"topics":["New vulnerabilities","Code & supply chain"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104774"},{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-pc5q-qfxp-ggqv"}],"epss":null},{"id":"CVE-2026-104364","title":"CVE-2026-104364 — IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow a local attacker to cause a denial o","summary":"IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow a local attacker to cause a denial of service due to improper input validation.","source":"NVD","date":"2026-10-12T20:17:07.473Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104364","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-104364"],"cvss":{"score":3.3,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-104364"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104364"}],"epss":null},{"id":"CVE-2026-104332","title":"CVE-2026-104332 — IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service when execut","summary":"IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service when executing a specially crafted query with a Materialized Query Table","source":"NVD","date":"2026-10-12T20:17:07.330Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104332","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-104332"],"cvss":{"score":5.5,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-104332"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104332"}],"epss":null},{"id":"CVE-2025-27902","title":"CVE-2025-27902 — IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 uses a web link with untrusted references to","summary":"IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 uses a web link with untrusted references to an external site. A remote attacker could exploit this vulnerability to expose sensitive information or perform unauthorized actions on the victims’ web browser","source":"NVD","date":"2026-10-12T20:17:05.407Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-27902","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2025-27902"],"cvss":{"score":6.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2025-27902"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-27902"}],"epss":null},{"id":"CVE-2025-27897","title":"CVE-2025-27897 — IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This ","summary":"IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.","source":"NVD","date":"2026-10-12T20:17:05.277Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-27897","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2025-27897"],"cvss":{"score":6.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2025-27897"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-27897"}],"epss":null},{"id":"CVE-2025-27896","title":"CVE-2025-27896 — IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This ","summary":"IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.","source":"NVD","date":"2026-10-12T20:17:05.137Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-27896","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2025-27896"],"cvss":{"score":6.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2025-27896"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-27896"}],"epss":null},{"id":"CVE-2025-27895","title":"CVE-2025-27895 — IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This ","summary":"IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.","source":"NVD","date":"2026-10-12T20:17:04.353Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-27895","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2025-27895"],"cvss":{"score":6.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2025-27895"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-27895"}],"epss":null},{"id":"CVE-2021-48009","title":"CVE-2021-48009 — Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.","summary":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.","source":"NVD","date":"2026-10-12T20:17:03.310Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-48009","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2021-48009"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2021-48009"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-48009"}],"epss":null},{"id":"CVE-2026-89140","title":"CVE-2026-89140 — Temporal Server does not bind internal completion callbacks to the namespace that attached them, which al","summary":"Temporal Server does not bind internal completion callbacks to the namespace that attached them, which allows an authenticated caller with write permission in one namespace to alter Scheduler V2 schedule state in another namespace. The callback address temporal://internal is reserved for callbacks that Scheduler V2 attaches to the Workflows it starts. In affected releases, any authenticated caller could attach a callback with that address to a Workflow start request, the address was exempt from the component.callbacks.allowedAddresses allowlist, and the History service delivered the callback to the component its token named, in whatever namespace that was, without authorizing the original caller there. When the forged completion matches an action a target schedule is running, the schedule records the action as completed while its Workflow","source":"NVD","date":"2026-10-12T19:16:40.420Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89140","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-89140"],"cvss":{"score":6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"security@temporal.io"},"read":false,"kev":false,"recordIds":["CVE-2026-89140"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89140"}],"epss":null},{"id":"CVE-2026-87744","title":"CVE-2026-87744 — A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to byp","summary":"A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer customizes a specific operation using @MethodProperties without explicitly re-declaring security roles, the code generator silently drops class-level security requirements. This results in the affected endpoint defaulting to permissive, unauthenticated access, potentially leading to unauthorized information disclosure or data modification.","source":"NVD","date":"2026-10-12T19:16:40.277Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87744","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-87744"],"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","source":"secalert@redhat.com"},"read":false,"kev":false,"recordIds":["CVE-2026-87744"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87744"}],"epss":null},{"id":"CVE-2026-85471","title":"CVE-2026-85471 — A flaw was found in Quay. An authenticated repository administrator could bypass the hostname blacklist i","summary":"A flaw was found in Quay. An authenticated repository administrator could bypass the hostname blacklist in webhook notifications, leading to a Server-Side Request Forgery (SSRF) vulnerability. This allows the Quay application to be tricked into sending requests to internal network resources, such as cloud metadata services or other services within the cluster. Consequently, this could lead to the disclosure of sensitive information from these internal services.","source":"NVD","date":"2026-10-12T19:16:40.133Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85471","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-85471"],"cvss":{"score":6.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","source":"secalert@redhat.com"},"read":false,"kev":false,"recordIds":["CVE-2026-85471"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85471"}],"epss":null},{"id":"CVE-2026-83536","title":"CVE-2026-83536 — A flaw was found in openstack-network-exporter. The HTTP server within the component is configured withou","summary":"A flaw was found in openstack-network-exporter. The HTTP server within the component is configured without essential timeout settings, such as ReadHeaderTimeout. This vulnerability allows an unauthenticated, remote attacker to initiate multiple slow HTTP header connections. By trickling header bytes, the attacker can exhaust server resources, specifically file descriptors, leading to a Denial of Service (DoS) that prevents legitimate Prometheus metric scraping and alerting.","source":"NVD","date":"2026-10-12T19:16:39.997Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83536","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-83536"],"cvss":{"score":5.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","source":"secalert@redhat.com"},"read":false,"kev":false,"recordIds":["CVE-2026-83536"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83536"}],"epss":null},{"id":"CVE-2026-83535","title":"CVE-2026-83535 — A flaw was found in openstack-network-exporter. When an operator configures user authentication but omits","summary":"A flaw was found in openstack-network-exporter. When an operator configures user authentication but omits or misconfigures Transport Layer Security (TLS), the basic authentication mechanism is silently bypassed. This fail-open design allows an adjacent network attacker to access sensitive Open vSwitch (OVS) and Open Virtual Network (OVN) dataplane metrics without credentials. Consequently, an attacker can enumerate bridge names, port counters, OVN controller state, and host topology, leading to information disclosure.","source":"NVD","date":"2026-10-12T19:16:39.850Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83535","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-83535"],"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","source":"secalert@redhat.com"},"read":false,"kev":false,"recordIds":["CVE-2026-83535"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83535"}],"epss":null},{"id":"CVE-2026-78404","title":"CVE-2026-78404 — IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a local privilege escalation vi","summary":"IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a local privilege escalation via the db2pd utility.","source":"NVD","date":"2026-10-12T19:16:39.720Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78404","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-78404"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-78404"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78404"}],"epss":null},{"id":"CVE-2026-65954","title":"CVE-2026-65954 — PHPCSUtils is a suite of utility functions for use with PHP_CodeSniffer. From 1.0.0-alpha1 until 1.2.3, P","summary":"PHPCSUtils is a suite of utility functions for use with PHP_CodeSniffer. From 1.0.0-alpha1 until 1.2.3, PHPCSUtils\\AbstractSniffs\\AbstractArrayDeclarationSniff::getActualArrayKey() evaluates attacker-controlled array-key expressions with eval(), allowing callback-form keys in untrusted PHP code scanned by an extending sniff to execute arbitrary commands on the scanning host. Known reachable paths include Universal.Arrays.DuplicateArrayKey and Universal.Arrays.MixedArrayKeyTypes. This issue is fixed in version 1.2.3.","source":"NVD","date":"2026-10-12T19:16:39.567Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65954","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-65954"],"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-65954"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65954"}],"epss":null},{"id":"CVE-2026-59977","title":"CVE-2026-59977 — ConvertX is a self-hosted file conversion service. Prior to 0.18.0, the /delete/{id} endpoint uses HTTP G","summary":"ConvertX is a self-hosted file conversion service. Prior to 0.18.0, the /delete/{id} endpoint uses HTTP GET for permanent deletion without CSRF protection. If an authenticated user visits attacker-controlled content that requests /delete/{id}, the browser sends the user session cookie and the request deletes the targeted job, resulting in unauthorized loss of converted-file history. This issue is fixed in version 0.18.0.","source":"NVD","date":"2026-10-12T19:16:39.417Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59977","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-59977"],"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-59977"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59977"}],"epss":null},{"id":"CVE-2026-59976","title":"CVE-2026-59976 — ConvertX is a self-hosted file conversion service. Prior to 0.18.0, the ImageMagick converter uses the un","summary":"ConvertX is a self-hosted file conversion service. Prior to 0.18.0, the ImageMagick converter uses the unsanitized convert_to parameter to construct an output path. If an authenticated user, or an unauthenticated user when ConvertX is configured to allow unauthenticated access, uploads an extensionless image and supplies directory traversal sequences in convert_to through /convert, the constructed path escapes the intended output directory, allowing the attacker to write converted output to arbitrary container paths, potentially overwriting files or causing denial of service. This issue is fixed in version 0.18.0.","source":"NVD","date":"2026-10-12T19:16:39.260Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59976","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-59976"],"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-59976"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59976"}],"epss":null},{"id":"CVE-2026-57143","title":"CVE-2026-57143 — PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.62, searxng_search and the search_w","summary":"PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.62, searxng_search and the search_web SearxNG provider pass the LLM-controlled searxng_url parameter directly to requests.get without validating its scheme, host, port, or resolved address. Prompt-injected content can direct the default search tool to internal JSON services, distinguish open and closed internal ports, and attempt cloud-metadata requests, with returned JSON results entering agent context. This issue is fixed in praisonaiagents 1.6.62.","source":"NVD","date":"2026-10-12T19:16:39.110Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57143","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-57143"],"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-57143"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57143"}],"epss":null},{"id":"CVE-2026-57118","title":"CVE-2026-57118 — PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, AgentTeam.launch and the Agents","summary":"PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, AgentTeam.launch and the Agents alias register GET /{path}/list, POST /{path}, and `POST /{path}/{agent_id}' without access-control checks before listing agents or calling agent.chat. A remotely exposed server can therefore let unauthenticated clients enumerate agents, consume model resources, access connected private context, and trigger agent tools or workflow side effects. This vulnerability is fixed in praisonaiagents 1.6.59.","source":"NVD","date":"2026-10-12T19:16:38.940Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57118","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-57118"],"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-57118"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57118"}],"epss":null},{"id":"CVE-2026-18166","title":"CVE-2026-18166 — IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connec","summary":"IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a remote authenticated attacker to obtain sensitive information due to improper authorization when using the CREATE WRAPPER command.","source":"NVD","date":"2026-10-12T19:16:38.773Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18166","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-18166"],"cvss":{"score":7.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-18166"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18166"}],"epss":null},{"id":"CVE-2026-108922","title":"CVE-2026-108922 — A flaw has been found in KusalkaSilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da4","summary":"A flaw has been found in KusalkaSilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. Affected is the function getimagesize of the file upload_save.php. Executing a manipulation of the argument uploaded_file/image can lead to unrestricted upload. The attack may be launched remotely. The exploit has been published and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.","source":"NVD","date":"2026-10-12T19:16:38.600Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108922","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108922"],"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108922"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108922"}],"epss":null},{"id":"CVE-2026-108921","title":"CVE-2026-108921 — A vulnerability was detected in KusalkaSilva Learning-Management-System up to ffeb873f8803f1e9664384ff750","summary":"A vulnerability was detected in KusalkaSilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. This impacts the function mysql_query of the file remove_announcements.php of the component State-Changing Endpoints. Performing a manipulation of the argument ID results in missing authentication. The attack may be initiated remotely. The exploit is now public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.","source":"NVD","date":"2026-10-12T19:16:38.420Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108921","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108921"],"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108921"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108921"}],"epss":null},{"id":"CVE-2026-108920","title":"CVE-2026-108920 — A security vulnerability has been detected in SourceCodester Drug Recommendation System 1.0. This affects","summary":"A security vulnerability has been detected in SourceCodester Drug Recommendation System 1.0. This affects an unknown function of the file Admin/user_record.php of the component Admin Record Tables. Such manipulation of the argument name/email leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.","source":"NVD","date":"2026-10-12T19:16:38.240Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108920","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108920"],"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108920"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108920"}],"epss":null},{"id":"CVE-2026-108919","title":"CVE-2026-108919 — A weakness has been identified in SourceCodester Drug Recommendation System 1.0. The impacted element is ","summary":"A weakness has been identified in SourceCodester Drug Recommendation System 1.0. The impacted element is an unknown function of the file Auth/add_student.php of the component Student Registration. This manipulation of the argument txtname/txtpassword/txtemail/txtphone/txtprevious_school causes cross site scripting. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.","source":"NVD","date":"2026-10-12T19:16:38.047Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108919","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108919"],"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108919"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108919"}],"epss":null},{"id":"CVE-2026-107226","title":"CVE-2026-107226 — The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchrono","summary":"The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 3.0.14, the default ThreadSafeCookieStore does not retain whether a Set-Cookie response used a secure transport. It accepts Secure cookies received over plaintext and permits insecure cookies to overlay or delete existing Secure cookies with matching scope. An attacker controlling a plaintext same-site response can consequently plant, replace, or remove cookie state later sent to an HTTPS origin, enabling session fixation, CSRF-token replacement, or loss of security-relevant state. This issue is fixed in version 3.0.14.","source":"NVD","date":"2026-10-12T19:16:37.880Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107226","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107226","GHSA-P2JM-6HJ6-9RJG"],"cvss":{"score":6.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107226","GHSA-p2jm-6hj6-9rjg"],"sources":["NVD","GitHub Advisories"],"topics":["New vulnerabilities","Code & supply chain"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107226"},{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-p2jm-6hj6-9rjg"}],"epss":null},{"id":"CVE-2026-105466","title":"CVE-2026-105466 — IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service when insert","summary":"IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service when inserting into a table with XML columns under specific conditions.","source":"NVD","date":"2026-10-12T19:16:37.740Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105466","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-105466"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-105466"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105466"}],"epss":null},{"id":"CVE-2026-105465","title":"CVE-2026-105465 — IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation when db2lo","summary":"IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation when db2locssh is enabled with the db2 instance.","source":"NVD","date":"2026-10-12T19:16:37.610Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105465","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-105465"],"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-105465"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105465"}],"epss":null},{"id":"CVE-2026-105464","title":"CVE-2026-105464 — IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connec","summary":"IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local attacker to gain elevated privileges due to improper privilege management.","source":"NVD","date":"2026-10-12T19:16:37.450Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105464","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-105464"],"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-105464"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105464"}],"epss":null},{"id":"CVE-2026-104355","title":"CVE-2026-104355 — A connected peer cluster can modify a Temporal Server cluster's local namespaces, which are never replica","summary":"A connected peer cluster can modify a Temporal Server cluster's local namespaces, which are never replicated to that peer, because the receiving cluster applies inbound namespace replication updates to them. In a multi-cluster deployment, each cluster pulls replication tasks from the remote clusters an administrator has registered with connection enabled; the sending side excludes local namespaces, but the receiving side does not apply the same rule. When an inbound task names an existing namespace, the server checks at most that the namespace identifiers match, then overwrites its state, description, owner, retention, archival settings, and cluster list, and its active cluster when the task carries a higher failover version, without checking that the namespace is global. A party that controls a registered peer's replies, by operating or ","source":"NVD","date":"2026-10-12T19:16:36.900Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104355","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-104355"],"cvss":{"score":7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"security@temporal.io"},"read":false,"kev":false,"recordIds":["CVE-2026-104355"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104355"}],"epss":null},{"id":"CVE-2026-104102","title":"CVE-2026-104102 — copyparty is a portable file server. Prior to 1.20.19, FTP upload path handling does not confine destinat","summary":"copyparty is a portable file server. Prior to 1.20.19, FTP upload path handling does not confine destinations to configured copyparty volumes. When FTP or FTPS is explicitly enabled, a low-privileged authenticated user can submit traversal paths during upload to create a new file outside configured volumes wherever the copyparty process has write permission. The attacker cannot read or overwrite files, the output name receives a randomized suffix, and copyparty does not execute the file; however, unrelated software on the same host could process the newly created file. This issue is fixed in version 1.20.19.","source":"NVD","date":"2026-10-12T19:16:36.713Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104102","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-104102"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-104102"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104102"}],"epss":null},{"id":"CVE-2026-103061","title":"CVE-2026-103061 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in gleam-lan","summary":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in gleam-lang gleam allows a malicious package publisher to delete a directory outside the project's build directory when a developer builds a project.\n\nA Hex package release's metadata carries an app field with the release's OTP application name. Gleam reads this field from the hex.pm release API when it downloads dependencies and uses it as the package's build directory name without validating it (hex_manifest_package in compiler-cli/src/dependencies.rs, ProjectPaths::build_directory_for_package). When a dependency fails to compile, Gleam deletes that directory with remove_dir_all. hex.pm didn't restrict the field to a directory name before 2026-10-12, so a publisher could set it to a value such as ../../../../target or an absolute path. When a ","source":"NVD","date":"2026-10-12T19:16:36.387Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103061","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-103061"],"cvss":{"score":5.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},"read":false,"kev":false,"recordIds":["CVE-2026-103061"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103061"}],"epss":null},{"id":"CVE-2026-102663","title":"CVE-2026-102663 — OpenList is a file list program that supports multiple storage backends. Prior to 4.2.4, the OpenList sea","summary":"OpenList is a file list program that supports multiple storage backends. Prior to 4.2.4, the OpenList search API uses a non-separator-aware strings.HasPrefix comparison as a path containment authorization check when authorizing globally indexed Bleve results against a restricted user's BasePath. When Bleve search is enabled and a restricted authenticated user searches the global index for content in a sibling path, the user causes a globally indexed sibling-path result to pass the prefix check. The strings.HasPrefix(node.Parent, user.BasePath) predicate allows a sibling path such as /base2 to be treated as contained by /base. Unauthorized file metadata or file-existence information can be disclosed, and the backend Total value can reveal a match even when another access check removes the individual result. This issue is fixed in version 4","source":"NVD","date":"2026-10-12T19:16:36.190Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102663","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-102663"],"cvss":{"score":4.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-102663"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102663"}],"epss":null},{"id":"CVE-2026-77366","title":"CVE-2026-77366 — obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1,","summary":"obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, tool dispatch does not compare the caller-controlled input.vault value with the vault bound to the caller, the JSON Web Token (JWT) has no vault claim, and the folder access-control list is shared globally. Any valid token can therefore select another configured vault and read, write, or delete its contents through affected tools. Version 1.3.1 fixes the vulnerability by binding tokens and request context to a vault and rejecting mismatched input.vault values before scope checks.","source":"NVD","date":"2026-10-12T18:17:23.830Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77366","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-77366"],"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-77366"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77366"}],"epss":null},{"id":"CVE-2026-77364","title":"CVE-2026-77364 — obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1,","summary":"obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, undefined readPaths and writePaths settings allow all paths, strictReadDefault does not protect direct requests, and the .obsidian, .git, and .trash control directories are excluded only during enumeration. An authenticated caller can directly read sensitive files such as .obsidian/plugins/*/data.json, potentially exposing plugin API keys, Obsidian Sync passwords, and other in-vault data. Version 1.3.1 fixes the vulnerability by denying the control directories by default and enforcing strictReadDefault on direct request paths.","source":"NVD","date":"2026-10-12T18:17:23.677Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77364","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-77364"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-77364"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77364"}],"epss":null},{"id":"CVE-2026-77363","title":"CVE-2026-77363 — obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1,","summary":"obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, the Streamable HTTP transport does not validate the Host or Origin header or enable DNS-rebinding protection. When the documented loopback configuration uses auth.mode set to none, a malicious web page can send requests to the local MCP endpoint and receive unrestricted vault access through the http-local caller. Version 1.3.1 fixes the vulnerability by enabling host, origin, and DNS-rebinding validation.","source":"NVD","date":"2026-10-12T18:17:23.513Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77363","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-77363"],"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-77363"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77363"}],"epss":null},{"id":"CVE-2026-6232","title":"CVE-2026-6232 — An out-of-bounds write vulnerability in the SPI host command interface of Semtech's LR11xx transceiver fi","summary":"An out-of-bounds write vulnerability in the SPI host command interface of Semtech's LR11xx transceiver firmware where a crafted SPI host command with an oversized length field can cause the firmware to write up to 254 arbitrary bytes past the bounds of an internal, non-persistent memory buffer. Exploitation requires physical access to the device and logical access to the SPI bus.","source":"NVD","date":"2026-10-12T18:17:23.333Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6232","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-6232"],"cvss":{"score":5.2,"version":"4.0","vector":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:M/U:X","source":"security@sierrawireless.com"},"read":false,"kev":false,"recordIds":["CVE-2026-6232"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6232"}],"epss":null},{"id":"CVE-2026-61994","title":"CVE-2026-61994 — Missing Authorization vulnerability in RocketGeek WP-Members wp-members allows Exploiting Incorrectly Con","summary":"Missing Authorization vulnerability in RocketGeek WP-Members wp-members allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-Members: from n/a through 3.5.7.","source":"NVD","date":"2026-10-12T18:17:23.183Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61994","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-61994"],"cvss":{"score":5.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-61994"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61994"}],"epss":null},{"id":"CVE-2026-42689","title":"CVE-2026-42689 — Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability","summary":"Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Pixelite Events Manager events-manager allows Leveraging Race Conditions.This issue affects Events Manager: from n/a through 7.4.7.","source":"NVD","date":"2026-10-12T18:17:23.030Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42689","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-42689"],"cvss":{"score":3.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-42689"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42689"}],"epss":null},{"id":"CVE-2026-109448","title":"CVE-2026-109448 — Integer wraparound in psqlODBC SQLBindParameter allows an application, or an attacker who controls how ma","summary":"Integer wraparound in psqlODBC SQLBindParameter allows an application, or an attacker who controls how many parameters the application binds on one statement, to corrupt heap memory. psqlODBC stores the binding count in a signed 16-bit field. Binding parameter number 32768 wraps that count to -32768. Binding parameter 32769 then writes about 2.5 MB of zeros starting 1.25 MB before the binding array, which crashes the application or leaves it running on a corrupted heap. Applications that build parameter lists from untrusted input, such as an IN (?, ?, ...) list, are exposed. Versions before psqlODBC 18.00.0005 are affected.","source":"NVD","date":"2026-10-12T18:17:22.633Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109448","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109448"],"cvss":{"score":5.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"},"read":false,"kev":false,"recordIds":["CVE-2026-109448"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109448"}],"epss":null},{"id":"CVE-2026-109222","title":"CVE-2026-109222 — Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in erro","summary":"Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.","source":"NVD","date":"2026-10-12T18:17:22.543Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109222","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109222"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-109222"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109222"}],"epss":null},{"id":"CVE-2026-108918","title":"CVE-2026-108918 — A vulnerability was identified in Edimax BR-6208AC 1.32. Impacted is an unknown function of the file /gof","summary":"A vulnerability was identified in Edimax BR-6208AC 1.32. Impacted is an unknown function of the file /goform/formWlanMP. The manipulation of the argument readE2P leads to command injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.","source":"NVD","date":"2026-10-12T18:17:22.353Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108918","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108918"],"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108918"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108918"}],"epss":null},{"id":"CVE-2026-108917","title":"CVE-2026-108917 — A vulnerability was determined in Edimax BR-6208AC 1.32. This issue affects some unknown processing of th","summary":"A vulnerability was determined in Edimax BR-6208AC 1.32. This issue affects some unknown processing of the file /goform/formAutoFWupgrade. Executing a manipulation of the argument tftpsIP can lead to command injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.","source":"NVD","date":"2026-10-12T18:17:22.163Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108917","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108917"],"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108917"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108917"}],"epss":null},{"id":"CVE-2026-108916","title":"CVE-2026-108916 — A vulnerability was found in Edimax BR-6208AC 1.32. This vulnerability affects unknown code of the file /","summary":"A vulnerability was found in Edimax BR-6208AC 1.32. This vulnerability affects unknown code of the file /goform/formAccept. Performing a manipulation of the argument submit-url results in command injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.","source":"NVD","date":"2026-10-12T18:17:21.967Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108916","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108916"],"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108916"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108916"}],"epss":null},{"id":"CVE-2026-108915","title":"CVE-2026-108915 — A vulnerability has been found in Edimax BR-6208AC 1.32. This affects an unknown part of the file /goform","summary":"A vulnerability has been found in Edimax BR-6208AC 1.32. This affects an unknown part of the file /goform/formWlanMP. Such manipulation of the argument ateBW leads to buffer overflow. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.","source":"NVD","date":"2026-10-12T18:17:21.770Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108915","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108915"],"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108915"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108915"}],"epss":null},{"id":"CVE-2026-108486","title":"CVE-2026-108486 — Missing Authorization vulnerability in WPMU DEV Forminator forminator allows Exploiting Incorrectly Confi","summary":"Missing Authorization vulnerability in WPMU DEV Forminator forminator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Forminator: from n/a through 1.58.0.","source":"NVD","date":"2026-10-12T18:17:21.620Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108486","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108486"],"cvss":{"score":5.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108486"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108486"}],"epss":null},{"id":"CVE-2026-108482","title":"CVE-2026-108482 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lea","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows Stored XSS.This issue affects Premium Addons for Elementor: from n/a through 4.11.110.","source":"NVD","date":"2026-10-12T18:17:21.473Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108482","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108482"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108482"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108482"}],"epss":null},{"id":"CVE-2026-108481","title":"CVE-2026-108481 — Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress patreon-connect allows Cross","summary":"Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress patreon-connect allows Cross Site Request Forgery.This issue affects Patreon WordPress: from n/a through 1.10.0.","source":"NVD","date":"2026-10-12T18:17:21.327Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108481","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108481"],"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108481"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108481"}],"epss":null},{"id":"CVE-2026-108479","title":"CVE-2026-108479 — Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress patreon-connect allows Cross","summary":"Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress patreon-connect allows Cross Site Request Forgery.This issue affects Patreon WordPress: from n/a through 1.9.17.","source":"NVD","date":"2026-10-12T18:17:21.187Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108479","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108479"],"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108479"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108479"}],"epss":null},{"id":"CVE-2026-107862","title":"CVE-2026-107862 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Exp","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows DOM-Based XSS.This issue affects Quiz And Survey Master: from n/a through 11.2.7.","source":"NVD","date":"2026-10-12T18:17:20.983Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107862","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107862"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107862"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107862"}],"epss":null},{"id":"CVE-2026-107418","title":"CVE-2026-107418 — Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configur","summary":"Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.28.","source":"NVD","date":"2026-10-12T18:17:20.843Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107418","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107418"],"cvss":{"score":5.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107418"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107418"}],"epss":null},{"id":"CVE-2026-103080","title":"CVE-2026-103080 — External Control of Assumed-Immutable Web Parameter vulnerability in VillaTheme Salevo woo-boost-sales al","summary":"External Control of Assumed-Immutable Web Parameter vulnerability in VillaTheme Salevo woo-boost-sales allows Input Data Manipulation.This issue affects Salevo: from n/a through 1.3.0.","source":"NVD","date":"2026-10-12T18:17:20.627Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103080","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-103080"],"cvss":{"score":5.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-103080"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103080"}],"epss":null},{"id":"https://cyberscoop.com/?p=91063","title":"IonQ to buy zero-trust security firm Elisity in deal valued at up to $1.3 billion","source":"CyberScoop","date":"2026-10-12T18:12:10.000Z","summary":"The acquisition pairs Elisity's zero-trust access controls with IonQ's post-quantum cryptography business as federal agencies and major companies accelerate timelines for quantum-ready encryption.  3 billion appeared first on CyberScoop .","url":"https://cyberscoop.com/ionq-acquires-elisity-1-3-billion-quantum-security/","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://cyberscoop.com/?p=91063"],"sources":["CyberScoop"],"topics":["Cyber news"],"affected":[],"references":[{"source":"CyberScoop","url":"https://cyberscoop.com/ionq-acquires-elisity-1-3-billion-quantum-security/"}],"epss":null},{"id":"CVE-2026-94451","title":"CVE-2026-94451 — Quarkus REST Data Panache provides a way to automatically generate REST endpoints for data entities. A fl","summary":"Quarkus REST Data Panache provides a way to automatically generate REST endpoints for data entities. A flaw was found where certain endpoints do not properly check the sort parameter provided by users. This could allow an attacker to learn information they should not have access to or slow down the system by forcing the database to perform complex tasks, potentially causing a denial of service.","source":"NVD","date":"2026-10-12T17:17:38.513Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94451","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-94451"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","source":"secalert@redhat.com"},"read":false,"kev":false,"recordIds":["CVE-2026-94451"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94451"}],"epss":null},{"id":"CVE-2026-85976","title":"CVE-2026-85976 — Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently","summary":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently sanitize input used by the Query Console file-exploration endpoint, which could allow HTTP response splitting and unintended client-side response handling.","source":"NVD","date":"2026-10-12T17:17:38.380Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85976","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-85976"],"cvss":{"score":5.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","source":"security@progress.com"},"read":false,"kev":false,"recordIds":["CVE-2026-85976"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85976"}],"epss":null},{"id":"CVE-2026-85975","title":"CVE-2026-85975 — Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may use cleartext t","summary":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may use cleartext transport for Amazon S3 connections by default. A network-positioned attacker could intercept data or credentials transmitted through an affected connection.","source":"NVD","date":"2026-10-12T17:17:38.250Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85975","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-85975"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","source":"security@progress.com"},"read":false,"kev":false,"recordIds":["CVE-2026-85975"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85975"}],"epss":null},{"id":"CVE-2026-85974","title":"CVE-2026-85974 — Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not consistently","summary":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not consistently validate TLS certificate hostnames for certain outbound connections. A network-positioned attacker could exploit this weakness to intercept or modify communications with an affected service.","source":"NVD","date":"2026-10-12T17:17:38.123Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85974","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-85974"],"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","source":"security@progress.com"},"read":false,"kev":false,"recordIds":["CVE-2026-85974"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85974"}],"epss":null},{"id":"CVE-2026-85973","title":"CVE-2026-85973 — Progress MarkLogic Server 12.x releases before 12.1.0 may use cleartext transport for certain cluster-man","summary":"Progress MarkLogic Server 12.x releases before 12.1.0 may use cleartext transport for certain cluster-management communications. A network-positioned attacker could intercept or modify information transmitted through an affected connection.","source":"NVD","date":"2026-10-12T17:17:38.000Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85973","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-85973"],"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","source":"security@progress.com"},"read":false,"kev":false,"recordIds":["CVE-2026-85973"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85973"}],"epss":null},{"id":"CVE-2026-85972","title":"CVE-2026-85972 — Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently","summary":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently verify the identity of a Kerberos authentication service in certain password-based authentication configurations. A network-positioned attacker could impersonate trusted authentication infrastructure, potentially resulting in unauthorized access or modification of protected data.","source":"NVD","date":"2026-10-12T17:17:37.870Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85972","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-85972"],"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","source":"security@progress.com"},"read":false,"kev":false,"recordIds":["CVE-2026-85972"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85972"}],"epss":null},{"id":"CVE-2026-85971","title":"CVE-2026-85971 — Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 assign overly permi","summary":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 assign overly permissive operating-system permissions to certain log files, which could allow a local user to read or alter log data. The corrected default permissions apply to newly created and rotated logs; existing logs retain their current permissions until remediated.","source":"NVD","date":"2026-10-12T17:17:37.750Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85971","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-85971"],"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","source":"security@progress.com"},"read":false,"kev":false,"recordIds":["CVE-2026-85971"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85971"}],"epss":null},{"id":"CVE-2026-85970","title":"CVE-2026-85970 — Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 enable XML external","summary":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 enable XML external entity processing by default in multiple server paths, which could allow crafted XML to cause server-side requests or disclosure of local files.","source":"NVD","date":"2026-10-12T17:17:37.627Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85970","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-85970"],"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L","source":"security@progress.com"},"read":false,"kev":false,"recordIds":["CVE-2026-85970"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85970"}],"epss":null},{"id":"CVE-2026-85969","title":"CVE-2026-85969 — Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an out-of-b","summary":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an out-of-bounds write vulnerability in certain language-processing functionality. A remote authenticated attacker could exploit this vulnerability to cause server instability or limited modification of data.","source":"NVD","date":"2026-10-12T17:17:37.500Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85969","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-85969"],"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","source":"security@progress.com"},"read":false,"kev":false,"recordIds":["CVE-2026-85969"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85969"}],"epss":null},{"id":"CVE-2026-85968","title":"CVE-2026-85968 — Progress MarkLogic Server 12.x releases before 12.1.0 contain an out-of-bounds read vulnerability in cert","summary":"Progress MarkLogic Server 12.x releases before 12.1.0 contain an out-of-bounds read vulnerability in certain query-processing functionality. A remote authenticated attacker could exploit this vulnerability to cause server instability or disclose limited information from process memory.","source":"NVD","date":"2026-10-12T17:17:37.387Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85968","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-85968"],"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H","source":"security@progress.com"},"read":false,"kev":false,"recordIds":["CVE-2026-85968"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85968"}],"epss":null},{"id":"CVE-2026-85967","title":"CVE-2026-85967 — Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain a cross-sit","summary":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain a cross-site scripting vulnerability that could allow a remote attacker to execute script in the context of an authenticated user's browser session, which could result in unauthorized actions or disclosure of information accessible to that user.","source":"NVD","date":"2026-10-12T17:17:37.260Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85967","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-85967"],"cvss":{"score":6.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","source":"security@progress.com"},"read":false,"kev":false,"recordIds":["CVE-2026-85967"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85967"}],"epss":null},{"id":"CVE-2026-85966","title":"CVE-2026-85966 — Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently","summary":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently restrict access to certain security-sensitive information. A remote authenticated attacker with limited management permissions could obtain this information, which could result in unauthorized access to protected resources.","source":"NVD","date":"2026-10-12T17:17:37.137Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85966","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-85966"],"cvss":{"score":7.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","source":"security@progress.com"},"read":false,"kev":false,"recordIds":["CVE-2026-85966"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85966"}],"epss":null},{"id":"CVE-2026-85965","title":"CVE-2026-85965 — Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain memory-safe","summary":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain memory-safety defects in the JavaScript engine integration that could result in memory corruption, controlled process failure, or server instability.","source":"NVD","date":"2026-10-12T17:17:37.007Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85965","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-85965"],"cvss":{"score":8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","source":"security@progress.com"},"read":false,"kev":false,"recordIds":["CVE-2026-85965"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85965"}],"epss":null},{"id":"CVE-2026-85964","title":"CVE-2026-85964 — Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow an authentica","summary":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow an authenticated Query Console user to supply unsafe path values to a privileged filesystem helper, which could result in disclosure of arbitrary server files.","source":"NVD","date":"2026-10-12T17:17:36.877Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85964","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-85964"],"cvss":{"score":7.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","source":"security@progress.com"},"read":false,"kev":false,"recordIds":["CVE-2026-85964"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85964"}],"epss":null},{"id":"CVE-2026-85963","title":"CVE-2026-85963 — Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 include deprecated ","summary":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 include deprecated OpsDirector functionality with weaknesses that could allow an unauthenticated remote attacker to make unauthorized requests to internal services or forge trusted requests, potentially resulting in unauthorized access to protected information.","source":"NVD","date":"2026-10-12T17:17:36.753Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85963","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-85963"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","source":"security@progress.com"},"read":false,"kev":false,"recordIds":["CVE-2026-85963"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85963"}],"epss":null},{"id":"CVE-2026-85962","title":"CVE-2026-85962 — Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an improper","summary":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an improper authentication vulnerability in SAML processing. In deployments that use SAML authentication, an unauthenticated remote attacker could cause the affected server to accept an assertion that should be rejected, potentially resulting in unauthorized access.","source":"NVD","date":"2026-10-12T17:17:36.627Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85962","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-85962"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","source":"security@progress.com"},"read":false,"kev":false,"recordIds":["CVE-2026-85962"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85962"}],"epss":null},{"id":"CVE-2026-85961","title":"CVE-2026-85961 — On Azure deployments, Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3","summary":"On Azure deployments, Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may record security-sensitive authentication information in diagnostic logs under certain configurations. An attacker with access to the affected logs could use this information to obtain unauthorized access to protected cloud resources.","source":"NVD","date":"2026-10-12T17:17:36.500Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85961","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-85961"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","source":"security@progress.com"},"read":false,"kev":false,"recordIds":["CVE-2026-85961"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85961"}],"epss":null},{"id":"CVE-2026-85960","title":"CVE-2026-85960 — Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 use predictable CSR","summary":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 use predictable CSRF tokens in Query Console. A remote attacker who lures an authenticated Query Console user to a malicious page could submit unauthorized requests and execute server-side code with the victim's permissions.","source":"NVD","date":"2026-10-12T17:17:36.373Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85960","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-85960"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"security@progress.com"},"read":false,"kev":false,"recordIds":["CVE-2026-85960"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85960"}],"epss":null},{"id":"CVE-2026-85959","title":"CVE-2026-85959 — Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not consistently","summary":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not consistently record successful authentication events in audit logs, which could limit customers' ability to detect and investigate unauthorized access or credential misuse.","source":"NVD","date":"2026-10-12T17:17:36.247Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85959","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-85959"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","source":"security@progress.com"},"read":false,"kev":false,"recordIds":["CVE-2026-85959"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85959"}],"epss":null},{"id":"CVE-2026-85958","title":"CVE-2026-85958 — Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authenti","summary":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authentication validation weakness that could allow an attacker to use a token that should not be accepted by the affected server, which could result in unauthorized access.","source":"NVD","date":"2026-10-12T17:17:36.120Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85958","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-85958"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","source":"security@progress.com"},"read":false,"kev":false,"recordIds":["CVE-2026-85958"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85958"}],"epss":null},{"id":"CVE-2026-85957","title":"CVE-2026-85957 — Affected Progress MarkLogic Server 11.x releases before 11.3.7 use a SAML parser configuration that can p","summary":"Affected Progress MarkLogic Server 11.x releases before 11.3.7 use a SAML parser configuration that can process external DTDs or entities, which could result in unintended network access or information disclosure.","source":"NVD","date":"2026-10-12T17:17:35.990Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85957","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-85957"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","source":"security@progress.com"},"read":false,"kev":false,"recordIds":["CVE-2026-85957"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85957"}],"epss":null},{"id":"CVE-2026-84286","title":"CVE-2026-84286 — ExLlamaV3’s EXL3 loader uses an untrusted, model-supplied index to select a CUDA kernel without first ver","summary":"ExLlamaV3’s EXL3 loader uses an untrusted, model-supplied index to select a CUDA kernel without first verifying that the index is within bounds. A malicious model can force the code to read and invoke an out‑of‑range function pointer, resulting in a reproducible crash. Under specific conditions involving certain host memory layouts, it may be possible for an attacker to exploit this vulnerability to achieve controlled indirect kernel dispatch during model load.","source":"NVD","date":"2026-10-12T17:17:35.873Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84286","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-84286"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-84286"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84286"}],"epss":null},{"id":"CVE-2026-75888","title":"CVE-2026-75888 — A flaw was found in the OpenShift console. An authenticated console user can exploit a Server-Side Reques","summary":"A flaw was found in the OpenShift console. An authenticated console user can exploit a Server-Side Request Forgery (SSRF) vulnerability by providing a specially crafted Helm chart URL without proper validation. This allows the user to make the console pod fetch arbitrary URLs, potentially leading to the disclosure of sensitive information through error messages or enabling blind port scanning within the cluster.","source":"NVD","date":"2026-10-12T17:17:35.723Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75888","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-75888"],"cvss":{"score":7.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","source":"secalert@redhat.com"},"read":false,"kev":false,"recordIds":["CVE-2026-75888"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75888"}],"epss":null},{"id":"CVE-2026-109374","title":"CVE-2026-109374 — ZITADEL 3.0.0 before 4.19.2 contains a privilege escalation vulnerability in OIDC token exchange that all","summary":"ZITADEL 3.0.0 before 4.19.2 contains a privilege escalation vulnerability in OIDC token exchange that allows end-user impersonators to impersonate administrators including IAM_OWNER by bypassing the admin.impersonation check. Attackers holding IAM_END_USER_IMPERSONATOR or ORG_END_USER_IMPERSONATOR roles can sign in to relying applications as administrators with their roles and claims.","source":"NVD","date":"2026-10-12T17:17:35.277Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109374","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109374"],"cvss":{"score":5.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109374"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109374"}],"epss":null},{"id":"CVE-2026-109373","title":"CVE-2026-109373 — ZITADEL 3.0.0 before 4.19.2 contains an authentication bypass vulnerability in the Login V2 UI that allow","summary":"ZITADEL 3.0.0 before 4.19.2 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to obtain other users' session tokens by forging unsigned session cookies. Attackers can guess time-ordered session IDs around a victim's sign-in and supply them with empty tokens to receive rotated tokens, taking over accounts including MFA-completed administrator sessions.","source":"NVD","date":"2026-10-12T17:17:35.110Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109373","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109373"],"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109373"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109373"}],"epss":null},{"id":"CVE-2026-109372","title":"CVE-2026-109372 — ZITADEL 4.x before 4.19.2 and 3.x through 3.4.15 contains an authentication bypass in the SAML identity-p","summary":"ZITADEL 4.x before 4.19.2 and 3.x through 3.4.15 contains an authentication bypass in the SAML identity-provider intent callback, which verifies the assertion signature using the provider named in the request URL but resolves the user from the login intent without checking they match. Attackers with organization-administrator permission can register a SAML provider with their own signing key to obtain authenticated sessions as any user linked to another SAML provider on the instance, including in other organizations.","source":"NVD","date":"2026-10-12T17:17:34.800Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109372","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109372"],"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109372"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109372"}],"epss":null},{"id":"CVE-2026-109371","title":"CVE-2026-109371 — ZITADEL 3.0.0 before 4.18.0 contains a missing authentication vulnerability in the hosted Login V1 UI, wh","summary":"ZITADEL 3.0.0 before 4.18.0 contains a missing authentication vulnerability in the hosted Login V1 UI, where the change-username handler acts on the account bound to a login flow before any factor is verified. Unauthenticated attackers can submit a victim's login name and then post a new username to rename any active human user, including administrators, locking them out.","source":"NVD","date":"2026-10-12T17:17:34.547Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109371","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109371"],"cvss":{"score":8.8,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109371"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109371"}],"epss":null},{"id":"CVE-2026-109366","title":"CVE-2026-109366 — Zebra before 6.4.0 contains an improper integrity validation vulnerability in the inbound gossip download","summary":"Zebra before 6.4.0 contains an improper integrity validation vulnerability in the inbound gossip download path that allows unauthenticated peers to force dropping of new blocks without penalty. Attackers can serve a real block with a coinbase scriptSig rewritten to height 1, which keeps the ZIP-244 block hash, triggering a behind-tip drop before consensus validation and delaying tip discovery for mining backends.","source":"NVD","date":"2026-10-12T17:17:34.393Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109366","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109366"],"cvss":{"score":6.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109366"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109366"}],"epss":null},{"id":"CVE-2026-109365","title":"CVE-2026-109365 — Zebra before 6.4.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticate","summary":"Zebra before 6.4.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated peers to force full proof verification by serving forged block bodies with valid header hashes. Attackers can flip authorizing-only bytes such as a coinbase scriptSig, wasting Sapling, Orchard, and Ironwood proof verification without penalty and stalling sync for 67 seconds.","source":"NVD","date":"2026-10-12T17:17:34.247Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109365","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109365"],"cvss":{"score":6.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109365"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109365"}],"epss":null},{"id":"CVE-2026-109364","title":"CVE-2026-109364 — Zebra 2.3.0 before 6.4.0 contains a protection mechanism failure that allows unauthenticated peers to eva","summary":"Zebra 2.3.0 before 6.4.0 contains a protection mechanism failure that allows unauthenticated peers to evade bans because bans and misbehavior scores are keyed on exact IP addresses. Attackers can reconnect from fresh IPv6 addresses in their /64 allocation or flush the 20,000-entry FIFO ban list to restore access for banned peers.","source":"NVD","date":"2026-10-12T17:17:34.103Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109364","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109364"],"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109364"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109364"}],"epss":null},{"id":"CVE-2026-109363","title":"CVE-2026-109363 — ZcashFoundation Zebra 6.4.0 before 6.4.2 parses version 6 transactions carrying a pre-NU6.3 consensus bra","summary":"ZcashFoundation Zebra 6.4.0 before 6.4.2 parses version 6 transactions carrying a pre-NU6.3 consensus branch ID, but the size computation during UnminedTx construction treats re-serialization of the Orchard bundle as infallible, so the resulting error trips an expect that aborts zebrad. Unauthenticated peers can send a single pre-handshake tx message to crash the node, and can repeat this after each restart.","source":"NVD","date":"2026-10-12T17:17:33.953Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109363","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109363"],"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109363"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109363"}],"epss":null},{"id":"CVE-2026-109362","title":"CVE-2026-109362 — Heym v0.0.5 before v0.0.113 contains a broken access control vulnerability that allows former collaborato","summary":"Heym v0.0.5 before v0.0.113 contains a broken access control vulnerability that allows former collaborators to keep executing JWT-auth workflows by reusing scoped workflow:execute tokens after share removal. Attackers can mint a token with a TTL up to 10 years, which the owner cannot list or revoke, and repeatedly run the workflow consuming shared credentials.","source":"NVD","date":"2026-10-12T17:17:33.783Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109362","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109362"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109362"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109362"}],"epss":null},{"id":"CVE-2026-109361","title":"CVE-2026-109361 — MONAI 1.2.0 before 1.6.1 contains an insecure deserialization vulnerability in nnUNetV2Runner that unpick","summary":"MONAI 1.2.0 before 1.6.1 contains an insecure deserialization vulnerability in nnUNetV2Runner that unpickles the postprocessing_file path read from inference_information.json without confining it to the results directory. Attackers who can modify inference_information.json can point it at a malicious pickle elsewhere on the filesystem to execute code when predict_ensemble_postprocessing runs.","source":"NVD","date":"2026-10-12T17:17:33.630Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109361","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109361"],"cvss":{"score":7,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109361"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109361"}],"epss":null},{"id":"CVE-2026-109360","title":"CVE-2026-109360 — MONAI 0.4.0 before 1.6.1 contains a remote code execution vulnerability that allows on-path attackers to ","summary":"MONAI 0.4.0 before 1.6.1 contains a remote code execution vulnerability that allows on-path attackers to execute code by tampering with SENet pretrained weights fetched over plaintext HTTP. Attackers can substitute a crafted .pth file that load_state_dict_from_url unpickles without weights_only=True, executing code when SEResNet50 or other SENet models are constructed with pretrained=True.","source":"NVD","date":"2026-10-12T17:17:33.480Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109360","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109360"],"cvss":{"score":7.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109360"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109360"}],"epss":null},{"id":"CVE-2026-109359","title":"CVE-2026-109359 — Contrast 1.8.0 before 1.24.1 contains an improper verification vulnerability in Coordinator peer recovery","summary":"Contrast 1.8.0 before 1.24.1 contains an improper verification vulnerability in Coordinator peer recovery that fails to confirm the serving peer uses the same manifest generation. Attackers with write access to manifest history can replay a superseded history head so withdrawn workloads obtain trusted mesh certificates, or with the secret seed disclose the Mesh CA key.","source":"NVD","date":"2026-10-12T17:17:33.327Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109359","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109359"],"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109359"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109359"}],"epss":null},{"id":"CVE-2026-109358","title":"CVE-2026-109358 — Edgeless Systems Contrast 1.8.0 before 1.24.1 contains an incorrect permissions vulnerability where the n","summary":"Edgeless Systems Contrast 1.8.0 before 1.24.1 contains an incorrect permissions vulnerability where the node installer writes the containerd config world-writable (0666). Local unprivileged users on the node can modify the containerd config, for example overwriting the runc location, to escalate privileges.","source":"NVD","date":"2026-10-12T17:17:33.177Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109358","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109358"],"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109358"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109358"}],"epss":null},{"id":"CVE-2026-109357","title":"CVE-2026-109357 — LibreNMS before 26.9.0 contains an LDAP filter injection in ldap-authorization and ad-authorization modes","summary":"LibreNMS before 26.9.0 contains an LDAP filter injection in ldap-authorization and ad-authorization modes because usernames are inserted unescaped into LDAP search filters and authentication only checks user existence. When REMOTE_USER is not forwarded, unauthenticated attackers can send a wildcard username via HTTP Basic Authorization (PHP_AUTH_USER) to match all users and groups and gain admin access.","source":"NVD","date":"2026-10-12T17:17:33.020Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109357","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109357"],"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109357"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109357"}],"epss":null},{"id":"CVE-2026-109356","title":"CVE-2026-109356 — LibreNMS before 26.9.0 contains a missing authorization vulnerability in PortsController::purge that allo","summary":"LibreNMS before 26.9.0 contains a missing authorization vulnerability in PortsController::purge that allows global-read users to physically delete ports without delete privileges. Attackers with read-only accounts can send DELETE requests to /ports/purge, using purge=all to irreversibly erase every deleted port on all visible devices.","source":"NVD","date":"2026-10-12T17:17:32.870Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109356","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109356"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109356"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109356"}],"epss":null},{"id":"CVE-2026-109355","title":"CVE-2026-109355 — LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in get_oxidized_nodes_list() ","summary":"LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in get_oxidized_nodes_list() that renders Oxidized API fields and SNMP sysName unescaped. Attackers controlling the Oxidized response or a device's SNMP sysName can inject script that executes in browsers of users viewing the Tools Oxidized page.","source":"NVD","date":"2026-10-12T17:17:32.720Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109355","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109355"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109355"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109355"}],"epss":null},{"id":"CVE-2026-109354","title":"CVE-2026-109354 — LibreNMS before 26.9.0 contains a path traversal vulnerability in nfsen_channel_common.inc.php that allow","summary":"LibreNMS before 26.9.0 contains a path traversal vulnerability in nfsen_channel_common.inc.php that allows authenticated users to read unauthorized RRD data by injecting ../ sequences into the channel parameter. Attackers with access to one NFSen-enabled device can request graph.php with a traversed channel value to view traffic and NetFlow graphs of devices outside their authorized scope.","source":"NVD","date":"2026-10-12T17:17:32.573Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109354","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109354"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109354"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109354"}],"epss":null},{"id":"CVE-2026-109353","title":"CVE-2026-109353 — LibreNMS before 26.9.0 contains an SQL injection vulnerability that allows unprivileged users to inject S","summary":"LibreNMS before 26.9.0 contains an SQL injection vulnerability that allows unprivileged users to inject SQL by supplying an array-valued notification_id parameter to notifications.inc.php. Attackers can perform cross-table reads of users.password hashes, with results persisted in notifications_attribs and readable through the interface.","source":"NVD","date":"2026-10-12T17:17:32.423Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109353","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109353"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109353"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109353"}],"epss":null},{"id":"CVE-2026-109352","title":"CVE-2026-109352 — LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in includes/html/pages/device","summary":"LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in includes/html/pages/device/wireless.inc.php, which echoes wireless sensor sensor_descr values, populated from SNMP DisplayString fields during discovery, into HTML without escaping. Attackers controlling a monitored device's SNMP agent can set values such as AI-AP-MIB::aiSSID to malicious JavaScript that executes when authenticated users view the device's Wireless tab, enabling session hijacking.","source":"NVD","date":"2026-10-12T17:17:32.270Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109352","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109352"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109352"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109352"}],"epss":null},{"id":"CVE-2026-109351","title":"CVE-2026-109351 — Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulnerability that allows remo","summary":"Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulnerability that allows remote attackers to abort the process by supplying a huge pack-header object count. Malicious remotes can serve a 12-byte pack header claiming 0xFFFFFFFF objects, forcing Tree::with_capacity to reserve hundreds of gigabytes and crash clone or fetch operations.","source":"NVD","date":"2026-10-12T17:17:32.123Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109351","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109351"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109351"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109351"}],"epss":null},{"id":"CVE-2026-109350","title":"CVE-2026-109350 — Gitoxide gix-pack before 0.75.0 contains a denial of service vulnerability that allows malicious remotes ","summary":"Gitoxide gix-pack before 0.75.0 contains a denial of service vulnerability that allows malicious remotes to crash fetch operations by sending crafted thin-pack OFS_DELTA entries. Attackers can serve a thin pack with a REF_DELTA referencing an existing object followed by an OFS_DELTA whose base_distance exceeds pack_offset, triggering a panic in LookupRefDeltaObjectsIter that aborts the fetch process.","source":"NVD","date":"2026-10-12T17:17:31.973Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109350","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109350"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109350"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109350"}],"epss":null},{"id":"CVE-2026-109349","title":"CVE-2026-109349 — gitoxide gix-pack before 0.75.0 contains a reachable assertion in BytesToEntriesIter::new_from_header: th","summary":"gitoxide gix-pack before 0.75.0 contains a reachable assertion in BytesToEntriesIter::new_from_header: the pack header decoder accepts version 3, but a release-enabled assert_eq! requires version 2. A malicious remote can send a 12-byte pack header declaring version 3 to panic the client and abort the clone or fetch.","source":"NVD","date":"2026-10-12T17:17:31.823Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109349","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109349"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109349"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109349"}],"epss":null},{"id":"CVE-2026-109348","title":"CVE-2026-109348 — Gitoxide gix-mailmap before 0.35.0 contains a denial of service vulnerability that allows attackers to ex","summary":"Gitoxide gix-mailmap before 0.35.0 contains a denial of service vulnerability that allows attackers to exhaust CPU through quadratic-time parsing in Snapshot::from_bytes. Attackers can commit a crafted .mailmap with descending-ordered entries forcing repeated front inserts, blocking workers running log, blame, or shortlog for minutes.","source":"NVD","date":"2026-10-12T17:17:31.673Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109348","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109348"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109348"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109348"}],"epss":null},{"id":"CVE-2026-109347","title":"CVE-2026-109347 — Adminer before 6.1.1 contains a remote code execution vulnerability that allows authenticated SQLite user","summary":"Adminer before 6.1.1 contains a remote code execution vulnerability that allows authenticated SQLite users to bypass ATTACH and VACUUM INTO restrictions by prefixing statements with a UTF-8 byte-order mark. Attackers can attach a database file at a PHP-served path and create a table named with PHP code to execute it as the web server user.","source":"NVD","date":"2026-10-12T17:17:31.517Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109347","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109347"],"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109347"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109347"}],"epss":null},{"id":"CVE-2026-109346","title":"CVE-2026-109346 — better-auth from 1.3.8-beta.3 before 1.7.0-rc.3 contains a UI misrepresentation vulnerability in the devi","summary":"better-auth from 1.3.8-beta.3 before 1.7.0-rc.3 contains a UI misrepresentation vulnerability in the deviceAuthorization plugin because GET /device omits the requesting client_id and scope. Attackers can start a device request via /device/code, trick signed-in users into approving the code, then redeem it at /device/token for a live session token.","source":"NVD","date":"2026-10-12T17:17:31.367Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109346","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109346"],"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109346"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109346"}],"epss":null},{"id":"CVE-2026-109345","title":"CVE-2026-109345 — DOMPurify before 3.4.16 contains a cross-site scripting vulnerability that allows attackers to bypass san","summary":"DOMPurify before 3.4.16 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization because IN_PLACE mode returns a force-removed style element whose text content still carries markup. Attackers can supply a style element containing a closing style tag and an img onerror payload, which executes script when the application serializes and re-parses the returned node.","source":"NVD","date":"2026-10-12T17:17:31.217Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109345","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109345"],"cvss":{"score":5.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109345"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109345"}],"epss":null},{"id":"CVE-2026-109344","title":"CVE-2026-109344 — DOMPurify from 3.4.13 before 3.4.16 contains a cross-site scripting vulnerability because IN_PLACE mode f","summary":"DOMPurify from 3.4.13 before 3.4.16 contains a cross-site scripting vulnerability because IN_PLACE mode fails to neutralize subtrees detached by afterSanitizeElements or afterSanitizeAttributes hooks. Attackers can supply markup with on* handlers inside a wrapper removed by such hooks, leaving handlers armed on the live DOM to execute script in the victim origin.","source":"NVD","date":"2026-10-12T17:17:31.060Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109344","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109344"],"cvss":{"score":5.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109344"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109344"}],"epss":null},{"id":"CVE-2026-109343","title":"CVE-2026-109343 — SurrealDB before 3.3.0 allows cross-tenant access because the SurrealQL USE statement switches a session ","summary":"SurrealDB before 3.3.0 allows cross-tenant access because the SurrealQL USE statement switches a session to any namespace/database without checking that the caller's authenticated level covers it. Authenticated namespace, database, or record users can switch to another tenant and read, create, update, or delete rows in tables whose PERMISSIONS allow it, such as PERMISSIONS FULL.","source":"NVD","date":"2026-10-12T17:17:30.890Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109343","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109343"],"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109343"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109343"}],"epss":null},{"id":"CVE-2026-109342","title":"CVE-2026-109342 — SurrealDB from 3.0.0 before 3.3.0 contains a missing authentication vulnerability in the revoke RPC metho","summary":"SurrealDB from 3.0.0 before 3.3.0 contains a missing authentication vulnerability in the revoke RPC method that allows low-privileged or unauthenticated callers to invalidate other users' refresh tokens without proof of possession. Attackers can obtain grant identifiers via ACCESS SHOW ALL with VIEWER permission or leaked tokens, then permanently revoke refresh tokens to force re-authentication.","source":"NVD","date":"2026-10-12T17:17:30.720Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109342","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109342"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109342"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109342"}],"epss":null},{"id":"CVE-2026-109341","title":"CVE-2026-109341 — SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows callers with table-leve","summary":"SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows callers with table-level write permission to read SELECT-restricted fields by resolving JSON Patch pointers against the unreduced record. Attackers can use PATCH copy or move operations to copy hidden fields into readable destinations, or abuse test mismatch errors as a disclosure oracle.","source":"NVD","date":"2026-10-12T17:17:30.550Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109341","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109341"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109341"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109341"}],"epss":null},{"id":"CVE-2026-109340","title":"CVE-2026-109340 — SurrealDB from 3.1.0 before 3.3.0 contains an authorization bypass vulnerability that allows authenticate","summary":"SurrealDB from 3.1.0 before 3.3.0 contains an authorization bypass vulnerability that allows authenticated users to delete protected graph edges by triggering a REFERENCE ON DELETE CASCADE. Attackers with delete permission on a referenced table can delete a record whose cascade disables permission checks for edge cleanup, erasing edges despite the edge table's PERMISSIONS FOR delete clause.","source":"NVD","date":"2026-10-12T17:17:30.380Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109340","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109340"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109340"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109340"}],"epss":null},{"id":"CVE-2026-109339","title":"CVE-2026-109339 — SurrealDB 3.1.0 before 3.3.0 lets Surrealism modules exhaust server memory because module stdout/stderr l","summary":"SurrealDB 3.1.0 before 3.3.0 lets Surrealism modules exhaust server memory because module stdout/stderr lines are buffered unbounded in host memory, bypassing the configured module memory limit. An attacker can run an Owner-installed malicious module that writes output without newlines, crashing the server and denying service to all namespaces and databases.","source":"NVD","date":"2026-10-12T17:17:30.233Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109339","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109339"],"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109339"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109339"}],"epss":null},{"id":"CVE-2026-109338","title":"CVE-2026-109338 — SurrealDB before 3.3.0 contains a denial of service vulnerability that allows query-capable users to cras","summary":"SurrealDB before 3.3.0 contains a denial of service vulnerability that allows query-capable users to crash the server by reading non-ASCII header values in embedded JavaScript. Attackers with scripting enabled can read such values via Headers get(), entries(), values(), or getSetCookie(), or return them from fetch() endpoints, aborting the server process.","source":"NVD","date":"2026-10-12T17:17:30.060Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109338","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109338"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109338"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109338"}],"epss":null},{"id":"CVE-2026-109337","title":"CVE-2026-109337 — SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to infer f","summary":"SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to infer field values hidden by field-level SELECT permissions using LIVE SELECT WHERE predicates over $before or $after. Attackers can craft repeated predicates and observe whether notifications are delivered on CREATE, UPDATE, or DELETE to confirm or narrow restricted field values.","source":"NVD","date":"2026-10-12T17:17:29.887Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109337","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109337"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109337"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109337"}],"epss":null},{"id":"CVE-2026-109336","title":"CVE-2026-109336 — SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to read fi","summary":"SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to read fields hidden by field-level SELECT permissions through LIVE SELECT projections. Attackers can project restricted fields from the unreduced $after or $before parameters under an alias to receive exact stored values in CREATE, UPDATE, and DELETE notifications.","source":"NVD","date":"2026-10-12T17:17:29.710Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109336","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109336"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109336"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109336"}],"epss":null},{"id":"CVE-2026-109335","title":"CVE-2026-109335 — SurrealDB from 3.0.0 before 3.3.0 contains an information disclosure vulnerability that allows record use","summary":"SurrealDB from 3.0.0 before 3.3.0 contains an information disclosure vulnerability that allows record users to read values hidden by field-level SELECT permissions through COMPUTED fields. Attackers can select records whose readable COMPUTED fields derive from hidden fields, or use write RETURN clauses with $before/$after to expose hidden values.","source":"NVD","date":"2026-10-12T17:17:29.533Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109335","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109335"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109335"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109335"}],"epss":null},{"id":"CVE-2026-109334","title":"CVE-2026-109334 — SurrealDB before 3.3.0 does not check the caller-selected namespace or database against the level at whic","summary":"SurrealDB before 3.3.0 does not check the caller-selected namespace or database against the level at which a namespace- or database-level system user authenticated, allowing cross-tenant access. An authenticated attacker can set the Surreal-NS/Surreal-DB headers on /sql or call the RPC use method to read, create, modify, and delete rows and read DEFINE PARAM values in another tenant where table PERMISSIONS allow it.","source":"NVD","date":"2026-10-12T17:17:29.363Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109334","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109334"],"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109334"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109334"}],"epss":null},{"id":"CVE-2026-109333","title":"CVE-2026-109333 — SurrealDB from 3.0.0 before 3.3.0 contains an authorization bypass vulnerability that allows authenticate","summary":"SurrealDB from 3.0.0 before 3.3.0 contains an authorization bypass vulnerability that allows authenticated record users to read records in other namespaces or databases by resolving record ids through FETCH. Attackers can switch to a foreign namespace/database and name a known record id in a RETURN … FETCH query to read another tenant's data when table PERMISSIONS allow reads.","source":"NVD","date":"2026-10-12T17:17:29.190Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109333","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109333"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109333"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109333"}],"epss":null},{"id":"CVE-2026-109332","title":"CVE-2026-109332 — Network-AI (npm network-ai) before 5.15.2 contains an origin validation error in McpSseServer._handleRequ","summary":"Network-AI (npm network-ai) before 5.15.2 contains an origin validation error in McpSseServer._handleRequest in lib/mcp-transport-sse.ts that reflects localhost Origins into Access-Control-Allow-Origin regardless of bind interface. When the server binds a non-loopback address, an attacker page with a localhost Origin visited by a victim can read unauthenticated endpoints like /health cross-origin.","source":"NVD","date":"2026-10-12T17:17:29.020Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109332","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109332"],"cvss":{"score":2.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109332"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109332"}],"epss":null},{"id":"CVE-2026-109331","title":"CVE-2026-109331 — Network-AI from 5.14.0 before 5.15.2 contains a security control bypass vulnerability in the ClaudeHookBr","summary":"Network-AI from 5.14.0 before 5.15.2 contains a security control bypass vulnerability in the ClaudeHookBridge PreToolUse hook, which matches deny patterns only against the first present candidate field. A prompt-injected agent can place dangerous payloads in fields like Write content or an MCP script parameter beside a benign file_path or command, evading denyPatterns to write web shells or execute scripts.","source":"NVD","date":"2026-10-12T17:17:28.843Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109331","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109331"],"cvss":{"score":7.5,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109331"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109331"}],"epss":null},{"id":"CVE-2026-109330","title":"CVE-2026-109330 — Network-AI 5.0.0 before 5.15.2 contains a cross-site WebSocket hijacking vulnerability in DashboardServer","summary":"Network-AI 5.0.0 before 5.15.2 contains a cross-site WebSocket hijacking vulnerability in DashboardServer that allows remote attackers to read live agent topology because handleUpgrade performs no Origin or token validation. Attackers can lure a victim running the dashboard to a malicious page that opens a WebSocket to the loopback dashboard and exfiltrates agent IDs, roles, task descriptions, and token budgets.","source":"NVD","date":"2026-10-12T17:17:28.670Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109330","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109330"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109330"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109330"}],"epss":null},{"id":"CVE-2026-109329","title":"CVE-2026-109329 — Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 contains a broken access control vulnerability that ","summary":"Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 contains a broken access control vulnerability that allows role administrators to assign users to roles in other organizations. Attackers can submit crafted assign requests to members_assignment.php with a foreign role UUID to gain privileged membership, log into that organization, and edit its user profiles.","source":"NVD","date":"2026-10-12T17:17:28.500Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109329","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109329"],"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109329"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109329"}],"epss":null},{"id":"CVE-2026-109328","title":"CVE-2026-109328 — Admidio 5.0.0 before 5.0.15 contains an unauthenticated stored cross-site scripting vulnerability in Regi","summary":"Admidio 5.0.0 before 5.0.15 contains an unauthenticated stored cross-site scripting vulnerability in RegistrationPresenter.php, which inserts the raw FIRST_NAME registration value into an unencoded data-message attribute. Attackers can register with a double-quoted event handler that executes JavaScript in an administrator's session when they hover the entry on the Manage registrations page.","source":"NVD","date":"2026-10-12T17:17:28.340Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109328","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109328"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109328"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109328"}],"epss":null},{"id":"CVE-2026-109327","title":"CVE-2026-109327 — Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 contains a reflected cross-site scripting vulnerabi","summary":"Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 contains a reflected cross-site scripting vulnerability in system/redirect.php that allows unauthenticated attackers to inject JavaScript via the url GET parameter, due to an incomplete fix for CVE-2021-43810. Attackers can craft a javascript: URL containing a decoy http:// segment that passes validation and executes script in the Admidio origin when victims click the redirect link.","source":"NVD","date":"2026-10-12T17:17:28.187Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109327","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109327"],"cvss":{"score":5.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109327"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109327"}],"epss":null},{"id":"CVE-2026-109326","title":"CVE-2026-109326 — Grav before 2.1.7 contains an information disclosure vulnerability because bundled nginx, lighttpd, IIS, ","summary":"Grav before 2.1.7 contains an information disclosure vulnerability because bundled nginx, lighttpd, IIS, and Caddy 2 configurations block .git only at document root. Unauthenticated attackers can request nested repositories such as user/.git to retrieve Git config, refs, and objects, reconstructing unpublished history or committed secrets.","source":"NVD","date":"2026-10-12T17:17:28.017Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109326","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109326"],"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109326"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109326"}],"epss":null},{"id":"CVE-2026-109325","title":"CVE-2026-109325 — Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in the Clockwork profiler t","summary":"Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in the Clockwork profiler that trusts loopback REMOTE_ADDR values. Unauthenticated attackers behind a same-host HTTP proxy can read profiler records exposing system and plugin configuration, secrets, request metadata, and queries.","source":"NVD","date":"2026-10-12T17:17:27.860Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109325","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109325"],"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109325"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109325"}],"epss":null},{"id":"CVE-2026-109324","title":"CVE-2026-109324 — Grav before 2.1.7 contains a denial of service vulnerability that allows authenticated media authors to e","summary":"Grav before 2.1.7 contains a denial of service vulnerability that allows authenticated media authors to exhaust memory by uploading compressed oversized raster images. Attackers can reference a Twig or Markdown transform so GD or Imagick decodes the full source without dimension checks, letting anonymous requests repeatedly cause page unavailability.","source":"NVD","date":"2026-10-12T17:17:27.690Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109324","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109324"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109324"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109324"}],"epss":null},{"id":"CVE-2026-109323","title":"CVE-2026-109323 — Grav Star Ratings 2.0.1 through 2.0.3 contains a missing authorization vulnerability that allows unauthen","summary":"Grav Star Ratings 2.0.1 through 2.0.3 contains a missing authorization vulnerability that allows unauthenticated visitors to vote by bypassing client-only vote_access and readonly enforcement. Attackers can use the anonymous nonce emitted by getData() to submit votes directly to addVote(), manipulating restricted or disabled ratings and aggregate rating output.","source":"NVD","date":"2026-10-12T17:17:27.547Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109323","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109323"],"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109323"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109323"}],"epss":null},{"id":"CVE-2026-109322","title":"CVE-2026-109322 — Grav Guestbook plugin before 0.5.2 contains a stored cross-site scripting vulnerability because its AJAX ","summary":"Grav Guestbook plugin before 0.5.2 contains a stored cross-site scripting vulnerability because its AJAX Load more and Admin Load all handlers insert stored author and message fields into the DOM as unescaped HTML via jQuery. Unauthenticated visitors can submit markup that executes in other visitors' browsers and, in versions 0.5.0 and 0.5.1, in administrator moderation sessions.","source":"NVD","date":"2026-10-12T17:17:27.400Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109322","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109322"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109322"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109322"}],"epss":null},{"id":"CVE-2026-109321","title":"CVE-2026-109321 — Grav Login OAuth plugin (grav-plugin-login-oauth) before 1.4.3 provisions OAuth accounts as ordinary Grav","summary":"Grav Login OAuth plugin (grav-plugin-login-oauth) before 1.4.3 provisions OAuth accounts as ordinary Grav users with a deterministic <provider>.<id> username and an unsalted MD5 hash of the provider identifier as the password, without disabling password login. Unauthenticated remote attackers who learn or guess a provider identifier can reproduce these credentials and log in, gaining administrative control of privileged accounts.","source":"NVD","date":"2026-10-12T17:17:27.247Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109321","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109321"],"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109321"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109321"}],"epss":null},{"id":"CVE-2026-109320","title":"CVE-2026-109320 — The Grav API plugin (grav-plugin-api) before 1.0.36 contains an improper session validation vulnerability","summary":"The Grav API plugin (grav-plugin-api) before 1.0.36 contains an improper session validation vulnerability that allows disabled accounts to keep API access, because SessionAuthenticator does not enforce account state. Disabled users can reuse an already authorized browser or remember-me session to call API endpoints until expiry, defeating operator revocation.","source":"NVD","date":"2026-10-12T17:17:27.097Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109320","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109320"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109320"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109320"}],"epss":null},{"id":"CVE-2026-109319","title":"CVE-2026-109319 — Grav Guestbook plugin 0.5.0 and 0.5.1 contains missing authorization and cross-site request forgery vulne","summary":"Grav Guestbook plugin 0.5.0 and 0.5.1 contains missing authorization and cross-site request forgery vulnerabilities in Admin moderation actions delete, approve, and approveAll. Authenticated Admin users lacking the admin.guestbook permission, or external sites abusing a moderator's session via nonce-less GET requests, can delete or approve Guestbook entries.","source":"NVD","date":"2026-10-12T17:17:26.950Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109319","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109319"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109319"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109319"}],"epss":null},{"id":"CVE-2026-109318","title":"CVE-2026-109318 — Grav Git Sync 1.0.2 through 3.4.12 contains a command injection vulnerability that allows authenticated c","summary":"Grav Git Sync 1.0.2 through 3.4.12 contains a command injection vulnerability that allows authenticated content editors to execute OS commands by injecting shell substitutions into profile fields. When the gravuser or gravfull author mode is enabled, attackers can set a malicious username, full name, or email that reaches PHP exec() via git commit --author, running commands as the web-server account.","source":"NVD","date":"2026-10-12T17:17:26.807Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109318","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109318"],"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109318"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109318"}],"epss":null},{"id":"CVE-2026-109317","title":"CVE-2026-109317 — Grav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability that allows delegated us","summary":"Grav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability that allows delegated user managers to obtain super-admin access by storing positive scalar admin or api parent grants. Attackers with api.users.write can edit account access maps or invitations so the inheriting permission resolver satisfies requireSuper checks, accessing super-only API endpoints.","source":"NVD","date":"2026-10-12T17:17:26.653Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109317","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109317"],"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109317"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109317"}],"epss":null},{"id":"CVE-2026-109316","title":"CVE-2026-109316 — Grav Data Manager plugin 1.4.0 through 1.4.5 contains a missing authorization vulnerability that allows u","summary":"Grav Data Manager plugin 1.4.0 through 1.4.5 contains a missing authorization vulnerability that allows unauthenticated attackers to delete stored data files via the classic Admin integration. Attackers can send a request with the delete parameter and known data type and filename to remove files under user/data/, including form submissions, or forge requests lacking CSRF nonce checks.","source":"NVD","date":"2026-10-12T17:17:26.507Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109316","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109316"],"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109316"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109316"}],"epss":null},{"id":"CVE-2026-109315","title":"CVE-2026-109315 — Grav from 2.0.22 before 2.1.7 contains an information disclosure vulnerability that allows page editors t","summary":"Grav from 2.0.22 before 2.1.7 contains an information disclosure vulnerability that allows page editors to read the Clockwork debugger token because the sandbox redaction list omits system.debugger.token. Attackers can render the token through editor-authored Twig and supply it as X-Clockwork-Auth to read profiler records with configuration, request metadata, and database queries.","source":"NVD","date":"2026-10-12T17:17:26.340Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109315","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109315"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109315"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109315"}],"epss":null},{"id":"CVE-2026-109314","title":"CVE-2026-109314 — Grav Login plugin 1.2.0 before 3.9.9 contains an information disclosure vulnerability that allows publish","summary":"Grav Login plugin 1.2.0 before 3.9.9 contains an information disclosure vulnerability that allows publishers to obtain password-reset tokens by authoring a page at the reset route. When a victim opens an emailed reset link, the publisher-controlled page rendered by Login::getPage() exposes the username and bearer token, enabling takeover of more privileged accounts.","source":"NVD","date":"2026-10-12T17:17:26.193Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109314","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109314"],"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109314"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109314"}],"epss":null},{"id":"CVE-2026-109313","title":"CVE-2026-109313 — Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerability that allows attacker","summary":"Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerability that allows attackers with a valid password to skip two-factor authentication through remember-me cookie restoration. Attackers can obtain a persistent remember-me cookie after the password step and restore it as a fully authorized session without completing the second factor.","source":"NVD","date":"2026-10-12T17:17:26.043Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109313","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109313"],"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109313"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109313"}],"epss":null},{"id":"CVE-2026-109312","title":"CVE-2026-109312 — Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass in processUserProfile(), which che","summary":"Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass in processUserProfile(), which checks that the session user exists but not that a pending front-end 2FA session is fully authorized. Attackers with a victim's password who can publish a page form without an access rule can invoke update_user before completing 2FA to disable twofa_enabled and take over the account.","source":"NVD","date":"2026-10-12T17:17:25.890Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109312","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109312"],"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109312"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109312"}],"epss":null},{"id":"CVE-2026-109311","title":"CVE-2026-109311 — vLLM before 0.29.0 passes uploaded audio to the PyAV/FFmpeg av.open() fallback with only a file-size chec","summary":"vLLM before 0.29.0 passes uploaded audio to the PyAV/FFmpeg av.open() fallback with only a file-size check, exposing FFmpeg's IAMF parser heap overflow. Authenticated remote attackers can repeatedly upload malformed IAMF containers to /v1/audio/transcriptions, corrupting the heap and crashing the API process.","source":"NVD","date":"2026-10-12T17:17:25.730Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109311","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109311"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109311"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109311"}],"epss":null},{"id":"CVE-2026-109310","title":"CVE-2026-109310 — SiYuan v3.1.12 before v3.8.6 fails to restrict the Sprig template function map in the /api/icon/getDynami","summary":"SiYuan v3.1.12 before v3.8.6 fails to restrict the Sprig template function map in the /api/icon/getDynamicIcon content parameter, allowing resource exhaustion. A publish reader, or anyone when publish auth is disabled, can use uncapped functions like until to OOM-kill the kernel with one request.","source":"NVD","date":"2026-10-12T17:17:25.560Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109310","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109310"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109310"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109310"}],"epss":null},{"id":"CVE-2026-109309","title":"CVE-2026-109309 — SiYuan v3.7.0 before v3.8.6 contains an absolute path traversal vulnerability in the kernel's private plu","summary":"SiYuan v3.7.0 before v3.8.6 contains an absolute path traversal vulnerability in the kernel's private plugin HTTP server, which passes a kernel plugin handler's ResponseFile.Path to gin's Context.File without validation. Attackers supplying a malicious kernel plugin can return an absolute path to read any file readable by the SiYuan process, including the API token and conf.json.","source":"NVD","date":"2026-10-12T17:17:25.380Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109309","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109309"],"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109309"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109309"}],"epss":null},{"id":"CVE-2026-109308","title":"CVE-2026-109308 — Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 passes the raw 'updates' request parameter in AppC","summary":"Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 passes the raw 'updates' request parameter in AppController::actionCacheUpdates to UpdatesModel without Component::cleanseConfig(), allowing behavior and event-handler injection. Authenticated control panel users with the performUpdates permission or Updates-utility access can supply 'as' or 'on' keys, such as an AttributeTypecastBehavior gadget, to execute arbitrary code.","source":"NVD","date":"2026-10-12T17:17:25.227Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109308","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109308"],"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109308"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109308"}],"epss":null},{"id":"CVE-2026-109307","title":"CVE-2026-109307 — Craft CMS 5.0.0 before 5.10.14 contains a DOM-based cross-site scripting vulnerability in the control pan","summary":"Craft CMS 5.0.0 before 5.10.14 contains a DOM-based cross-site scripting vulnerability in the control panel login and 2FA verification flow, where a user-controlled returnUrl accepting javascript: URLs is used in client-side navigation. Attackers can lure a 2FA-enabled victim into opening a crafted /admin/login?verify=1 URL between password submission and TOTP verification, executing JavaScript in the authenticated control panel with the victim's permissions.","source":"NVD","date":"2026-10-12T17:17:25.077Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109307","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109307"],"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109307"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109307"}],"epss":null},{"id":"CVE-2026-109306","title":"CVE-2026-109306 — Craft CMS from 5.0.0 before 5.10.14 contains a missing authorization vulnerability in AppController::acti","summary":"Craft CMS from 5.0.0 before 5.10.14 contains a missing authorization vulnerability in AppController::actionSwitchToLicensedEdition() that lets any authenticated user change the installed edition. Low-privileged front-end users can call the action route when the licensed edition mismatches to persistently downgrade the site edition in project config, which admins cannot reverse from the control panel.","source":"NVD","date":"2026-10-12T17:17:24.923Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109306","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109306"],"cvss":{"score":6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109306"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109306"}],"epss":null},{"id":"CVE-2026-109305","title":"CVE-2026-109305 — Craft CMS from 5.10.2 before 5.10.14 contains a Twig sandbox bypass that allows non-admin users to invoke","summary":"Craft CMS from 5.10.2 before 5.10.14 contains a Twig sandbox bypass that allows non-admin users to invoke PHP callables through the \"has some\" and \"has every\" operators. Users with the System Messages permission can supply two-argument callables such as passthru or system in sandboxed templates to execute code as the web user.","source":"NVD","date":"2026-10-12T17:17:24.773Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109305","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109305"],"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109305"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109305"}],"epss":null},{"id":"CVE-2026-109304","title":"CVE-2026-109304 — Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 contains an arbitrary file read vulnerability beca","summary":"Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 contains an arbitrary file read vulnerability because the Twig create() class blocklist does not cover DOMDocument. Attackers able to set an entry-type title format, including via project-config/apply, can use create('DOMDocument').loadHTMLFile() with textContent to expose local file contents to non-admin users who can view entries.","source":"NVD","date":"2026-10-12T17:17:24.610Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109304","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109304"],"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109304"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109304"}],"epss":null},{"id":"CVE-2026-109303","title":"CVE-2026-109303 — Parse Server before 8.6.93 and 9.0.0 before 9.10.1-alpha.13 does not enforce identity-scoped protectedFie","summary":"Parse Server before 8.6.93 and 9.0.0 before 9.10.1-alpha.13 does not enforce identity-scoped protectedFields (authenticated, role, or per-user groups) on count queries using the $relatedTo operator, exposing the size of protected Relation fields. An authenticated user who can read the owning object can combine counts with an objectId constraint as a membership oracle to reveal confidential memberships such as private groups or block lists.","source":"NVD","date":"2026-10-12T17:17:24.237Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109303","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109303"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109303"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109303"}],"epss":null},{"id":"CVE-2026-109302","title":"CVE-2026-109302 — Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 applies its GraphQL introspection contr","summary":"Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 applies its GraphQL introspection control only to operation text sent directly with a request, not to operations resolved from Apollo Server's automatic persisted query cache. Unauthenticated attackers holding the public Application Id and client key can replay an introspection query previously cached by a master or maintenance key client to retrieve the schema, including private class and field names.","source":"NVD","date":"2026-10-12T17:17:24.090Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109302","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109302"],"cvss":{"score":6.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109302"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109302"}],"epss":null},{"id":"CVE-2026-109301","title":"CVE-2026-109301 — Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 does not resolve file references lacking a URL","summary":"Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 does not resolve file references lacking a URL before passing objects to Cloud Code triggers and LiveQuery, causing an uncaught exception that terminates the process. Attackers able to write to a class with Cloud Code save, find, or delete triggers or LiveQuery enabled, including unauthenticated users when public write access or sign-up is allowed, can crash the server or break subsequent requests.","source":"NVD","date":"2026-10-12T17:17:23.940Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109301","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109301"],"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109301"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109301"}],"epss":null},{"id":"CVE-2026-109300","title":"CVE-2026-109300 — Open WebUI from 0.6.31 before 0.11.4 contains a stored cross-site scripting vulnerability in its Markdown","summary":"Open WebUI from 0.6.31 before 0.11.4 contains a stored cross-site scripting vulnerability in its Markdown renderer, which treats user-authored tool-call details blocks as tool output and mounts their embeds attribute in script-enabled iframes. Authenticated users can post crafted channel messages, chat messages, or citation content that runs JavaScript in viewers' browsers, enabling in-app phishing, or session hijacking where iframeSandboxAllowSameOrigin is enabled.","source":"NVD","date":"2026-10-12T17:17:23.700Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109300","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109300"],"cvss":{"score":5.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109300"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109300"}],"epss":null},{"id":"CVE-2026-109299","title":"CVE-2026-109299 — Open WebUI from 0.9.0 before 0.11.4 contains a denial of service vulnerability that allows authenticated ","summary":"Open WebUI from 0.9.0 before 0.11.4 contains a denial of service vulnerability that allows authenticated users with automations permission to stall the instance by submitting unsatisfiable recurrence rules. Attackers can repeatedly send rules like February 30th to the automations create or update endpoints, blocking the shared event loop for seconds per request.","source":"NVD","date":"2026-10-12T17:17:23.540Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109299","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109299"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109299"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109299"}],"epss":null},{"id":"CVE-2026-109298","title":"CVE-2026-109298 — Open WebUI 0.11.0 before 0.11.4 compiles user-chosen grep patterns for its knowledge and chat file search","summary":"Open WebUI 0.11.0 before 0.11.4 compiles user-chosen grep patterns for its knowledge and chat file search tools with a regex engine that expands nested counted repetition unbounded at compile time and caches the result. Authenticated users can have the model call grep_knowledge_files with short nested-repetition patterns, blocking the event loop and exhausting worker memory.","source":"NVD","date":"2026-10-12T17:17:23.390Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109298","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109298"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109298"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109298"}],"epss":null},{"id":"CVE-2026-109297","title":"CVE-2026-109297 — Open WebUI 0.11.0 before 0.11.4 contains a denial of service vulnerability in the automation recurrence-r","summary":"Open WebUI 0.11.0 before 0.11.4 contains a denial of service vulnerability in the automation recurrence-rule validator, whose sub-daily frequency guard parses rule text more strictly than the calendar library that executes it. Users permitted to create automations can submit whitespace-folded rules (or, in 0.11.0, lowercase frequencies or omitted RRULE prefixes) that expand per-second synchronously, blocking the shared event loop for minutes per request and on every scheduler poll.","source":"NVD","date":"2026-10-12T17:17:23.240Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109297","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109297"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109297"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109297"}],"epss":null},{"id":"CVE-2026-109296","title":"CVE-2026-109296 — Open WebUI before 0.11.4 contains a missing authorization vulnerability that allows authenticated users t","summary":"Open WebUI before 0.11.4 contains a missing authorization vulnerability that allows authenticated users to reach disabled model provider backends by supplying an explicit backend index. Attackers can pass the index as a path segment or query parameter on Ollama and OpenAI-compatible listing routes to trigger requests carrying configured API keys, read version strings, and enumerate connections.","source":"NVD","date":"2026-10-12T17:17:23.097Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109296","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109296"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109296"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109296"}],"epss":null},{"id":"CVE-2026-109295","title":"CVE-2026-109295 — Open WebUI from 0.11.0 before 0.11.4 contains a regular expression denial of service vulnerability that a","summary":"Open WebUI from 0.11.0 before 0.11.4 contains a regular expression denial of service vulnerability that allows authenticated users to stall server workers via file search patterns. Attackers can instruct the model to call grep_knowledge_files or grep_chat_files with a catastrophically backtracking regex, blocking the event loop for two seconds per repeated call.","source":"NVD","date":"2026-10-12T17:17:22.950Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109295","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109295"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109295"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109295"}],"epss":null},{"id":"CVE-2026-109294","title":"CVE-2026-109294 — Open WebUI from 0.6.42 before 0.11.4 contains an uncontrolled resource consumption vulnerability that all","summary":"Open WebUI from 0.6.42 before 0.11.4 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory by supplying compressed remote image URLs in chat messages. Attackers can point the image field at a host returning gzip-encoded responses, which get_image_base64_from_url decompresses unbounded, causing denial of service for all users.","source":"NVD","date":"2026-10-12T17:17:22.800Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109294","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109294"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109294"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109294"}],"epss":null},{"id":"CVE-2026-109293","title":"CVE-2026-109293 — Open WebUI from 0.11.0 before 0.11.4 contains an information disclosure vulnerability that allows authent","summary":"Open WebUI from 0.11.0 before 0.11.4 contains an information disclosure vulnerability that allows authenticated non-admin users with tool export permission to obtain tool source code shared with them read-only. Attackers can request GET /api/v1/tools/export to retrieve the full Python source of read-only shared tools, exposing embedded API keys and credentials.","source":"NVD","date":"2026-10-12T17:17:22.650Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109293","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109293"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109293"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109293"}],"epss":null},{"id":"CVE-2026-109292","title":"CVE-2026-109292 — Open WebUI from 0.6.27 before 0.11.4 contains an information disclosure vulnerability that allows destina","summary":"Open WebUI from 0.6.27 before 0.11.4 contains an information disclosure vulnerability that allows destination servers to obtain user session cookies by receiving the full browser cookie jar on OAuth-mode connections. Operators of OpenAI-compatible connections, OpenAPI tool servers or terminal servers can capture forwarded session cookies from routine requests and replay them to hijack accounts, including administrators.","source":"NVD","date":"2026-10-12T17:17:22.500Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109292","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109292"],"cvss":{"score":7.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109292"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109292"}],"epss":null},{"id":"CVE-2026-109291","title":"CVE-2026-109291 — Open WebUI from 0.6.33 before 0.11.4 contains a cross-site scripting vulnerability that allows authentica","summary":"Open WebUI from 0.6.33 before 0.11.4 contains a cross-site scripting vulnerability that allows authenticated users to execute script in victims' sessions by storing javascript: URLs in citation embed_url fields. Attackers can share a crafted chat whose citation, when clicked, is passed to window.open, letting them steal localStorage.token and act as the victim.","source":"NVD","date":"2026-10-12T17:17:22.353Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109291","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109291"],"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109291"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109291"}],"epss":null},{"id":"CVE-2026-109290","title":"CVE-2026-109290 — Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vulnerability in DocxPreview.","summary":"Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vulnerability in DocxPreview.svelte that allows authenticated users to execute script by uploading crafted DOCX attachments. Attackers can embed an OOXML altChunk HTML part or script-scheme hyperlink to steal a previewing administrator's session token from local storage and take over the instance.","source":"NVD","date":"2026-10-12T17:17:22.210Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109290","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109290"],"cvss":{"score":8.4,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109290"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109290"}],"epss":null},{"id":"CVE-2026-109289","title":"CVE-2026-109289 — Open WebUI from 0.8.8 before 0.11.4 contains an improper authorization vulnerability that allows deactiva","summary":"Open WebUI from 0.8.8 before 0.11.4 contains an improper authorization vulnerability that allows deactivated users to keep executing terminal commands through an already open terminal WebSocket. Because the terminal proxy route in terminals.py checks access only on the first message, deactivated users can keep running commands and reading or writing files on the terminal server.","source":"NVD","date":"2026-10-12T17:17:22.060Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109289","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109289"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109289"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109289"}],"epss":null},{"id":"CVE-2026-109288","title":"CVE-2026-109288 — Open WebUI before 0.11.4 contains a stored cross-site scripting vulnerability in MarkdownInlineTokens.sve","summary":"Open WebUI before 0.11.4 contains a stored cross-site scripting vulnerability in MarkdownInlineTokens.svelte, which renders markdown link URLs into anchor hrefs without validating their scheme. Authenticated users can embed javascript: links in shared chats that, when clicked by a victim, steal the victim's JWT from local storage, including admins' tokens.","source":"NVD","date":"2026-10-12T17:17:21.913Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109288","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109288"],"cvss":{"score":7.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109288"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109288"}],"epss":null},{"id":"CVE-2026-109287","title":"CVE-2026-109287 — Open WebUI from 0.9.6 before 0.11.4 contains an authorization flaw where the knowledge base file listing ","summary":"Open WebUI from 0.9.6 before 0.11.4 contains an authorization flaw where the knowledge base file listing does not verify that a supplied directory_id belongs to the requested knowledge base. Users with read access to any knowledge base can supply a retained foreign directory UUID to GET /api/v1/knowledge/{id}/files. The returned breadcrumbs expose folder names, owner user ids and knowledge base ids of that directory and all its ancestors.","source":"NVD","date":"2026-10-12T17:17:21.763Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109287","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109287"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109287"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109287"}],"epss":null},{"id":"CVE-2026-109286","title":"CVE-2026-109286 — Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in SyncStatsMo","summary":"Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in SyncStatsModal that allows any website to steal a signed-in user's session token by posting unvalidated verify:chat messages. Attackers can supply a path-traversal chat id redirecting the authenticated stats export request to the auths endpoint, receiving the victim's JWT for full API access.","source":"NVD","date":"2026-10-12T17:17:21.613Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109286","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109286"],"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109286"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109286"}],"epss":null},{"id":"CVE-2026-109285","title":"CVE-2026-109285 — Open WebUI from 0.6.0 before 0.11.4 contains an improper access control vulnerability in has_access_to_fi","summary":"Open WebUI from 0.6.0 before 0.11.4 contains an improper access control vulnerability in has_access_to_file that lets former knowledge base collaborators keep file access via stale cached knowledge base references. Attackers with read or write grants can download removed files through the file content endpoint or delete them, including from the owner's private knowledge bases.","source":"NVD","date":"2026-10-12T17:17:21.463Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109285","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109285"],"cvss":{"score":2.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109285"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109285"}],"epss":null},{"id":"CVE-2026-109284","title":"CVE-2026-109284 — Open WebUI from 0.11.0 before 0.11.4 contains an improper authorization vulnerability in the chat fork ha","summary":"Open WebUI from 0.11.0 before 0.11.4 contains an improper authorization vulnerability in the chat fork handler, which places forked chats in the source chat's folder without checking folder write access. Shared folder members downgraded to read-only can call POST /api/v1/chats/{id}/fork on chats they created there while they had write access, inserting attacker-controlled chats visible to the folder owner and members.","source":"NVD","date":"2026-10-12T17:17:21.317Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109284","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109284"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109284"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109284"}],"epss":null},{"id":"CVE-2026-109283","title":"CVE-2026-109283 — Open WebUI from 0.11.1 before 0.11.4 contains an authorization bypass in the OAuth token exchange endpoin","summary":"Open WebUI from 0.11.1 before 0.11.4 contains an authorization bypass in the OAuth token exchange endpoint, which reads role claims only from the provider's userinfo response and keeps the user's existing role when no roles claim is found, ignoring roles sent only in the ID token. Users with a linked account whose identity provider role no longer satisfies the OAuth role policy can send a valid provider access token to POST /api/v1/auths/oauth/{provider}/token/exchange to obtain a session retaining their previous role.","source":"NVD","date":"2026-10-12T17:17:21.167Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109283","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109283"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109283"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109283"}],"epss":null},{"id":"CVE-2026-109282","title":"CVE-2026-109282 — ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a type confusion flaw in the INFO, JSON and","summary":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a type confusion flaw in the INFO, JSON and YAML encoders, where an internal method receives a pointer of an unexpected type when writing an image in a compressed format. An attacker who can cause such an image write can trigger a SIGABRT or SIGSEGV, crashing the process and causing denial of service.","source":"NVD","date":"2026-10-12T17:17:21.020Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109282","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109282"],"cvss":{"score":2,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109282"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109282"}],"epss":null},{"id":"CVE-2026-109281","title":"CVE-2026-109281 — ImageMagick 7.1.0-21 before 7.1.2-32 contains a heap buffer over-read in its handling of the -fx option, ","summary":"ImageMagick 7.1.0-21 before 7.1.2-32 contains a heap buffer over-read in its handling of the -fx option, where a certain -fx operation reads beyond the bounds of an allocated heap buffer in specific situations. Attackers who can get a crafted -fx expression processed can read out-of-bounds heap memory, potentially disclosing limited memory contents.","source":"NVD","date":"2026-10-12T17:17:20.873Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109281","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109281"],"cvss":{"score":4.8,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109281"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109281"}],"epss":null},{"id":"CVE-2026-109280","title":"CVE-2026-109280 — ImageMagick 7.1.0-20 before 7.1.2-32 contains a use after free vulnerability in the -fx option that occur","summary":"ImageMagick 7.1.0-20 before 7.1.2-32 contains a use after free vulnerability in the -fx option that occurs when a memory allocation fails during a specific operation. Attackers who can supply crafted -fx expressions under memory pressure can trigger freed memory access, causing crashes or memory corruption.","source":"NVD","date":"2026-10-12T17:17:20.730Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109280","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109280"],"cvss":{"score":2,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109280"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109280"}],"epss":null},{"id":"CVE-2026-109279","title":"CVE-2026-109279 — ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 lacks proper synchronization when the security polic","summary":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 lacks proper synchronization when the security policy is accessed, so simultaneous reads and writes of the policy by multiple threads trigger a race condition that causes a heap buffer over-write. An attacker able to induce concurrent security policy access can crash the application, causing a denial of service.","source":"NVD","date":"2026-10-12T17:17:20.577Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109279","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109279"],"cvss":{"score":2,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109279"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109279"}],"epss":null},{"id":"CVE-2026-109278","title":"CVE-2026-109278 — ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the wavelet-denoise operat","summary":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the wavelet-denoise operation, which fails to release allocated memory when a required resource cannot be acquired. Attackers can repeatedly trigger wavelet-denoise processing under resource-constrained conditions to leak memory and degrade service availability.","source":"NVD","date":"2026-10-12T17:17:20.430Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109278","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109278"],"cvss":{"score":6.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109278"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109278"}],"epss":null},{"id":"CVE-2026-109277","title":"CVE-2026-109277 — ImageMagick before 7.1.2-32 contains a policy bypass vulnerability in the -script operation due to missin","summary":"ImageMagick before 7.1.2-32 contains a policy bypass vulnerability in the -script operation due to missing checks on file descriptor handling. Attackers can use the -script operation to close file descriptors not opened by the current operation, circumventing configured security policies.","source":"NVD","date":"2026-10-12T17:17:20.287Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109277","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109277"],"cvss":{"score":4.8,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109277"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109277"}],"epss":null},{"id":"CVE-2026-109276","title":"CVE-2026-109276 — ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an incomplete cleanup flaw in the JNG decod","summary":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an incomplete cleanup flaw in the JNG decoder that fails to remove temporary files when processing crafted input. Attackers can submit crafted JNG files for processing to repeatedly leak temporary files, consuming disk space and degrading availability.","source":"NVD","date":"2026-10-12T17:17:20.133Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109276","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109276"],"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109276"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109276"}],"epss":null},{"id":"CVE-2026-109275","title":"CVE-2026-109275 — ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a code injection vulnerability in the MVG d","summary":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a code injection vulnerability in the MVG decoder when a PostScript renderer is used. Attackers can supply a crafted MVG file that, when decoded, injects code into the PostScript rendering path.","source":"NVD","date":"2026-10-12T17:17:19.983Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109275","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109275"],"cvss":{"score":6.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109275"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109275"}],"epss":null},{"id":"CVE-2026-109274","title":"CVE-2026-109274 — ImageMagick before 7.1.2-32 contains a time-of-check time-of-use symlink race vulnerability that allows a","summary":"ImageMagick before 7.1.2-32 contains a time-of-check time-of-use symlink race vulnerability that allows attackers to bypass the path security policy when executing a magick script. Attackers can swap a checked path with a symlink during script execution to read files that the security policy is meant to block.","source":"NVD","date":"2026-10-12T17:17:19.833Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109274","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109274"],"cvss":{"score":2,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109274"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109274"}],"epss":null},{"id":"CVE-2026-109273","title":"CVE-2026-109273 — ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an information disclosure vulnerability in ","summary":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an information disclosure vulnerability in the PostScript decoder, which allocates a buffer one byte longer than the data it decoded. Attackers can supply a crafted PostScript file to expose a single uninitialized byte of memory contents.","source":"NVD","date":"2026-10-12T17:17:19.683Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109273","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109273"],"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109273"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109273"}],"epss":null},{"id":"CVE-2026-109272","title":"CVE-2026-109272 — ImageMagick 7.1.1-31 before 7.1.2-32 contains a NULL pointer dereference in the PostScript decoder that i","summary":"ImageMagick 7.1.1-31 before 7.1.2-32 contains a NULL pointer dereference in the PostScript decoder that is triggered when a policy limit is reached. Attackers can supply a crafted PostScript file for processing to crash the application, causing a denial of service.","source":"NVD","date":"2026-10-12T17:17:19.537Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109272","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109272"],"cvss":{"score":6.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109272"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109272"}],"epss":null},{"id":"CVE-2026-109271","title":"CVE-2026-109271 — ImageMagick 7.1.2-30 before 7.1.2-32 contains a use after free vulnerability in the WBINFO decoder that o","summary":"ImageMagick 7.1.2-30 before 7.1.2-32 contains a use after free vulnerability in the WBINFO decoder that occurs when a memory allocation fails during image decoding. Attackers can supply a crafted image that, when decoded under memory allocation failure conditions, causes freed memory to be reused, crashing the application.","source":"NVD","date":"2026-10-12T17:17:19.383Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109271","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109271"],"cvss":{"score":6.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109271"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109271"}],"epss":null},{"id":"CVE-2026-109270","title":"CVE-2026-109270 — ImageMagick before 7.1.2-32 contains a memory leak vulnerability in the -process option that allows attac","summary":"ImageMagick before 7.1.2-32 contains a memory leak vulnerability in the -process option that allows attackers to cause unreleased memory allocations by supplying certain arguments. Attackers can repeatedly invoke the -process option with crafted arguments to gradually exhaust memory and degrade service availability.","source":"NVD","date":"2026-10-12T17:17:19.233Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109270","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109270"],"cvss":{"score":4.8,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109270"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109270"}],"epss":null},{"id":"CVE-2026-109269","title":"CVE-2026-109269 — ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an information disclosure vulnerability in ","summary":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an information disclosure vulnerability in the JPEG decoder, which performs a read that exposes uninitialized memory when handling crafted input. Attackers can supply a crafted JPEG file for processing to disclose uninitialized memory contents.","source":"NVD","date":"2026-10-12T17:17:19.073Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109269","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109269"],"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109269"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109269"}],"epss":null},{"id":"CVE-2026-109268","title":"CVE-2026-109268 — ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a use after free vulnerability in the PDF w","summary":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a use after free vulnerability in the PDF writer when writing CMYK images with JPEG2000 compression. Attackers can supply a crafted CMYK image that, when written to PDF with JPEG2000 compression, causes freed memory to be reused, potentially crashing the process.","source":"NVD","date":"2026-10-12T17:17:18.930Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109268","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109268"],"cvss":{"score":6.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109268"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109268"}],"epss":null},{"id":"CVE-2026-109267","title":"CVE-2026-109267 — ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a stack overflow in the MSL decoder caused ","summary":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a stack overflow in the MSL decoder caused by an incorrect depth check that fails to limit recursion. Attackers can supply a set of crafted MSL images that exhaust the stack when one of them is read, crashing the process and causing a denial of service.","source":"NVD","date":"2026-10-12T17:17:18.777Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109267","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109267"],"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109267"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109267"}],"epss":null},{"id":"CVE-2026-109266","title":"CVE-2026-109266 — ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an XML injection vulnerability in the CIP e","summary":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an XML injection vulnerability in the CIP encoder, which does not properly escape input-derived data when writing Cisco IP Phone XML output. Attackers can supply a crafted file that, when converted to CIP format, injects arbitrary markup into the generated XML.","source":"NVD","date":"2026-10-12T17:17:18.630Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109266","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109266"],"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109266"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109266"}],"epss":null},{"id":"CVE-2026-109265","title":"CVE-2026-109265 — ImageMagick 7.1.1-7 before 7.1.2-32 contains a heap buffer over-read vulnerability that allows attackers ","summary":"ImageMagick 7.1.1-7 before 7.1.2-32 contains a heap buffer over-read vulnerability that allows attackers to read beyond allocated memory due to incorrect string termination in XMP profiles. Attackers can supply a crafted image containing a malformed XMP profile to trigger the over-read and crash the application.","source":"NVD","date":"2026-10-12T17:17:18.483Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109265","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109265"],"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109265"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109265"}],"epss":null},{"id":"CVE-2026-109264","title":"CVE-2026-109264 — ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains uncontrolled recursion in the MVG decoder t","summary":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains uncontrolled recursion in the MVG decoder that can exhaust the program stack. An attacker who controls a file name processed by ImageMagick can trigger a stack overflow that crashes the process, causing a denial of service.","source":"NVD","date":"2026-10-12T17:17:18.337Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109264","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109264"],"cvss":{"score":6.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109264"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109264"}],"epss":null},{"id":"CVE-2026-109263","title":"CVE-2026-109263 — ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the YUV encoder, which fai","summary":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the YUV encoder, which fails to release allocated memory when a specific operation fails. Attackers can supply crafted input that triggers the failing encoder operation, leaking memory and potentially exhausting resources to cause a denial of service.","source":"NVD","date":"2026-10-12T17:17:18.183Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109263","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109263"],"cvss":{"score":6.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109263"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109263"}],"epss":null},{"id":"CVE-2026-109262","title":"CVE-2026-109262 — ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the SVG encoder (WriteSVGI","summary":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the SVG encoder (WriteSVGImage) that fails to release allocated memory when handling crafted images. Attackers can supply crafted image files that are processed by the SVG encoder to leak memory and cause a denial of service through resource consumption.","source":"NVD","date":"2026-10-12T17:17:18.033Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109262","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109262"],"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109262"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109262"}],"epss":null},{"id":"CVE-2026-109261","title":"CVE-2026-109261 — ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the GIF encoder because al","summary":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the GIF encoder because allocated memory is not released when color quantization fails during encoding. Attackers can supply images whose GIF conversion causes quantization to fail, leaking memory with each attempt and degrading availability.","source":"NVD","date":"2026-10-12T17:17:17.883Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109261","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109261"],"cvss":{"score":6.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109261"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109261"}],"epss":null},{"id":"CVE-2026-109260","title":"CVE-2026-109260 — ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the PNG encoder, which doe","summary":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the PNG encoder, which does not release allocated memory when libpng initialization fails. Attackers who can repeatedly trigger PNG encoding operations in which libpng initialization fails can exhaust memory and cause a denial of service.","source":"NVD","date":"2026-10-12T17:17:17.730Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109260","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109260"],"cvss":{"score":6.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109260"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109260"}],"epss":null},{"id":"CVE-2026-109259","title":"CVE-2026-109259 — ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an uninitialized memory read in the TGA ima","summary":"ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an uninitialized memory read in the TGA image decoder that can expose memory contents. Attackers can supply a crafted TGA image for processing to disclose contents of uninitialized memory from the ImageMagick process.","source":"NVD","date":"2026-10-12T17:17:17.577Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109259","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109259"],"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109259"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109259"}],"epss":null},{"id":"CVE-2026-109258","title":"CVE-2026-109258 — ImageMagick 7.1.0-20 before 7.1.2-32 contains an invalid memory free vulnerability in the fx operation th","summary":"ImageMagick 7.1.0-20 before 7.1.2-32 contains an invalid memory free vulnerability in the fx operation that occurs when initialization of an FX runtime entry fails. Attackers can trigger the failed FX runtime initialization to cause an invalid free, resulting in memory corruption and application crashes.","source":"NVD","date":"2026-10-12T17:17:17.427Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109258","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109258"],"cvss":{"score":2,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109258"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109258"}],"epss":null},{"id":"CVE-2026-109257","title":"CVE-2026-109257 — FreeRDP before 3.32.0 contains a double-free vulnerability in nsc_context_initialize_encode() that leaves","summary":"FreeRDP before 3.32.0 contains a double-free vulnerability in nsc_context_initialize_encode() that leaves dangling plane pointers after a partial buffer growth failure. Attackers using a crafted RDP client can negotiate NSCodec with a large desktop geometry to trigger allocation failure, crashing the server during context teardown.","source":"NVD","date":"2026-10-12T17:17:17.280Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109257","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109257"],"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109257"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109257"}],"epss":null},{"id":"CVE-2026-109256","title":"CVE-2026-109256 — FreeRDP 3.10.0 through 3.32.2 contains a heap buffer overflow in the WinPR png_write_data callback that w","summary":"FreeRDP 3.10.0 through 3.32.2 contains a heap buffer overflow in the WinPR png_write_data callback that writes past the buffer after a realloc failure. A malicious RDP clipboard peer can supply a large CF_DIB image that triggers out-of-bounds memcpy during PNG conversion, causing a client crash.","source":"NVD","date":"2026-10-12T17:17:17.137Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109256","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109256"],"cvss":{"score":6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109256"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109256"}],"epss":null},{"id":"CVE-2026-109255","title":"CVE-2026-109255 — FreeRDP 3.0.0 before 3.32.0 contains an integer truncation vulnerability in license_check_stream_length t","summary":"FreeRDP 3.0.0 before 3.32.0 contains an integer truncation vulnerability in license_check_stream_length that allows a malicious RDP server to trigger a heap buffer overflow on 32-bit clients. Attackers can send a crafted SERVER_LICENSE_REQUEST with a large scopeCount that bypasses length checks, causing out-of-bounds writes leading to denial of service or remote code execution.","source":"NVD","date":"2026-10-12T17:17:16.987Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109255","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109255"],"cvss":{"score":6.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109255"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109255"}],"epss":null},{"id":"CVE-2026-109254","title":"CVE-2026-109254 — FreeRDP 2.1.0 before 3.32.0 contains a use-after-free vulnerability in the static rdpsnd channel disconne","summary":"FreeRDP 2.1.0 before 3.32.0 contains a use-after-free vulnerability in the static rdpsnd channel disconnect path, which frees audio formats and device without joining play_thread. A malicious RDP server can disconnect while asynchronous Wave2 playback processes queued PDUs, causing the client to read freed heap memory and crash.","source":"NVD","date":"2026-10-12T17:17:16.823Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109254","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109254"],"cvss":{"score":6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109254"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109254"}],"epss":null},{"id":"CVE-2026-109253","title":"CVE-2026-109253 — FreeRDP from 3.9.0 before 3.32.0 contains an out-of-bounds read vulnerability in the RDPEAR NDR scalar re","summary":"FreeRDP from 3.9.0 before 3.32.0 contains an out-of-bounds read vulnerability in the RDPEAR NDR scalar readers, which check value length before consuming alignment padding. Malicious or compromised RDP servers can send crafted unaligned RDPEAR payloads, such as CreateApReqAuthenticatorReq messages, to clients using Remote Credential Guard, causing over-reads and potentially crashing the client process.","source":"NVD","date":"2026-10-12T17:17:16.677Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109253","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109253"],"cvss":{"score":6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109253"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109253"}],"epss":null},{"id":"CVE-2026-109252","title":"CVE-2026-109252 — FreeRDP from 3.9.0 before 3.32.0 contains a NULL pointer dereference vulnerability in the RDPEAR NDR read","summary":"FreeRDP from 3.9.0 before 3.32.0 contains a NULL pointer dereference vulnerability in the RDPEAR NDR reader that allows malicious servers to crash clients via truncated KERB_RPC_INTERNAL_NAME data. Attackers can send a CreateApReqAuthenticatorReq with NameCount of two or more ending before the Names pointer, causing cleanup to dereference a null base and terminate the client.","source":"NVD","date":"2026-10-12T17:17:16.530Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109252","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109252"],"cvss":{"score":6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109252"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109252"}],"epss":null},{"id":"CVE-2026-109251","title":"CVE-2026-109251 — FreeRDP before 3.32.0 stores the server-supplied signed MS-RDPEGT geometry origin unchecked in an unsigne","summary":"FreeRDP before 3.32.0 stores the server-supplied signed MS-RDPEGT geometry origin unchecked in an unsigned video surface coordinate, so the blit clamp in gdiVideoShowSurface() wraps in 32-bit arithmetic and is skipped. A malicious RDP server can send a negative topLevelLeft to clients connecting with /video, causing an out-of-bounds write of decoded H.264 picture data or a client abort.","source":"NVD","date":"2026-10-12T17:17:16.380Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109251","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109251"],"cvss":{"score":6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109251"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109251"}],"epss":null},{"id":"CVE-2026-109250","title":"CVE-2026-109250 — FreeRDP 3.0.0 before 3.32.0 contains a heap buffer overflow vulnerability in collect_keys() that allows l","summary":"FreeRDP 3.0.0 before 3.32.0 contains a heap buffer overflow vulnerability in collect_keys() that allows local attackers to write past the fixed 64-entry keys array during PKCS#11 key enumeration. Attackers controlling smartcard tokens can present more than 64 public key objects across multiple slots to corrupt heap memory with attacker-chosen CKA_ID and CKA_LABEL data during smartcard logon.","source":"NVD","date":"2026-10-12T17:17:16.230Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109250","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109250"],"cvss":{"score":7,"version":"4.0","vector":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109250"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109250"}],"epss":null},{"id":"CVE-2026-109249","title":"CVE-2026-109249 — FreeRDP 3.0.0 before 3.32.0 contains a heap out-of-bounds read in freerdp_assistance_parse_all_elements_o","summary":"FreeRDP 3.0.0 before 3.32.0 contains a heap out-of-bounds read in freerdp_assistance_parse_all_elements_of() because it advances its parsing cursor without reducing the remaining length, letting the scan window exceed the decrypted ConnectionString2 buffer. Attackers can supply a crafted .msrcIncident invitation file and password that crash xfreerdp when opened, before any RDP connection.","source":"NVD","date":"2026-10-12T17:17:16.077Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109249","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109249"],"cvss":{"score":6.8,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109249"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109249"}],"epss":null},{"id":"CVE-2026-109248","title":"CVE-2026-109248 — FreeRDP 3.0.0 before 3.32.0 contains a heap out-of-bounds read in the WinPR clipboard function convert_fi","summary":"FreeRDP 3.0.0 before 3.32.0 contains a heap out-of-bounds read in the WinPR clipboard function convert_filedescriptors_to_file_list(), which scans a server-controlled FILEDESCRIPTORW cFileName with unbounded _wcschr() and count_special_chars() calls without a NUL-termination guarantee. A malicious RDP server can send an odd-length FILEDESCRIPTORW blob in a CB_FORMAT_DATA_RESPONSE, crashing X11, Wayland, and SDL clients when the user pastes server-copied files.","source":"NVD","date":"2026-10-12T17:17:15.930Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109248","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109248"],"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109248"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109248"}],"epss":null},{"id":"CVE-2026-109247","title":"CVE-2026-109247 — FreeRDP before 3.32.0 contains a path traversal vulnerability in convert_filedescriptors_to_file_list() i","summary":"FreeRDP before 3.32.0 contains a path traversal vulnerability in convert_filedescriptors_to_file_list() in winpr/libwinpr/clipboard/synthetic_file.c, which concatenates server-supplied cFileName values from FileGroupDescriptorW clipboard data into the published local file:// URI without rejecting '/' or '..' sequences. A malicious RDP server can supply '../' sequences so the user's next clipboard paste copies an arbitrary local file readable by the client user instead of the expected remote file.","source":"NVD","date":"2026-10-12T17:17:15.777Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109247","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109247"],"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109247"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109247"}],"epss":null},{"id":"CVE-2026-109246","title":"CVE-2026-109246 — FreeRDP before 3.32.0 contains a divide-by-zero vulnerability in the freerdp-shadow-cli shadow server: th","summary":"FreeRDP before 3.32.0 contains a divide-by-zero vulnerability in the freerdp-shadow-cli shadow server: the frame id in a client's Frame Acknowledge PDU is stored without a range check, so the in-flight frame count in shadow_encoder_inflight_frames() can underflow. An authenticated client can acknowledge a frame id one greater than the last frame sent, causing shadow_encoder_create_frame_id() to divide by zero (SIGFPE) and terminate the process, disconnecting all viewers.","source":"NVD","date":"2026-10-12T17:17:15.630Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109246","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109246"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109246"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109246"}],"epss":null},{"id":"CVE-2026-109245","title":"CVE-2026-109245 — FreeRDP 3.0.0 before 3.32.0 contains an improper certificate validation vulnerability in freerdp_http_req","summary":"FreeRDP 3.0.0 before 3.32.0 contains an improper certificate validation vulnerability in freerdp_http_request() in libfreerdp/utils/http.c that completes TLS handshakes without verifying the server certificate chain. On-path attackers can impersonate login.microsoftonline.com in the Azure AD authentication flow to capture OAuth authorization codes and substitute the OpenID discovery document.","source":"NVD","date":"2026-10-12T17:17:15.480Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109245","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109245"],"cvss":{"score":7.4,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109245"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109245"}],"epss":null},{"id":"CVE-2026-109244","title":"CVE-2026-109244 — FreeRDP from 2.0.0 before 3.32.0 contains an insecure permission vulnerability in winpr-makecert that cre","summary":"FreeRDP from 2.0.0 before 3.32.0 contains an insecure permission vulnerability in winpr-makecert that creates unencrypted private keys without owner-only file modes. Local users on multi-user Unix hosts can read world-readable key files or open PFX files protected by the hard-coded default password to steal private keys.","source":"NVD","date":"2026-10-12T17:17:15.333Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109244","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109244"],"cvss":{"score":6.8,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109244"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109244"}],"epss":null},{"id":"CVE-2026-109243","title":"CVE-2026-109243 — FreeRDP from 3.0.0 before 3.32.0 contains an incorrect permission assignment vulnerability that allows lo","summary":"FreeRDP from 3.0.0 before 3.32.0 contains an incorrect permission assignment vulnerability that allows local users to read private keys written by crypto_write_pem without owner-only permissions. Attackers on multi-user Unix hosts can enumerate the shared temporary directory during soft-smartcard logon to read the world-readable PKINIT private-key copy.","source":"NVD","date":"2026-10-12T17:17:15.180Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109243","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109243"],"cvss":{"score":4.1,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109243"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109243"}],"epss":null},{"id":"CVE-2026-109242","title":"CVE-2026-109242 — FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 renders uninitialized heap memory from un-decoded progressiv","summary":"FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 renders uninitialized heap memory from un-decoded progressive tiles because the tile->current buffer is allocated without zeroing. A malicious RDP server can send a crafted WBT_TILE_FIRST then WBT_TILE_UPGRADE sequence to paint heap bytes onscreen or abort the client process.","source":"NVD","date":"2026-10-12T17:17:15.023Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109242","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109242"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109242"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109242"}],"epss":null},{"id":"CVE-2026-109241","title":"CVE-2026-109241 — FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the client video redirection c","summary":"FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the client video redirection channel that allows malicious servers to crash clients by sending out-of-order messages. Attackers can send a Geometry CLEAR message that nulls presentation->geometry, then send VideoData that dereferences it, causing client denial of service.","source":"NVD","date":"2026-10-12T17:17:14.873Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109241","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109241"],"cvss":{"score":2.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109241"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109241"}],"epss":null},{"id":"CVE-2026-109240","title":"CVE-2026-109240 — FreeRDP 3.11.0 before 3.32.1 contains a reachable assertion vulnerability in urb_isoch_transfer that allo","summary":"FreeRDP 3.11.0 before 3.32.1 contains a reachable assertion vulnerability in urb_isoch_transfer that allows malicious RDP servers to crash clients by sending unvalidated OutputBufferSize values. Attackers can send a TS_URB_ISOCH_TRANSFER IN-direction request with OutputBufferSize above INT32_MAX over URBDRC, triggering an assertion in libusb_udev_isoch_transfer that terminates the client.","source":"NVD","date":"2026-10-12T17:17:14.720Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109240","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109240"],"cvss":{"score":2.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109240"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109240"}],"epss":null},{"id":"CVE-2026-109239","title":"CVE-2026-109239 — Crawl4AI before 0.9.4 contains a blind server-side request forgery vulnerability in RobotsParser.can_fetc","summary":"Crawl4AI before 0.9.4 contains a blind server-side request forgery vulnerability in RobotsParser.can_fetch that lets unauthenticated attackers bypass Docker server egress controls. Attackers can enable check_robots_txt and use redirects or DNS rebinding to reach internal, loopback, or cloud-metadata addresses for service discovery.","source":"NVD","date":"2026-10-12T17:17:14.570Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109239","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109239"],"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109239"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109239"}],"epss":null},{"id":"CVE-2026-109238","title":"CVE-2026-109238 — Crawl4AI 0.7.0 before 0.9.4 contains a server-side request forgery vulnerability that allows API clients ","summary":"Crawl4AI 0.7.0 before 0.9.4 contains a server-side request forgery vulnerability that allows API clients to reach internal addresses by enabling link_preview_config on /crawl requests. Attackers can supply a controlled page with include_external and include_patterns set, causing AsyncUrlSeeder to fetch internal, private, and cloud-metadata links and return their parsed head data.","source":"NVD","date":"2026-10-12T17:17:14.420Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109238","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109238"],"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109238"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109238"}],"epss":null},{"id":"CVE-2026-109237","title":"CVE-2026-109237 — Crawl4AI from 0.9.0 before 0.9.4 contains an untrusted-config gate bypass that allows non-admin API clien","summary":"Crawl4AI from 0.9.0 before 0.9.4 contains an untrusted-config gate bypass that allows non-admin API clients to construct forbidden config objects by wrapping them in dict-type wrappers. Attackers can send a laundered LLMConfig with api_token set to an env reference via /config/dump to read SECRET_KEY and provider keys, enabling admin JWT forgery.","source":"NVD","date":"2026-10-12T17:17:14.233Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109237","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109237"],"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109237"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109237"}],"epss":null},{"id":"CVE-2026-108914","title":"CVE-2026-108914 — A flaw has been found in Edimax BR-6208AC 1.32. Affected by this issue is some unknown functionality of t","summary":"A flaw has been found in Edimax BR-6208AC 1.32. Affected by this issue is some unknown functionality of the file /goform/formWlSiteSurvey. This manipulation of the argument ifname causes buffer overflow. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.","source":"NVD","date":"2026-10-12T17:17:13.890Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108914","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108914"],"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108914"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108914"}],"epss":null},{"id":"CVE-2026-108909","title":"CVE-2026-108909 — A security flaw has been discovered in Netcore NR268 1.7.121109. Affected by this issue is some unknown f","summary":"A security flaw has been discovered in Netcore NR268 1.7.121109. Affected by this issue is some unknown functionality of the component CGI Endpoint. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-12T17:17:13.717Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108909","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108909"],"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108909"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108909"}],"epss":null},{"id":"CVE-2026-108908","title":"CVE-2026-108908 — A vulnerability was identified in Netcore NR268 1.7.121109. Affected by this vulnerability is the functio","summary":"A vulnerability was identified in Netcore NR268 1.7.121109. Affected by this vulnerability is the function eval of the file /router/l7_call_board_user_set.cgi of the component Web UI. Such manipulation of the argument title/note/URL/content leads to cross site scripting. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-12T17:17:13.543Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108908","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108908"],"cvss":{"score":1.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108908"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108908"}],"epss":null},{"id":"CVE-2026-108907","title":"CVE-2026-108907 — A vulnerability was determined in Netcore NR268 1.7.121109. Affected is the function user_ok of the compo","summary":"A vulnerability was determined in Netcore NR268 1.7.121109. Affected is the function user_ok of the component CGI Execution. This manipulation causes improper authentication. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-12T17:17:13.373Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108907","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108907"],"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108907"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108907"}],"epss":null},{"id":"CVE-2026-108478","title":"CVE-2026-108478 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdT","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 8.8.8.","source":"NVD","date":"2026-10-12T17:17:13.237Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108478","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108478"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108478"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108478"}],"epss":null},{"id":"CVE-2026-108477","title":"CVE-2026-108477 — Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configur","summary":"Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.28.","source":"NVD","date":"2026-10-12T17:17:13.107Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108477","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108477"],"cvss":{"score":5.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108477"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108477"}],"epss":null},{"id":"CVE-2026-108476","title":"CVE-2026-108476 — Missing Authorization vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allo","summary":"Missing Authorization vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.13.","source":"NVD","date":"2026-10-12T17:17:12.973Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108476","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108476"],"cvss":{"score":5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108476"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108476"}],"epss":null},{"id":"CVE-2026-108475","title":"CVE-2026-108475 — Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-","summary":"Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broadcast Live Video: from n/a through 7.3.6.","source":"NVD","date":"2026-10-12T17:17:12.833Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108475","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108475"],"cvss":{"score":4.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108475"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108475"}],"epss":null},{"id":"CVE-2026-105274","title":"CVE-2026-105274 — Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex_core allows a","summary":"Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex_core allows an untrusted repository mirror, or a server answering hex_core's API requests, to exhaust the memory of the Erlang VM running hex_core. The same code is vendored in Hex (mix_hex_repo, mix_hex_api) and rebar3 (r3_hex_repo, r3_hex_api).\n\nhex_repo:get_names/1, hex_repo:get_versions/1, hex_repo:get_package/2 and hex_repo:get_policy/2 decompress the registry response with zlib:gunzip/1 and decode the signed envelope before verifying its signature. A mirror doesn't have the repository's private key, but it chooses the compressed bytes, so a small response decompresses into an envelope of any size before the signature check rejects it.\n\nhex_api decodes responses with the application/vnd.hex+erlang content type through hex_safe_binary_to_term:s","source":"NVD","date":"2026-10-12T17:17:12.457Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105274","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-105274"],"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},"read":false,"kev":false,"recordIds":["CVE-2026-105274"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105274"}],"epss":null},{"id":"CVE-2026-9191","title":"CVE-2026-9191 — Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently","summary":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently isolate user-supplied code executed through certain REST and XDBC evaluation paths from HTTP request, response, and session state. An attacker able to execute code through an affected path could perform unauthorized actions or compromise an authenticated session.","source":"NVD","date":"2026-10-12T16:17:08.223Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9191","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-9191"],"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","source":"security@progress.com"},"read":false,"kev":false,"recordIds":["CVE-2026-9191"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9191"}],"epss":null},{"id":"CVE-2026-96618","title":"CVE-2026-96618 — Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex allows an unt","summary":"Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex allows an untrusted package mirror to exhaust the memory or disk space of the machine running mix deps.get, mix deps.update, mix hex.package fetch or mix hex.docs fetch.\n\nHex treats a mirror configured with HEX_MIRROR_URL, HEX_MIRROR or mirror_url as untrusted: it doesn't send credentials to it, and it checks registry signatures and package checksums that the mirror can't forge. Several response paths consume memory or disk in proportion to what the mirror sends before any of those checks run.\n\nHex.HTTP.request/5 reads the whole response body into memory and decompresses it with :zlib.gunzip/1 whenever the response's Content-Encoding contains gzip, with no limit on the compressed or decompressed size. Hex doesn't ask for compressed responses, so th","source":"NVD","date":"2026-10-12T16:17:07.920Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96618","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-96618"],"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},"read":false,"kev":false,"recordIds":["CVE-2026-96618"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96618"}],"epss":null},{"id":"CVE-2026-96612","title":"CVE-2026-96612 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hex","summary":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hex allows a malicious package publisher to delete a directory outside the project's deps directory and extract package files into it when a developer fetches dependencies.\n\nA package release's requirements carry an app label that names the dependency's OTP application. Hex takes this label from the repository's signed registry and uses it as the dependency's application name without validating it (Hex.RemoteConverger.deps/2, Hex.Mix.to_lock/1). Mix derives the dependency's checkout directory as deps/<app>, and Hex.SCM.update/1 runs File.rm_rf!/1 on that directory and unpacks the package into it. hex.pm only checks the label's length, so a publisher can set it to a value such as ../../target. When a project depends on such a release direc","source":"NVD","date":"2026-10-12T16:17:07.637Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96612","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-96612"],"cvss":{"score":7.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},"read":false,"kev":false,"recordIds":["CVE-2026-96612"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96612"}],"epss":null},{"id":"CVE-2026-92682","title":"CVE-2026-92682 — In @neo4j/graphql versions from 7.0.0 up to but not including 7.6.4, the none quantifier in @authorizatio","summary":"In @neo4j/graphql versions from 7.0.0 up to but not including 7.6.4, the none quantifier in @authorization filters on relationships and connections is not negated when translated to Cypher, so it behaves like some. A rule such as \"none of the related denied users matches the JWT subject\" therefore returns exactly the records it was meant to exclude, and excludes those it was meant to return. An authenticated user whom such a rule is meant to deny can read the protected records. This is also the case for mutations, so the impact is that sensitive data could also be created and deleted by users that shouldn't have access according to the typedefs. Fixed in 7.6.4.","source":"NVD","date":"2026-10-12T16:17:07.480Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92682","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-92682"],"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6"},"read":false,"kev":false,"recordIds":["CVE-2026-92682"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92682"}],"epss":null},{"id":"CVE-2026-92681","title":"CVE-2026-92681 — In @neo4j/graphql versions up to and including 7.6.3, @authentication directives applied at the schema le","summary":"In @neo4j/graphql versions up to and including 7.6.3, @authentication directives applied at the schema level or on the Query or Mutation types are silently ignored for top-level fields annotated with @cypher. Only @authentication directives placed directly on the individual fields are enforced. An application that exposes a top-level @cypher field and relies on schema-level or type-level @authentication to protect it allows unauthenticated callers to invoke the field and run the configured Cypher statement with the privileges of the GraphQL service account, which may permit reading and modifying data. Fixed in 7.6.4.","source":"NVD","date":"2026-10-12T16:17:07.323Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92681","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-92681"],"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6"},"read":false,"kev":false,"recordIds":["CVE-2026-92681"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92681"}],"epss":null},{"id":"CVE-2026-85956","title":"CVE-2026-85956 — Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote atta","summary":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with delegated database-administrator privileges to perform backup or restore operations on forests outside the authorized database scope, which could result in unauthorized access to or modification of security-critical data.","source":"NVD","date":"2026-10-12T16:17:07.193Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85956","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-85956"],"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","source":"security@progress.com"},"read":false,"kev":false,"recordIds":["CVE-2026-85956"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85956"}],"epss":null},{"id":"CVE-2026-85955","title":"CVE-2026-85955 — Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote atta","summary":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with query-execution access to invoke an XQuery evaluation function without the additional required evaluation privilege, which could result in server-side code execution with elevated permissions.","source":"NVD","date":"2026-10-12T16:17:07.070Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85955","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-85955"],"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","source":"security@progress.com"},"read":false,"kev":false,"recordIds":["CVE-2026-85955"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85955"}],"epss":null},{"id":"CVE-2026-85954","title":"CVE-2026-85954 — Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 can evaluate user-c","summary":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 can evaluate user-controlled values supplied to certain higher-order XQuery functions in an elevated security context, which could result in privilege escalation beyond the attacker's granted permissions.","source":"NVD","date":"2026-10-12T16:17:06.940Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85954","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-85954"],"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","source":"security@progress.com"},"read":false,"kev":false,"recordIds":["CVE-2026-85954"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85954"}],"epss":null},{"id":"CVE-2026-85953","title":"CVE-2026-85953 — Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain privileged ","summary":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain privileged legacy InfoStudio modules that do not sufficiently validate user-controlled file paths and user-context values. Exploitation could result in unauthorized access to server files or execution under an unintended identity.","source":"NVD","date":"2026-10-12T16:17:06.810Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85953","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-85953"],"cvss":{"score":8.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","source":"security@progress.com"},"read":false,"kev":false,"recordIds":["CVE-2026-85953"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85953"}],"epss":null},{"id":"CVE-2026-85952","title":"CVE-2026-85952 — Affected Linux-based Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.","summary":"Affected Linux-based Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain a server-side request forgery vulnerability that could allow an authenticated attacker to access internal cloud services, potentially resulting in unauthorized access to cloud credentials.","source":"NVD","date":"2026-10-12T16:17:06.680Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85952","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-85952"],"cvss":{"score":8.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","source":"security@progress.com"},"read":false,"kev":false,"recordIds":["CVE-2026-85952"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85952"}],"epss":null},{"id":"CVE-2026-85951","title":"CVE-2026-85951 — Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 on Azure contain a ","summary":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 on Azure contain a server-side request forgery vulnerability that could allow an authenticated attacker to access internal cloud services, potentially resulting in unauthorized access to cloud credentials or tokens.","source":"NVD","date":"2026-10-12T16:17:06.553Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85951","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-85951"],"cvss":{"score":8.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","source":"security@progress.com"},"read":false,"kev":false,"recordIds":["CVE-2026-85951"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85951"}],"epss":null},{"id":"CVE-2026-85950","title":"CVE-2026-85950 — Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authoriz","summary":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw that could allow a remote attacker with administrative privileges to access authentication material associated with higher-privileged users, potentially resulting in unauthorized administrative access.","source":"NVD","date":"2026-10-12T16:17:06.427Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85950","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-85950"],"cvss":{"score":8.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","source":"security@progress.com"},"read":false,"kev":false,"recordIds":["CVE-2026-85950"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85950"}],"epss":null},{"id":"CVE-2026-85949","title":"CVE-2026-85949 — Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may record security","summary":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may record security-sensitive information in diagnostic logs under certain configurations. An attacker with access to the affected logs could use this information to obtain unauthorized access to protected resources.","source":"NVD","date":"2026-10-12T16:17:06.303Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85949","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-85949"],"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","source":"security@progress.com"},"read":false,"kev":false,"recordIds":["CVE-2026-85949"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85949"}],"epss":null},{"id":"CVE-2026-85948","title":"CVE-2026-85948 — Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an XQuery i","summary":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an XQuery injection flaw in a deprecated Management API package path. A remote attacker with manage-user-level privileges could exploit this flaw to obtain persistent unauthorized administrative control.","source":"NVD","date":"2026-10-12T16:17:06.173Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85948","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-85948"],"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","source":"security@progress.com"},"read":false,"kev":false,"recordIds":["CVE-2026-85948"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85948"}],"epss":null},{"id":"CVE-2026-85947","title":"CVE-2026-85947 — Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authoriz","summary":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw in certain forest-management operations. A remote attacker with forest-management privileges could exploit this flaw to create a persistent unauthorized administrator account, potentially resulting in complete unauthorized administrative control of the server.","source":"NVD","date":"2026-10-12T16:17:06.040Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85947","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-85947"],"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","source":"security@progress.com"},"read":false,"kev":false,"recordIds":["CVE-2026-85947"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85947"}],"epss":null},{"id":"CVE-2026-81856","title":"CVE-2026-81856 — Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in hexpm hex allows a malicio","summary":"Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in hexpm hex allows a malicious package publisher or a hostile repository server to inject terminal control sequences into the output of Mix tasks.\n\nHex prints strings supplied by the package repository and the documentation search service straight to the terminal through Hex.Shell.info/1 and Hex.Shell.error/1, neutralizing no control characters. Affected sinks span package metadata and configuration snippets in mix hex.info, search results in mix hex.package search and mix hex.search, owner and organization listings, publish and sponsor URLs, the authenticated username in mix hex.user, policy identities in mix hex.policy, and API error bodies rendered by Hex.Utils.print_error_result/1. A malicious package can embed ANSI escape sequences (cursor movement, line era","source":"NVD","date":"2026-10-12T16:17:05.827Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81856","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-81856"],"cvss":{"score":2.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},"read":false,"kev":false,"recordIds":["CVE-2026-81856"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81856"}],"epss":null},{"id":"CVE-2026-109399","title":"CVE-2026-109399 — SWUpdate through 2026.05.1 contains an improper certificate validation vulnerability in crypto/swupdate_c","summary":"SWUpdate through 2026.05.1 contains an improper certificate validation vulnerability in crypto/swupdate_cms_verify_openssl.c that trusts untrusted X.509 certificates embedded in CMS SignedData for chain building. Attackers holding a signing key from a sibling intermediate under the same root can embed that intermediate in the signature to install malicious updates.","source":"NVD","date":"2026-10-12T16:17:05.557Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109399","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109399"],"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109399"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109399"}],"epss":null},{"id":"CVE-2026-109398","title":"CVE-2026-109398 — Gumlet php-image-resize before 3.0.1 contains a denial of service vulnerability because the ImageResize c","summary":"Gumlet php-image-resize before 3.0.1 contains a denial of service vulnerability because the ImageResize constructor in lib/ImageResize.php passes images to GD imagecreatefrom* functions without pixel limits. Remote attackers can upload small, highly compressed images that decode to large bitmaps, exhausting PHP memory and terminating the worker process.","source":"NVD","date":"2026-10-12T16:17:05.397Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109398","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109398"],"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109398"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109398"}],"epss":null},{"id":"CVE-2026-109397","title":"CVE-2026-109397 — Thelia before 3.1.2 and 3.2.x before 3.2.1 contains an unrestricted file upload vulnerability that allows","summary":"Thelia before 3.1.2 and 3.2.x before 3.2.1 contains an unrestricted file upload vulnerability that allows authenticated back-office users to upload PHP files by appending a trailing space to filenames. FileProcessorService validates the raw filename but FileManager::sanitizeFileName() strips the space, storing an executable .php file under public/cache/documents/ for code execution as the web server user.","source":"NVD","date":"2026-10-12T16:17:05.233Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109397","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109397"],"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109397"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109397"}],"epss":null},{"id":"CVE-2026-109396","title":"CVE-2026-109396 — Thelia before 3.1.2 and 3.2.x before 3.2.1 contains a CSV formula injection vulnerability that allows una","summary":"Thelia before 3.1.2 and 3.2.x before 3.2.1 contains a CSV formula injection vulnerability that allows unauthenticated visitors to inject spreadsheet formulas by supplying crafted registration, checkout or newsletter fields. Attackers can submit names, addresses or phone values starting with =, +, - or @ that CSVSerializer exports verbatim, executing formulas in the administrator's spreadsheet application.","source":"NVD","date":"2026-10-12T16:17:05.077Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109396","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109396"],"cvss":{"score":2.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109396"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109396"}],"epss":null},{"id":"CVE-2026-109394","title":"CVE-2026-109394 — Thirty bees through 1.7.0 contains an authentication bypass vulnerability in PasswordController::resolveC","summary":"Thirty bees through 1.7.0 contains an authentication bypass vulnerability in PasswordController::resolveCustomer() that allows unauthenticated attackers to reset registered customers' passwords using guest account tokens. Attackers can place a guest order with the victim's email, then use the guest secure key to reset and take over the victim's account when guest checkout is enabled.","source":"NVD","date":"2026-10-12T16:17:04.920Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109394","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109394"],"cvss":{"score":9.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109394"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109394"}],"epss":null},{"id":"CVE-2026-109393","title":"CVE-2026-109393 — QloApps through 1.7.0 contains an insecure direct object reference vulnerability in back-office AJAX hand","summary":"QloApps through 1.7.0 contains an insecure direct object reference vulnerability in back-office AJAX handlers of AdminOrdersController, AdminBookingDocumentController, AdminProductsController and AdminAddHotelController that skip htl_access hotel checks. Hotel-restricted employees can supply other hotels' sequential identifiers to read, upload and delete booking documents and delete rooms, room images and hotel images.","source":"NVD","date":"2026-10-12T16:17:04.743Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109393","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109393"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109393"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109393"}],"epss":null},{"id":"CVE-2026-109392","title":"CVE-2026-109392 — Pimcore through 2026.3.1 contains a stored cross-site scripting vulnerability that allows authenticated b","summary":"Pimcore through 2026.3.1 contains a stored cross-site scripting vulnerability that allows authenticated backend users to inject scripts by storing unescaped URLs in ExternalImage fields. Attackers with data object edit permission can store attribute-breaking payloads that execute JavaScript in the admin origin when other users open version preview or diff views.","source":"NVD","date":"2026-10-12T16:17:04.557Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109392","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109392"],"cvss":{"score":5.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109392"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109392"}],"epss":null},{"id":"CVE-2026-109391","title":"CVE-2026-109391 — Square Squash through commit e73f280 contains an insecure deserialization vulnerability that allows unaut","summary":"Square Squash through commit e73f280 contains an insecure deserialization vulnerability that allows unauthenticated attackers to store crafted YAML via the POST /api/1.0/symbolication endpoint. When occurrences referencing the attacker-controlled symbolication UUID are symbolicated, the stored values are passed to YAML.load with SafeYAML in unsafe mode, enabling arbitrary Ruby object deserialization and potential code execution.","source":"NVD","date":"2026-10-12T16:17:04.373Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109391","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109391"],"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109391"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109391"}],"epss":null},{"id":"CVE-2026-109195","title":"CVE-2026-109195 — A flaw was found in Quay. An authenticated attacker can access repository auto-prune configurations from ","summary":"A flaw was found in Quay. An authenticated attacker can access repository auto-prune configurations from other namespaces, leading to unauthorized information disclosure. This issue occurs because the application does not properly enforce namespace scoping when retrieving policy details by repository name and policy identifier. To exploit the vulnerability, the attacker must manage a repository sharing the target's name and know the target policy's unique identifier.","source":"NVD","date":"2026-10-12T16:17:04.233Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109195","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109195"],"cvss":{"score":3.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","source":"secalert@redhat.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109195"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109195"}],"epss":null},{"id":"CVE-2026-109194","title":"CVE-2026-109194 — A flaw was found in Red Hat Quay. The build trigger management application programming interface (API) fa","summary":"A flaw was found in Red Hat Quay. The build trigger management application programming interface (API) fails to verify whether a requested trigger belongs to the specified repository. An authenticated user with administrative access to any repository can view, modify, or permanently delete build triggers and associated write tokens of another repository if they know the victim trigger's universally unique identifier (UUID).","source":"NVD","date":"2026-10-12T16:17:04.090Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109194","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109194"],"cvss":{"score":6.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L","source":"secalert@redhat.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109194"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109194"}],"epss":null},{"id":"CVE-2026-108906","title":"CVE-2026-108906 — A vulnerability has been found in Netcore NR268 1.7.121109. This affects the function filter_arp_put_file","summary":"A vulnerability has been found in Netcore NR268 1.7.121109. This affects the function filter_arp_put_file_cgi of the file /router/filter_arp_put_file.cgi. The manipulation of the argument put_file leads to out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-12T16:17:03.917Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108906","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108906"],"cvss":{"score":7.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108906"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108906"}],"epss":null},{"id":"CVE-2026-108901","title":"CVE-2026-108901 — A vulnerability was found in Shenzhen HCC Technology MPOS M6 PLUS 1.31-N. Affected by this vulnerability ","summary":"A vulnerability was found in Shenzhen HCC Technology MPOS M6 PLUS 1.31-N. Affected by this vulnerability is an unknown functionality of the component Display QR Code Rendering. Performing a manipulation of the argument alignment results in improper restriction of rendered ui layers. The attack can only be performed from the local network. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-12T16:17:03.713Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108901","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108901"],"cvss":{"score":2,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108901"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108901"}],"epss":null},{"id":"CVE-2026-108900","title":"CVE-2026-108900 — A vulnerability has been found in Exponent CMS up to 3.0.2patch2. Affected is the function userLogin of t","summary":"A vulnerability has been found in Exponent CMS up to 3.0.2patch2. Affected is the function userLogin of the file xmlrpc.php of the component XML-RPC. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-12T16:17:03.533Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108900","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108900"],"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108900"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108900"}],"epss":null},{"id":"CVE-2026-108899","title":"CVE-2026-108899 — A flaw has been found in tobychui zoraxy up to 3.3.4. This impacts the function handleBasicAuth of the fi","summary":"A flaw has been found in tobychui zoraxy up to 3.3.4. This impacts the function handleBasicAuth of the file mod/dynamicproxy/authProviders.go of the component Path Exception Matcher. This manipulation of the argument PathPrefix causes improper authorization. It is possible to initiate the attack remotely. The exploit has been published and may be used. Upgrading to version 3.3.5-rc1 will fix this issue. Patch name: 37cd0f27b17cd15cfa4af409bfec943146f5fdfe. Upgrading the affected component is advised.","source":"NVD","date":"2026-10-12T16:17:03.320Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108899","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108899"],"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108899"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108899"}],"epss":null},{"id":"CVE-2026-107248","title":"CVE-2026-107248 — Thelia 3.0.0's back-office Email/Messages feature contains a server‑side template injection (SSTI) flaw t","summary":"Thelia 3.0.0's back-office Email/Messages feature contains a server‑side template injection (SSTI) flaw that allows any authenticated user with the “Messages” permission to supply unsandboxed Twig templates, which are then compiled and executed as raw code. By modifying Message content, an attacker can execute arbitrary PHP functions, read sensitive files, and potentially write to the filesystem, leading to full compromise of the application and underlying host. This vulnerability has been patched in thelia/twig-engine-module 1.0.9.","source":"NVD","date":"2026-10-12T16:17:03.203Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107248","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107248"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-107248"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107248"}],"epss":null},{"id":"CVE-2026-105668","title":"CVE-2026-105668 — Protection Mechanism Failure vulnerability in hexpm hex allows the owner of a package, or an attacker who","summary":"Protection Mechanism Failure vulnerability in hexpm hex allows the owner of a package, or an attacker who has taken over the owner's account, to get a newly published release past the release-age cooldown.\n\nThe cooldown (cooldown config, HEX_COOLDOWN) withholds versions younger than the configured age during dependency resolution. When the release of a package locked in mix.lock is retired or has a security advisory, Hex.RemoteConverger.build_cooldown_bypass/3 and Hex.RemoteConverger.unsafe_lock_bypass/1 lift the cooldown for every version of that package and of every package the locked release depends on, so that mix deps.update can move off the unsafe release. Retiring a release needs the same package owner permission as publishing one. An attacker who publishes a malicious release can retire the currently locked release, and the next m","source":"NVD","date":"2026-10-12T16:17:02.943Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105668","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-105668"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},"read":false,"kev":false,"recordIds":["CVE-2026-105668"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105668"}],"epss":null},{"id":"CVE-2026-105280","title":"CVE-2026-105280 — Improper Validation of Integrity Check Value vulnerability in hexpm hex allows a package mirror to substi","summary":"Improper Validation of Integrity Check Value vulnerability in hexpm hex allows a package mirror to substitute the tarball that mix hex.package fetch PACKAGE VERSION --output - writes to standard output.\n\nHex compares a fetched tarball's inner and outer checksums with the repository's signed registry before writing it to a file or unpacking it. The standard output branch of mix hex.package fetch writes the bytes returned by Hex.SCM.fetch/3 without that comparison, and Hex.SCM.fetch/3 doesn't verify freshly downloaded tarballs itself. When a mirror configured with HEX_MIRROR_URL or mirror_url serves altered bytes, the command prints them and exits successfully, while the same fetch with --output FILE fails with a checksum mismatch.\n\nHex also prints diagnostics to standard output while the command runs: the body of a failed HTTP response fro","source":"NVD","date":"2026-10-12T16:17:02.680Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105280","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-105280"],"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},"read":false,"kev":false,"recordIds":["CVE-2026-105280"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105280"}],"epss":null},{"id":"CVE-2026-103503","title":"CVE-2026-103503 — Improper Certificate Validation vulnerability in hexpm hex allows an attacker who can intercept HTTPS con","summary":"Improper Certificate Validation vulnerability in hexpm hex allows an attacker who can intercept HTTPS connections, and holds a certificate for a Hex host issued by a CA in Hex's bundled CA store, to impersonate that host to users who set cacerts_path to a CA store that leaves that CA out.\n\ncacerts_path (HEX_CACERTS_PATH) is documented as the path to the CA certificate store, used instead of the CA bundle that ships with Hex. Hex.HTTP.SSL.ssl_opts/1 passes the configured store as the cacerts option, but builds the partial_chain callback from the bundled store whether cacerts_path is set or not. Hex.HTTP.SSL.partial_chain/2 accepts a server chain when any certificate in it has the same public key as a bundled CA certificate, so a chain that leads to a bundled CA passes verification although the configured store doesn't contain that CA. Host","source":"NVD","date":"2026-10-12T16:17:02.427Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103503","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-103503"],"cvss":{"score":5.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},"read":false,"kev":false,"recordIds":["CVE-2026-103503"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103503"}],"epss":null},{"id":"CVE-2026-103060","title":"CVE-2026-103060 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in erlang re","summary":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in erlang rebar3 allows a malicious package publisher to delete a directory outside the project's _build directory and extract package files into it when a developer fetches dependencies.\n\nA package release's dependencies in a Hex registry carry an app field that names the dependency's OTP application. rebar3 uses this field as the dependency's name without validating it (rebar_packages:parse_deps/1) and builds the dependency's directory from that name (rebar_app_utils:dep_to_app/7). rebar_fetch:download_source_online/2 deletes that directory with rm -rf and moves the fetched package into it. hex.pm didn't restrict the field to a directory name before 2026-10-12, so a publisher could set it to a value such as ../../../../target. When a project dep","source":"NVD","date":"2026-10-12T16:17:00.873Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103060","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-103060"],"cvss":{"score":7.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},"read":false,"kev":false,"recordIds":["CVE-2026-103060"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103060"}],"epss":null},{"id":"CVE-2026-92877","title":"CVE-2026-92877 — The JAXB factory methods historically relied solely on `FEATURE_SECURE_PROCESSING` to prevent XML Externa","summary":"The JAXB factory methods historically relied solely on `FEATURE_SECURE_PROCESSING` to prevent XML External Entity (XXE) resolution. On JAXP implementations where that feature alone does not block external entity resolution, an attacker who can get untrusted XML unmarshalled through JAXB can read local files via out-of-band XXE.","source":"NVD","date":"2026-10-12T15:17:09.890Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92877","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-92877"],"cvss":{"score":8.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"emo@eclipse.org"},"read":false,"kev":false,"recordIds":["CVE-2026-92877"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92877"}],"epss":null},{"id":"CVE-2026-109390","title":"CVE-2026-109390 — AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based b","summary":"AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer overflow, as demonstrated on Linux for command execution as root without the victim approving desktop control. In the stream packet handler for mode 5 in the session protocol, a payload length value is not validated.","source":"NVD","date":"2026-10-12T15:17:07.980Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109390","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109390"],"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"cve@mitre.org"},"read":false,"kev":false,"recordIds":["CVE-2026-109390"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109390"}],"epss":null},{"id":"CVE-2026-108898","title":"CVE-2026-108898 — A vulnerability was detected in Netis WF2409E 3.3.42541. This affects an unknown function of the componen","summary":"A vulnerability was detected in Netis WF2409E 3.3.42541. This affects an unknown function of the component Wireless Settings. The manipulation of the argument SSID results in cross site scripting. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-12T15:17:07.803Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108898","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108898"],"cvss":{"score":2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108898"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108898"}],"epss":null},{"id":"CVE-2026-108897","title":"CVE-2026-108897 — A security vulnerability has been detected in Smart Media4U Technology SHAREit App 6.27.38_ww on Android.","summary":"A security vulnerability has been detected in Smart Media4U Technology SHAREit App 6.27.38_ww on Android. The impacted element is the function syncInvoke of the component WebView JS Bridge. The manipulation leads to exposed dangerous routine. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-12T15:17:07.620Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108897","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108897"],"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108897"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108897"}],"epss":null},{"id":"CVE-2026-108896","title":"CVE-2026-108896 — A vulnerability was found in Linksys E1700 1.0.0.4.003. This affects the function setLinksysIpv6 of the f","summary":"A vulnerability was found in Linksys E1700 1.0.0.4.003. This affects the function setLinksysIpv6 of the file /goform/setLinksysIpv6. The manipulation of the argument _6rd_prefix/_6rd_prefix_len results in os command injection. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-12T15:17:07.423Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108896","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108896"],"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108896"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108896"}],"epss":null},{"id":"CVE-2026-108895","title":"CVE-2026-108895 — A weakness has been identified in Linksys E1700 1.0.0.4.003. The affected element is the function setDMZ ","summary":"A weakness has been identified in Linksys E1700 1.0.0.4.003. The affected element is the function setDMZ of the file /goform/setDMZ. Executing a manipulation of the argument MAC_addr can lead to os command injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-12T15:17:07.227Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108895","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108895"],"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108895"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108895"}],"epss":null},{"id":"CVE-2026-108094","title":"CVE-2026-108094 — A use-after-free flaw was found in mutter in the Wayland color-management ICC image-description path. A l","summary":"A use-after-free flaw was found in mutter in the Wayland color-management ICC image-description path. A local attacker who can run a malicious Wayland client can destroy a wp_image_description_v1 resource while an asynchronous ICC file read is still in progress. When the read completes, the compositor uses the freed wl_resource, writes into freed memory, and frees a pointer derived from that memory. This can crash the GNOME session and may allow arbitrary code execution within the compositor process.","source":"NVD","date":"2026-10-12T15:17:07.080Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108094","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108094"],"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"secalert@redhat.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108094"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108094"}],"epss":null},{"id":"CVE-2026-103521","title":"CVE-2026-103537 — Thelia 2.6.1 contains an absolute path traversal vulnerability in its Smarty template handling that enabl","summary":"Thelia 2.6.1 contains an absolute path traversal vulnerability in its Smarty template handling that enables SSTI and remote code execution. The `checkTemplate()` validation restricts relative directory traversal sequences such as `../` but does not reject absolute paths, allowing an authorized user to supply an arbitrary filesystem path as a template. Smarty then loads and compiles the referenced file without an effective security policy, so depending on filesystem layout and deployment configuration, template code in the file can be executed with the web server's privileges.","source":"NVD","date":"2026-10-12T15:17:06.667Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103537","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-103521","CVE-2026-103522","CVE-2026-103523","CVE-2026-103524","CVE-2026-103526","CVE-2026-103527","CVE-2026-103528","CVE-2026-103529","CVE-2026-103535","CVE-2026-103537"],"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-103537","CVE-2026-103535","CVE-2026-103529","CVE-2026-103528","CVE-2026-103527","CVE-2026-103526","CVE-2026-103524","CVE-2026-103523","CVE-2026-103522","CVE-2026-103521","https://kb.cert.org/vuls/id/162329"],"sources":["NVD","CERT/CC"],"topics":["New vulnerabilities","Coordinated disclosures"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103537"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103535"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103529"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103528"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103527"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103526"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103524"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103523"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103522"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103521"},{"source":"CERT/CC","url":"https://kb.cert.org/vuls/id/162329"}],"epss":null},{"id":"https://thehackernews.com/2026/10/weekly-recap-helpdesk-0-days-rogue.html","title":"⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More","source":"The Hacker News","date":"2026-10-12T15:16:26.000Z","summary":"Some meetings last longer than it took attackers to jump on a newly disclosed security flaw this week.  Within hours, they were already testing it.","url":"https://thehackernews.com/2026/10/weekly-recap-helpdesk-0-days-rogue.html","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://thehackernews.com/2026/10/weekly-recap-helpdesk-0-days-rogue.html"],"sources":["The Hacker News"],"topics":["Cyber news"],"affected":[],"references":[{"source":"The Hacker News","url":"https://thehackernews.com/2026/10/weekly-recap-helpdesk-0-days-rogue.html"}],"epss":null},{"id":"https://www.securityweek.com/?p=49951","title":"IonQ to Acquire Zero Trust Firm Elisity for Up to $1.3 Billion","source":"SecurityWeek","date":"2026-10-12T14:25:00.000Z","summary":"The all-stock deal brings Elisity’s least-privilege access technology into IonQ’s security portfolio.  3 Billion appeared first on SecurityWeek .","url":"https://www.securityweek.com/ionq-to-acquire-zero-trust-firm-elisity-for-up-to-1-3-billion/","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://www.securityweek.com/?p=49951"],"sources":["SecurityWeek"],"topics":["Cyber news"],"affected":[],"references":[{"source":"SecurityWeek","url":"https://www.securityweek.com/ionq-to-acquire-zero-trust-firm-elisity-for-up-to-1-3-billion/"}],"epss":null},{"id":"CVE-2026-68764","title":"CVE-2026-68764 — Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.","summary":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.","source":"NVD","date":"2026-10-12T14:17:13.473Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68764","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-68764"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-68764"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68764"}],"epss":null},{"id":"CVE-2026-18390","title":"CVE-2026-18390 — Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability ","summary":"Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor allows OS Command Injection.\n\nThis issue affects UYAP Document Editor: before 5.4.20.","source":"NVD","date":"2026-10-12T14:17:12.563Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18390","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-18390"],"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"iletisim@usom.gov.tr"},"read":false,"kev":false,"recordIds":["CVE-2026-18390"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18390"}],"epss":null},{"id":"CVE-2026-12613","title":"CVE-2026-12613 — Deserialization of untrusted data vulnerability in Ministry of Justice General Directorate of Information","summary":"Deserialization of untrusted data vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor allows Object Injection.\n\nThis issue affects UYAP Document Editor: before 5.4.20.","source":"NVD","date":"2026-10-12T14:17:12.423Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12613","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-12613"],"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"iletisim@usom.gov.tr"},"read":false,"kev":false,"recordIds":["CVE-2026-12613"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12613"}],"epss":null},{"id":"CVE-2026-109229","title":"CVE-2026-109229 — SGLang through 0.5.21 contains a denial of service vulnerability that disables Pillow decompression bomb ","summary":"SGLang through 0.5.21 contains a denial of service vulnerability that disables Pillow decompression bomb protection process-wide by setting Image.MAX_IMAGE_PIXELS to None in NanoNemotronVLImageProcessor. Remote attackers can submit small, highly compressed images with huge dimensions to the generic image loader, exhausting worker memory during decoding.","source":"NVD","date":"2026-10-12T14:17:12.257Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109229","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109229"],"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109229"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109229"}],"epss":null},{"id":"CVE-2026-109228","title":"CVE-2026-109228 — SGLang through 0.5.21 contains a resource budget bypass vulnerability that allows remote attackers to ove","summary":"SGLang through 0.5.21 contains a resource budget bypass vulnerability that allows remote attackers to override GLM-V video processing limits by supplying fps, max_frames, max_tokens_per_frame and max_image_tokens in the video_url object. Attackers can set these values arbitrarily high so glm4v.py decodes every frame of high-resolution video at full size, exhausting worker memory and denying service.","source":"NVD","date":"2026-10-12T14:17:12.087Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109228","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109228"],"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109228"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109228"}],"epss":null},{"id":"CVE-2026-109227","title":"CVE-2026-109227 — SGLang through 0.5.21 contains an unbounded memory allocation vulnerability in preprocess_video in qwen_v","summary":"SGLang through 0.5.21 contains an unbounded memory allocation vulnerability in preprocess_video in qwen_vl.py that decodes frames at full source resolution before applying max_pixels limits. Remote attackers can submit high-resolution videos to /v1/chat/completions on Qwen-VL deployments, and concurrent requests exhaust worker memory causing denial of service.","source":"NVD","date":"2026-10-12T14:17:11.923Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109227","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109227"],"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109227"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109227"}],"epss":null},{"id":"CVE-2026-109226","title":"CVE-2026-109226 — SGLang through 0.5.21 contains a decompression amplification vulnerability in load_audio that allows remo","summary":"SGLang through 0.5.21 contains a decompression amplification vulnerability in load_audio that allows remote attackers to exhaust memory by submitting highly compressed audio decoded without duration or sample limits. Attackers can supply small FLAC-encoded silence files through audio_url or audio_data inputs that expand into massive PCM buffers, exhausting worker memory and CPU for denial of service.","source":"NVD","date":"2026-10-12T14:17:11.747Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109226","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109226"],"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109226"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109226"}],"epss":null},{"id":"CVE-2026-109225","title":"CVE-2026-109225 — SGLang through 0.5.21 contains an unbounded memory allocation vulnerability that allows unauthenticated r","summary":"SGLang through 0.5.21 contains an unbounded memory allocation vulnerability that allows unauthenticated remote attackers to exhaust memory by uploading oversized files to /v1/audio/transcriptions. Attackers can send concurrent large multipart uploads, which are fully read into memory before validation, to crash the HTTP/tokenizer worker and deny service.","source":"NVD","date":"2026-10-12T14:17:11.580Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109225","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109225"],"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109225"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109225"}],"epss":null},{"id":"CVE-2026-109206","title":"CVE-2026-109206 — LogicalDOC Community Edition through 9.3 contains a username enumeration vulnerability that allows unauth","summary":"LogicalDOC Community Edition through 9.3 contains a username enumeration vulnerability that allows unauthenticated attackers to identify valid accounts because the AvatarServlet (/avatar) performs no session validation. Attackers can supply usernames or numeric IDs in the userId parameter and compare 1x1 transparent images against real avatars to enumerate users and retrieve profile pictures.","source":"NVD","date":"2026-10-12T14:17:11.427Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109206","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109206"],"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109206"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109206"}],"epss":null},{"id":"CVE-2026-109205","title":"CVE-2026-109205 — LogicalDOC Community Edition through 9.3 contains an unauthenticated file upload vulnerability in the Upl","summary":"LogicalDOC Community Edition through 9.3 contains an unauthenticated file upload vulnerability in the UploadServlet that allows remote attackers to write files to disk without a session. Attackers can repeatedly send multipart requests with unlimited file parts to /upload, persisting files in uncleaned temporary directories and exhausting server disk space.","source":"NVD","date":"2026-10-12T14:17:11.277Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109205","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109205"],"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109205"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109205"}],"epss":null},{"id":"CVE-2026-109204","title":"CVE-2026-109204 — LogicalDOC Community Edition through 9.3 contains an improper authorization vulnerability in the PswRecov","summary":"LogicalDOC Community Edition through 9.3 contains an improper authorization vulnerability in the PswRecovery servlet that fails to bind password recovery tickets to the requesting user. Attackers can obtain a ticket for their own account and reuse it with any userId, including administrators, to reset victims' passwords, lock them out, and reveal their email addresses.","source":"NVD","date":"2026-10-12T14:17:11.123Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109204","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109204"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109204"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109204"}],"epss":null},{"id":"CVE-2026-109203","title":"CVE-2026-109203 — LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the ConvertPdf","summary":"LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the ConvertPdf servlet that allows authenticated users to download restricted PDF documents. Attackers can enumerate sequential docId values and use the version parameter to retrieve any PDF and its versions from folders they cannot access.","source":"NVD","date":"2026-10-12T14:17:10.977Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109203","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109203"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109203"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109203"}],"epss":null},{"id":"CVE-2026-109202","title":"CVE-2026-109202 — LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the zip-export","summary":"LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the zip-export servlet that allows authenticated users to export restricted folders by supplying a folderId parameter. Attackers can request /zip-export with a restricted folder ID, since ZipExport.addFolderDocuments() skips READ and DOWNLOAD permission checks, to download all of its documents in a ZIP archive.","source":"NVD","date":"2026-10-12T14:17:10.827Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109202","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109202"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109202"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109202"}],"epss":null},{"id":"CVE-2026-109201","title":"CVE-2026-109201 — LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in SoapDocumentSe","summary":"LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in SoapDocumentService operations that allows authenticated users to access and modify unauthorized documents. Attackers can call copy, getExtractedText, deleteVersion, reindex, deleteLink, or restore via SOAP or /services/rest/document with sequential document IDs to disclose, delete, or tamper with documents.","source":"NVD","date":"2026-10-12T14:17:10.680Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109201","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109201"],"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109201"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109201"}],"epss":null},{"id":"CVE-2026-109200","title":"CVE-2026-109200 — LogicalDOC Community Edition through 9.3 contains a server-side request forgery vulnerability in the defa","summary":"LogicalDOC Community Edition through 9.3 contains a server-side request forgery vulnerability in the default-enabled XMLConverter that fetches xml-stylesheet href URLs without scheme or host allowlisting. Authenticated users can upload XML documents whose stylesheet href points to internal http, ftp, file, or jar URLs, forcing server requests and applying attacker-controlled XSLT during conversion.","source":"NVD","date":"2026-10-12T14:17:10.527Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109200","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109200"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109200"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109200"}],"epss":null},{"id":"CVE-2026-109199","title":"CVE-2026-109199 — LogicalDOC Community Edition through 9.3 contains a code injection vulnerability that allows authenticate","summary":"LogicalDOC Community Edition through 9.3 contains a code injection vulnerability that allows authenticated users to execute OS commands by submitting Velocity templates in DocumentService.sendAsEmail subject or message fields. Attackers can invoke SystemTool exec methods or ClassTool, bypassing the forbidRuntimeUsage denylist, to run commands with LogicalDOC process privileges.","source":"NVD","date":"2026-10-12T14:17:10.373Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109199","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109199"],"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109199"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109199"}],"epss":null},{"id":"CVE-2026-109170","title":"CVE-2026-109170 — LogicalDOC Community Edition through 9.3 contains an HQL injection vulnerability in DocumentsDataServlet ","summary":"LogicalDOC Community Edition through 9.3 contains an HQL injection vulnerability in DocumentsDataServlet that allows authenticated users to manipulate queries via the unvalidated indexed parameter. Attackers with read access to any folder can inject boolean HQL expressions to bypass folder scope and read-permission checks, listing restricted document metadata and extracting database contents.","source":"NVD","date":"2026-10-12T14:17:10.223Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109170","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109170"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109170"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109170"}],"epss":null},{"id":"CVE-2026-109169","title":"CVE-2026-109169 — LogicalDOC Community Edition through 9.3 contains a sql injection vulnerability that allows authenticated","summary":"LogicalDOC Community Edition through 9.3 contains a sql injection vulnerability that allows authenticated users to execute crafted SQL via the firstLetter parameter of TagsDataServlet. Low-privileged attackers can inject UNION SELECT statements returned in the XML tag list to read usernames, email addresses and password hashes from ld_user.","source":"NVD","date":"2026-10-12T14:17:10.073Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109169","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109169"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109169"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109169"}],"epss":null},{"id":"CVE-2026-108894","title":"CVE-2026-108894 — A security flaw has been discovered in Linksys E1700 1.0.0.4.003. Impacted is the function addStaticRoute","summary":"A security flaw has been discovered in Linksys E1700 1.0.0.4.003. Impacted is the function addStaticRoute of the file /goform/addStaticRoute of the component Static Route Handler. Performing a manipulation of the argument staticRoute_IP_setting/staticRoute_Netmask_setting/staticRoute_Gateway_setting/staticRoute_Metric_setting results in os command injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-12T14:17:09.897Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108894","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108894"],"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108894"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108894"}],"epss":null},{"id":"CVE-2026-108893","title":"CVE-2026-108893 — A vulnerability was identified in Linksys E1700 up to 1.0.0.4.003. This issue affects the function setVla","summary":"A vulnerability was identified in Linksys E1700 up to 1.0.0.4.003. This issue affects the function setVlan of the file /goform/setVlan. Such manipulation of the argument vlan_set leads to stack-based buffer overflow. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-12T14:17:09.710Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108893","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108893"],"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108893"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108893"}],"epss":null},{"id":"CVE-2026-108892","title":"CVE-2026-108892 — A vulnerability was determined in Linksys E1700 1.0.0.4.003. This vulnerability affects the function ssid","summary":"A vulnerability was determined in Linksys E1700 1.0.0.4.003. This vulnerability affects the function ssid1MACFilter of the file /goform/ssid1MACFilter of the component Mac Filter. This manipulation of the argument newap_text_%d causes stack-based buffer overflow. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-12T14:17:09.530Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108892","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108892"],"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108892"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108892"}],"epss":null},{"id":"CVE-2026-108890","title":"CVE-2026-108890 — A vulnerability has been found in BlackBeltTechnology pi-agent-dashboard up to 0.8.0. Affected by this is","summary":"A vulnerability has been found in BlackBeltTechnology pi-agent-dashboard up to 0.8.0. Affected by this issue is the function terminalManager.spawn of the file packages/server/src/browser-handlers/terminal-handler.ts of the component Terminal Handler. The manipulation of the argument cwd leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 48fd0bad5adfe76af9736599699d51a5f60019f6. It is suggested to install a patch to address this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.","source":"NVD","date":"2026-10-12T14:17:09.343Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108890","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108890"],"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108890"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108890"}],"epss":null},{"id":"CVE-2026-103502","title":"CVE-2026-103502 — Improper Certificate Validation vulnerability in hexpm hex_core allows an attacker who can intercept HTTP","summary":"Improper Certificate Validation vulnerability in hexpm hex_core allows an attacker who can intercept HTTPS connections to impersonate hex.pm, repo.hex.pm or any other repository or API server to programs that use hex_core's default HTTP adapter on Erlang/OTP 24, or on OTP 25 when the operating system's CA certificates can't be loaded.\n\nhex_core:default_config/0 selects the built-in hex_http_httpc adapter. For an HTTPS request whose adapter config has no ssl option, hex_http_httpc:http_options/2 builds options that verify the server certificate against public_key:cacerts_get/0. When that call raises, the adapter prints a warning and sends the request without ssl options, so httpc uses the defaults of the ssl application, which before OTP 26 don't verify the server certificate. public_key:cacerts_get/0 doesn't exist on OTP 24, so every HTTP","source":"NVD","date":"2026-10-12T14:17:08.610Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103502","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-103502"],"cvss":{"score":5.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},"read":false,"kev":false,"recordIds":["CVE-2026-103502"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103502"}],"epss":null},{"id":"CVE-2026-93695","title":"CVE-2026-93695 — In Progress ShareFile Storage Zones Controller v5.12.6 and below, FileCopyService uses a remote file iden","summary":"In Progress ShareFile Storage Zones Controller v5.12.6 and below, FileCopyService uses a remote file identifier when constructing a local temporary file path without enforcing containment. This can cause FileCopyService to write attacker-controlled content to filesystem locations writable by the service account. This can result in remote code execution when an executable IIS-served directory is writable.","source":"NVD","date":"2026-10-12T13:17:33.590Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93695","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-93695"],"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"security@progress.com"},"read":false,"kev":false,"recordIds":["CVE-2026-93695"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93695"}],"epss":null},{"id":"CVE-2026-93694","title":"CVE-2026-93694 — In Progress ShareFile Storage Zones Controller v5.12.6 and below, processing of queue items can send ackn","summary":"In Progress ShareFile Storage Zones Controller v5.12.6 and below, processing of queue items can send acknowledgements to an unvalidated callback URL, this behavior together with a race condition allows the attacker to cause FileCopyService to consume attacker-controlled metadata and content. Exploitation requires control over copy queue work and a race condition.","source":"NVD","date":"2026-10-12T13:17:33.460Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93694","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-93694"],"cvss":{"score":4,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","source":"security@progress.com"},"read":false,"kev":false,"recordIds":["CVE-2026-93694"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93694"}],"epss":null},{"id":"CVE-2026-93693","title":"CVE-2026-93693 — In Progress ShareFile Storage Zones Controller v5.12.6 and below, improper validation of outbound request","summary":"In Progress ShareFile Storage Zones Controller v5.12.6 and below, improper validation of outbound request destinations and parameters, unsafe JSONP response formatting, and insufficient validation on queue service can be chained by a remote unauthenticated attacker to issue server-side requests to unintended local handlers and perform unauthorized queue operations.","source":"NVD","date":"2026-10-12T13:17:33.313Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93693","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-93693"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","source":"security@progress.com"},"read":false,"kev":false,"recordIds":["CVE-2026-93693"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93693"}],"epss":null},{"id":"CVE-2026-52903","title":"CVE-2026-52903 — A deserialization of untrusted data vulnerability was found in ManageIQ. The YamlLoadAliases module overr","summary":"A deserialization of untrusted data vulnerability was found in ManageIQ. The YamlLoadAliases module overrides YAML.safe_load to silently fall back to YAML.unsafe_load in production when a Psych::DisallowedClass error occurs. An authenticated attacker with dialog import access can exploit this to achieve remote code execution by uploading a crafted YAML payload that triggers the fallback and deserializes arbitrary Ruby objects.\n\nRed Hat CloudForms, which was based on ManageIQ, has reached End of Life and is no longer supported. No errata or patches will be issued. This CVE is being assigned for the benefit of the ManageIQ community and downstream consumers.","source":"NVD","date":"2026-10-12T13:17:32.757Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52903","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-52903"],"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"secalert@redhat.com"},"read":false,"kev":false,"recordIds":["CVE-2026-52903"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52903"}],"epss":null},{"id":"CVE-2026-109188","title":"CVE-2026-109188 — jshERP through 3.6 contains a missing authorization vulnerability that allows low-privilege authenticated","summary":"jshERP through 3.6 contains a missing authorization vulnerability that allows low-privilege authenticated users to create tenant-wide master data via add and import endpoints lacking role checks. Attackers can send POST requests to endpoints like /account/add, /material/add, or /material/importExcel to create settlement accounts, products with initial stock, departments and dictionary entries.","source":"NVD","date":"2026-10-12T13:17:32.383Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109188","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109188"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109188"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109188"}],"epss":null},{"id":"CVE-2026-109187","title":"CVE-2026-109187 — jshERP through 3.6 contains an information disclosure vulnerability that allows any authenticated user to","summary":"jshERP through 3.6 contains an information disclosure vulnerability that allows any authenticated user to read platform-wide configuration secrets via the getInfoByKey handler of PlatformConfigController. Low-privilege users of any tenant can request arbitrary platformKey values such as email_auth_code or activation_code to obtain SMTP authorization codes and activation secrets, because only aliOss and weixin keys are blocked.","source":"NVD","date":"2026-10-12T13:17:32.173Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109187","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109187"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109187"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109187"}],"epss":null},{"id":"CVE-2026-109186","title":"CVE-2026-109186 — jshERP through 3.6 contains a mass assignment vulnerability in the UserController update handler that all","summary":"jshERP through 3.6 contains a mass assignment vulnerability in the UserController update handler that allows authenticated users to overwrite protected fields including tenant_id and password. Attackers can send a crafted PUT /user/update body to switch into another tenant on next login or overwrite other users' password hashes for account takeover.","source":"NVD","date":"2026-10-12T13:17:32.003Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109186","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109186"],"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109186"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109186"}],"epss":null},{"id":"CVE-2026-109185","title":"CVE-2026-109185 — jshERP through 3.6 contains a missing authorization vulnerability in the UserController updateUser handle","summary":"jshERP through 3.6 contains a missing authorization vulnerability in the UserController updateUser handler that allows authenticated users to assign arbitrary roles to any user. Low-privilege attackers can send their own user id with the tenant administrator roleId to escalate privileges or rebind other tenant users' roles.","source":"NVD","date":"2026-10-12T13:17:31.840Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109185","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109185"],"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109185"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109185"}],"epss":null},{"id":"CVE-2026-109184","title":"CVE-2026-109184 — jshERP through 3.6 contains an improper authorization vulnerability that allows low-privilege authenticat","summary":"jshERP through 3.6 contains an improper authorization vulnerability that allows low-privilege authenticated users to read any settlement account ledger by supplying an arbitrary accountId. Attackers restricted to personal or department data scope can query GET /account/findAccountInOutList to view other users' bill numbers, counterparties, amounts and remarks within the tenant.","source":"NVD","date":"2026-10-12T13:17:31.663Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109184","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109184"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109184"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109184"}],"epss":null},{"id":"CVE-2026-109183","title":"CVE-2026-109183 — jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users to crea","summary":"jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users to create pre-approved bills by setting status in POST /depotHead/addDepotHeadAndDetail requests. Attackers can supply a status of 1 to skip audit permission checks and multi-level approval workflows, creating audited bills that affect stock and report queries.","source":"NVD","date":"2026-10-12T13:17:31.497Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109183","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109183"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109183"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109183"}],"epss":null},{"id":"CVE-2026-109182","title":"CVE-2026-109182 — jshERP through 3.6 contains an incorrect authorization vulnerability in GET /supplier/exportExcel that al","summary":"jshERP through 3.6 contains an incorrect authorization vulnerability in GET /supplier/exportExcel that allows authenticated users to bypass role data scope restrictions enforced by /supplier/list. Attackers restricted to personal or department data can export every supplier, customer and member record, exposing contacts, phone numbers, tax numbers, bank accounts and balances.","source":"NVD","date":"2026-10-12T13:17:31.327Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109182","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109182"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109182"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109182"}],"epss":null},{"id":"CVE-2026-109181","title":"CVE-2026-109181 — jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users restric","summary":"jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users restricted to personal or department data to list other users' bills by adding a purchaseStatus value. Attackers can include purchaseStatus=0 in the search JSON on GET /depotHead/list, causing DepotHeadService.select to drop the creator filter and expose all tenant purchase, sales and inventory bills.","source":"NVD","date":"2026-10-12T13:17:31.157Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109181","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109181"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109181"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109181"}],"epss":null},{"id":"CVE-2026-109180","title":"CVE-2026-109180 — jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users to read","summary":"jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users to read data from unassigned warehouses by supplying depotId or depotIds request parameters. When depot_flag warehouse restriction is enabled, attackers can name arbitrary warehouse ids in endpoints like /depotItem/getMaterialDepotStockByParam to read stock levels, batch numbers, sales figures and priced bill lines within the tenant.","source":"NVD","date":"2026-10-12T13:17:30.980Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109180","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109180"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109180"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109180"}],"epss":null},{"id":"CVE-2026-109179","title":"CVE-2026-109179 — jshERP through 3.6 contains a missing authorization vulnerability in LogController that allows any authen","summary":"jshERP through 3.6 contains a missing authorization vulnerability in LogController that allows any authenticated user to read the tenant's operation audit log. Low-privilege users can send GET requests to /log/list or /log/info to view other users' login names, client IP addresses, and actions.","source":"NVD","date":"2026-10-12T13:17:30.813Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109179","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109179"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109179"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109179"}],"epss":null},{"id":"CVE-2026-109178","title":"CVE-2026-109178 — jshERP through 3.6 contains a missing authorization vulnerability in LogController that allows any authen","summary":"jshERP through 3.6 contains a missing authorization vulnerability in LogController that allows any authenticated user to forge, modify, or delete audit log entries. Low-privilege users can call /log/add, /log/update, /log/delete, and /log/deleteBatch to fabricate entries, rewrite user and IP fields, or erase records to hide activity.","source":"NVD","date":"2026-10-12T13:17:30.643Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109178","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109178"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109178"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109178"}],"epss":null},{"id":"CVE-2026-109177","title":"CVE-2026-109177 — MoguBlog through 6.2 contains a broken access control vulnerability that allows authenticated administrat","summary":"MoguBlog through 6.2 contains a broken access control vulnerability that allows authenticated administrators to move or rename other administrators' network-disk files by supplying their file paths. Attackers can send crafted requests to POST /networkDisk/moveFile, batchMoveFile, or edit, which update rows without admin_uid checks, relocating or renaming other users' files and folders.","source":"NVD","date":"2026-10-12T13:17:30.490Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109177","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109177"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109177"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109177"}],"epss":null},{"id":"CVE-2026-109176","title":"CVE-2026-109176 — MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated","summary":"MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to delete other administrators' files via POST /networkDisk/deleteFile and batchDeleteFile. Attackers can supply another administrator's file or folder uid, which NetworkDiskServiceImpl.deleteFile never checks against admin_uid, removing stored objects from local storage, Qiniu or MinIO.","source":"NVD","date":"2026-10-12T13:17:30.340Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109176","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109176"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109176"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109176"}],"epss":null},{"id":"CVE-2026-109175","title":"CVE-2026-109175 — MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated","summary":"MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to list other administrators' network-disk files via POST /networkDisk/getFileList. Attackers can query the endpoint, which filters only by status, file type, or filePath and never by admin_uid, to obtain other administrators' file names and download URLs.","source":"NVD","date":"2026-10-12T13:17:30.190Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109175","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109175"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109175"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109175"}],"epss":null},{"id":"CVE-2026-109174","title":"CVE-2026-109174 — MoguBlog through 6.2 contains an information disclosure vulnerability that allows low-privileged front-en","summary":"MoguBlog through 6.2 contains an information disclosure vulnerability that allows low-privileged front-end users to read system credentials via the getSystemConfig endpoint. Attackers can supply an ordinary reader session token to retrieve unfiltered SystemConfig data, exposing Qiniu and MinIO secret keys and SMTP mailbox passwords.","source":"NVD","date":"2026-10-12T13:17:30.040Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109174","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109174"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109174"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109174"}],"epss":null},{"id":"CVE-2026-109173","title":"CVE-2026-109173 — yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back","summary":"yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject invoices via POST /admin-api/crm/invoice/check. The CrmInvoiceController check handler lacks @PreAuthorize and approver checks are commented out, letting attackers bypass the invoice approval workflow by supplying any invoice id.","source":"NVD","date":"2026-10-12T13:17:29.870Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109173","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109173"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109173"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109173"}],"epss":null},{"id":"CVE-2026-109172","title":"CVE-2026-109172 — yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back","summary":"yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject receivables records by calling POST /admin-api/crm/contract-receivables/check. The handler lacks a @PreAuthorize check and the approver checks in CrmContractReceivablesServiceImpl.check are commented out, so attackers can approve records by id, inflating contract return_money and forging approval logs.","source":"NVD","date":"2026-10-12T13:17:29.697Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109172","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109172"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109172"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109172"}],"epss":null},{"id":"CVE-2026-109171","title":"CVE-2026-109171 — yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back","summary":"yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject contracts by calling POST /admin-api/crm/contract/check. Because CrmContractController lacks @PreAuthorize and approver checks are commented out, attackers can approve contracts to alter customer deal and purchase data or reject them to return products to stock.","source":"NVD","date":"2026-10-12T13:17:29.520Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109171","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109171"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109171"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109171"}],"epss":null},{"id":"CVE-2026-109168","title":"CVE-2026-109168 — lamp-cloud through 5.10.1 contains an insecure direct object reference vulnerability that allows authenti","summary":"lamp-cloud through 5.10.1 contains an insecure direct object reference vulnerability that allows authenticated users to list other business objects' file attachments by supplying an arbitrary bizId to the listFileByBizId endpoint. Attackers can retrieve file names, storage paths, MD5 hashes and stored URLs, which in default LOCAL storage are served without login under /anyTenant/file.","source":"NVD","date":"2026-10-12T13:17:29.350Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109168","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109168"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109168"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109168"}],"epss":null},{"id":"CVE-2026-109167","title":"CVE-2026-109167 — TDuck survey form through 6.0 contains an insecure direct object reference vulnerability in the saveFormT","summary":"TDuck survey form through 6.0 contains an insecure direct object reference vulnerability in the saveFormTheme handler that allows authenticated users to overwrite other users' form themes. Attackers whose form has no theme can submit another form's sequential theme id with their own formKey, replacing its colours and image URLs and removing the victim's theme.","source":"NVD","date":"2026-10-12T13:17:29.200Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109167","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109167"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109167"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109167"}],"epss":null},{"id":"CVE-2026-109166","title":"CVE-2026-109166 — lamp-cloud through 5.10.1 contains an insecure direct object reference vulnerability that allows authenti","summary":"lamp-cloud through 5.10.1 contains an insecure direct object reference vulnerability that allows authenticated users to obtain storage URLs for other users' files by supplying arbitrary file ids. Attackers can send another user's file ids to the findUrlById handler of FileAnyoneController, which never checks ownership, to retrieve access URLs and read uploaded attachments.","source":"NVD","date":"2026-10-12T13:17:29.007Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109166","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109166"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109166"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109166"}],"epss":null},{"id":"CVE-2026-109165","title":"CVE-2026-109165 — TDuck survey form through 6.0 contains a broken access control vulnerability that allows authenticated us","summary":"TDuck survey form through 6.0 contains a broken access control vulnerability that allows authenticated users to add fields to other users' forms via POST /user/form/item/batch/create. Attackers can submit an array whose first element references their own form and later elements reference a victim's formKey, injecting attacker-chosen fields onto the victim's public fill page.","source":"NVD","date":"2026-10-12T13:17:28.613Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109165","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109165"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109165"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109165"}],"epss":null},{"id":"CVE-2026-109164","title":"CVE-2026-109164 — TDuck survey form through 6.0 contains an insecure direct object reference vulnerability that allows auth","summary":"TDuck survey form through 6.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' form submissions by supplying arbitrary submission ids. Attackers can place their own formKey in the path and iterate sequential submission ids in the request body to permanently delete submissions platform-wide.","source":"NVD","date":"2026-10-12T13:17:28.460Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109164","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109164"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109164"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109164"}],"epss":null},{"id":"CVE-2026-108953","title":"CVE-2026-108953 — mac-shell-mcp before 2.0.0 contains an OS command injection vulnerability that allows MCP clients to bypa","summary":"mac-shell-mcp before 2.0.0 contains an OS command injection vulnerability that allows MCP clients to bypass the command whitelist by injecting shell metacharacters into execute_command arguments. Attackers or malicious prompts can call a safe command such as pwd with arguments like ';' to run forbidden commands as the server user without approval.","source":"NVD","date":"2026-10-12T13:17:28.307Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108953","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108953"],"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108953"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108953"}],"epss":null},{"id":"CVE-2026-108952","title":"CVE-2026-108952 — RT-Thread through 5.3.0 contains a memory corruption vulnerability in the legacy USB CDC virtual COM port","summary":"RT-Thread through 5.3.0 contains a memory corruption vulnerability in the legacy USB CDC virtual COM port driver that aliases rx_ringbuffer as a Serial V2 rt_serial_rx_fifo in _function_enable(). A connected USB host configuring the CDC device triggers writes past the ring buffer into struct vcom members and an invalid rt_free() on close, causing denial of service.","source":"NVD","date":"2026-10-12T13:17:28.150Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108952","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108952"],"cvss":{"score":5.1,"version":"4.0","vector":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108952"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108952"}],"epss":null},{"id":"CVE-2026-108951","title":"CVE-2026-108951 — LavaLite CMS through 10.1.2 contains an authorization bypass vulnerability that allows authenticated low-","summary":"LavaLite CMS through 10.1.2 contains an authorization bypass vulnerability that allows authenticated low-privileged users to modify other users' accounts by abusing the AbstractRequest isWorkflow() check. Attackers can send a PATCH request to the user update route with a target identifier to change name, email, password, status, or mobile, including for administrators.","source":"NVD","date":"2026-10-12T13:17:27.993Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108951","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108951"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108951"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108951"}],"epss":null},{"id":"CVE-2026-108950","title":"CVE-2026-108950 — Open Source Social Network (OSSN) through 10.1 contains a missing authorization vulnerability in ossn_alb","summary":"Open Source Social Network (OSSN) through 10.1 contains a missing authorization vulnerability in ossn_album_page_handler that allows unauthenticated attackers to download files via album/getphoto and album/getcover. Attackers can enumerate sequential file GUIDs to retrieve friends-only album photos and other stored files without any access check.","source":"NVD","date":"2026-10-12T13:17:27.840Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108950","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108950"],"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108950"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108950"}],"epss":null},{"id":"CVE-2026-108889","title":"CVE-2026-108889 — A flaw has been found in Yungengxin Cloud Billing 2024.11.28.11. Affected by this vulnerability is the fu","summary":"A flaw has been found in Yungengxin Cloud Billing 2024.11.28.11. Affected by this vulnerability is the function sub_14000443C in the library LWBilling64.sys of the component IOCTL Process Termination. Executing a manipulation of the argument Pid can lead to exposed ioctl with insufficient access control. The attack needs to be launched locally. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-12T13:17:27.660Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108889","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108889"],"cvss":{"score":1.9,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108889"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108889"}],"epss":null},{"id":"CVE-2026-108836","title":"CVE-2026-108836 — A vulnerability has been found in Ollama up to 0.34.1. The affected element is the function IsValid of th","summary":"A vulnerability has been found in Ollama up to 0.34.1. The affected element is the function IsValid of the file types/model/name.go of the component Pull API. The manipulation leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.34.2 is sufficient to fix this issue. The identifier of the patch is dfabde4539e42ba1e1eab50a3a50b88aea7958a0. It is suggested to upgrade the affected component.","source":"NVD","date":"2026-10-12T13:17:27.457Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108836","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108836"],"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108836"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108836"}],"epss":null},{"id":"CVE-2026-108835","title":"CVE-2026-108835 — A flaw has been found in Yungengxin Yun Jia Security Guard up to 2.7.1.9. Impacted is the function sub_14","summary":"A flaw has been found in Yungengxin Yun Jia Security Guard up to 2.7.1.9. Impacted is the function sub_14000885C in the library kgameprotect.sys. Executing a manipulation of the argument Pid can lead to improper privilege management. The attack requires local access. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-12T13:17:27.280Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108835","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108835"],"cvss":{"score":4.8,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108835"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108835"}],"epss":null},{"id":"CVE-2026-108834","title":"CVE-2026-108834 — A vulnerability was detected in Cairo-dock Glx-Dock up to 3.4.0. This issue affects some unknown processi","summary":"A vulnerability was detected in Cairo-dock Glx-Dock up to 3.4.0. This issue affects some unknown processing of the file ww_page.php of the component Query Parameter Handler. Performing a manipulation of the argument p results in cross site scripting. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-12T13:17:27.090Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108834","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108834"],"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108834"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108834"}],"epss":null},{"id":"CVE-2026-108831","title":"CVE-2026-108831 — A security vulnerability has been detected in meetecho janus-gateway up to 1.4.2. This vulnerability affe","summary":"A security vulnerability has been detected in meetecho janus-gateway up to 1.4.2. This vulnerability affects unknown code of the file html/demos/admin.js of the component Admin API. Such manipulation leads to hard-coded credentials. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.","source":"NVD","date":"2026-10-12T13:17:26.890Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108831","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108831"],"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108831"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108831"}],"epss":null},{"id":"CVE-2026-105081","title":"CVE-2026-105081 — ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 does not properly account for symbolic links in the ","summary":"ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 does not properly account for symbolic links in the IsRightsAuthorizedByName security policy check, allowing configured policy restrictions to be bypassed. Local attackers who can create a symlink can point it at a policy-restricted path to evade the configured policy.","source":"NVD","date":"2026-10-12T13:17:25.590Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105081","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-105081"],"cvss":{"score":2,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-105081"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105081"}],"epss":null},{"id":"https://www.securityweek.com/?p=49949","title":"Bricksforge WordPress Plugin Vulnerability Exploited in the Wild","source":"SecurityWeek","date":"2026-10-12T13:14:37.000Z","summary":"The vulnerability tracked as CVE-2026-85097 can allow threat actors to take control of the targeted WordPress websites.  The post Bricksforge WordPress Plugin Vulnerability Exploited in the Wild appeared first on SecurityWeek .","url":"https://www.securityweek.com/bricksforge-wordpress-plugin-vulnerability-exploited-in-the-wild/","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://www.securityweek.com/?p=49949"],"sources":["SecurityWeek"],"topics":["Cyber news"],"affected":[],"references":[{"source":"SecurityWeek","url":"https://www.securityweek.com/bricksforge-wordpress-plugin-vulnerability-exploited-in-the-wild/"}],"epss":null},{"id":"CVE-2026-85499","title":"CVE-2026-85499 — Improper Authorization vulnerability in Apache SkyWalking BanyanDB.\n\n\n\nThe Canopy includes incomplete pro","summary":"Improper Authorization vulnerability in Apache SkyWalking BanyanDB.\n\n\n\nThe Canopy includes incomplete proof-of-concept role and monitoring-proxy functionality. Under a non-default configuration with a readonly Canopy user and a reachable monitoring target, that user can send non-read requests through the monitoring proxy.\n\n\n\nThis issue affects Apache SkyWalking BanyanDB: from 0.11.0 before 0.11.1.\n\n\n\nUsers are recommended to upgrade to version 0.11.1, which fixes the issue.","source":"NVD","date":"2026-10-12T12:17:15.483Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85499","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-85499"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-85499"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85499"}],"epss":null},{"id":"CVE-2026-108830","title":"CVE-2026-108830 — A weakness has been identified in meetecho janus-gateway up to 1.4.2. This affects an unknown part of the","summary":"A weakness has been identified in meetecho janus-gateway up to 1.4.2. This affects an unknown part of the file src/plugins/janus_videoroom.c of the component VideoRoom. This manipulation causes race condition. Remote exploitation of the attack is possible. The attack's complexity is rated as high. It is indicated that the exploitability is difficult. The exploit has been made available to the public and could be used for attacks. Patch name: 27c0d1af888153e818675b56a4e6267f62d57097. Applying a patch is the recommended action to fix this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.","source":"NVD","date":"2026-10-12T12:17:14.813Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108830","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108830"],"cvss":{"score":1.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108830"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108830"}],"epss":null},{"id":"CVE-2026-108829","title":"CVE-2026-108829 — A security flaw has been discovered in Zen Cart up to 2.2.2. Affected by this issue is some unknown funct","summary":"A security flaw has been discovered in Zen Cart up to 2.2.2. Affected by this issue is some unknown functionality of the file admin/modules.php of the component Module Configuration. The manipulation of the argument configuration results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The patch is identified as 08f572654edee1db8f9db091c9949825c6c69339. It is advisable to implement a patch to correct this issue.","source":"NVD","date":"2026-10-12T12:17:14.640Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108829","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108829"],"cvss":{"score":2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108829"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108829"}],"epss":null},{"id":"CVE-2026-108828","title":"CVE-2026-108828 — A vulnerability was identified in Zen Cart 2.2.2. Affected by this vulnerability is the function eval of ","summary":"A vulnerability was identified in Zen Cart 2.2.2. Affected by this vulnerability is the function eval of the file admin/configuration.php of the component Admin Panel. The manipulation of the argument gID leads to sql injection. The attack may be initiated remotely. The attack is considered to have high complexity. The exploitation appears to be difficult. The exploit is publicly available and might be used. The vendor explains: \"`set_function`/`use_function` are not editable through any normal admin UI (only at plugin-install time via SQL, or via direct database access)\".","source":"NVD","date":"2026-10-12T12:17:14.463Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108828","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108828"],"cvss":{"score":1.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108828"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108828"}],"epss":null},{"id":"CVE-2026-108827","title":"CVE-2026-108827 — A vulnerability was determined in Zen Cart up to 2.2.2. Affected is the function zen_call_function of the","summary":"A vulnerability was determined in Zen Cart up to 2.2.2. Affected is the function zen_call_function of the file admin/includes/functions/general.php of the component Administrative Module Management. Executing a manipulation of the argument use_function can lead to code injection. The attack can be launched remotely. Attacks of this nature are highly complex. The exploitability is told to be difficult. The exploit has been publicly disclosed and may be utilized. The vendor explains: \"We don't consider this an independently exploitable vulnerability. The only path to controlling `use_function`/`configuration_value` in the `configuration` table is the SQL Patch tool (raw arbitrary SQL execution) or a pre-existing SQL injection elsewhere\".","source":"NVD","date":"2026-10-12T12:17:14.270Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108827","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108827"],"cvss":{"score":1.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108827"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108827"}],"epss":null},{"id":"CVE-2026-105283","title":"CVE-2026-105283 — Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript ","summary":"Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unauthenticated attacker to read internal Elixir terms from an RPC error response by provoking an error the error builder has no dedicated clause for.\n\nAshTypescript.Rpc.ErrorBuilder.build_error_response/1 in lib/ash_typescript/rpc/error_builder.ex renders a pipeline error term that matches no specific clause with inspect/1 and places the result in details.error of the client-facing error. Ash exceptions take a separate path in AshTypescript.Rpc.Errors where unhandled cases are redacted behind an errorId, but these fallbacks have no redaction, so whatever the term carries reaches the HTTP or channel response. Two request paths hand it such terms: a struct-typed action argument with an invalid nested value, where cast_map_to_s","source":"NVD","date":"2026-10-12T12:17:12.447Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105283","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-105283"],"cvss":{"score":6.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},"read":false,"kev":false,"recordIds":["CVE-2026-105283"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105283"}],"epss":null},{"id":"https://www.securityweek.com/?p=49946","title":"Canonical Websites Disrupted in Second DDoS Attack This Year","source":"SecurityWeek","date":"2026-10-12T11:58:39.000Z","summary":"The outage hit the main Ubuntu and Canonical websites, including the Ubuntu blog and developer portal.  The post Canonical Websites Disrupted in Second DDoS Attack This Year appeared first on SecurityWeek .","url":"https://www.securityweek.com/canonical-websites-disrupted-in-second-ddos-attack-this-year/","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://www.securityweek.com/?p=49946"],"sources":["SecurityWeek"],"topics":["Cyber news"],"affected":[],"references":[{"source":"SecurityWeek","url":"https://www.securityweek.com/canonical-websites-disrupted-in-second-ddos-attack-this-year/"}],"epss":null},{"id":"https://thehackernews.com/2026/10/bring-your-own-agent-your-employees.html","title":"Bring Your Own Agent: Your Employees' Assistants Are Already Logged In","source":"The Hacker News","date":"2026-10-12T11:55:00.000Z","summary":"The personal AI agents rollout is going about as smoothly as expected: Amazon now blocks Meta's Muse because it doesn't identify itself as a bot while browsing; Instinct keeps raising privacy concerns; and the horror stories from pretty much every personal AI agent keep piling up.  Regardless, the tech world is mesmerized by the capabilities and potential of these services.","url":"https://thehackernews.com/2026/10/bring-your-own-agent-your-employees.html","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://thehackernews.com/2026/10/bring-your-own-agent-your-employees.html"],"sources":["The Hacker News"],"topics":["Cyber news"],"affected":[],"references":[{"source":"The Hacker News","url":"https://thehackernews.com/2026/10/bring-your-own-agent-your-employees.html"}],"epss":null},{"id":"https://www.securityweek.com/?p=49944","title":"Mastermind of 15,000-Mule Cybercrime Laundering Network Pleads Guilty in US","source":"SecurityWeek","date":"2026-10-12T11:24:50.000Z","summary":"Oleg Korniev was a leader of YMCO, a sophisticated network of money mules that helped hackers move funds outside the US.  The post Mastermind of 15,000-Mule Cybercrime Laundering Network Pleads Guilty in US appeared first on SecurityWeek .","url":"https://www.securityweek.com/mastermind-of-15000-mule-cybercrime-laundering-network-pleads-guilty-in-us/","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://www.securityweek.com/?p=49944"],"sources":["SecurityWeek"],"topics":["Cyber news"],"affected":[],"references":[{"source":"SecurityWeek","url":"https://www.securityweek.com/mastermind-of-15000-mule-cybercrime-laundering-network-pleads-guilty-in-us/"}],"epss":null},{"id":"https://thehackernews.com/2026/10/ledger-finds-unauthorized-hardware.html","title":"Ledger Finds Unauthorized Hardware Implant in CryptoBilis-Sold Wallet Amid Fund Theft Reports","source":"The Hacker News","date":"2026-10-12T11:21:48.000Z","summary":"Cryptocurrency hardware maker Ledger has temporarily paused sales of its products via CryptoBilis following reports of stolen funds linked to devices sold by the reseller.  On Friday, the company said it was investigating reports of loss of funds from users in Southeast Asia who had purchased products from CryptoBilis.","url":"https://thehackernews.com/2026/10/ledger-finds-unauthorized-hardware.html","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://thehackernews.com/2026/10/ledger-finds-unauthorized-hardware.html"],"sources":["The Hacker News"],"topics":["Cyber news"],"affected":[],"references":[{"source":"The Hacker News","url":"https://thehackernews.com/2026/10/ledger-finds-unauthorized-hardware.html"}],"epss":null},{"id":"CVE-2026-108826","title":"CVE-2026-108826 — A vulnerability was found in Zen Cart up to 2.2.2. This impacts the function zen_db_perform in the librar","summary":"A vulnerability was found in Zen Cart up to 2.2.2. This impacts the function zen_db_perform in the library includes/modules/payment/paypaldp.php of the component PayPal IPN Handler. Performing a manipulation of the argument txn_id results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used. The patch is named 557154f4fa025f51553094f47b06aa024220c48f. It is suggested to install a patch to address this issue.","source":"NVD","date":"2026-10-12T11:17:10.910Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108826","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108826"],"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108826"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108826"}],"epss":null},{"id":"CVE-2026-108825","title":"CVE-2026-108825 — A vulnerability has been found in yangzongzhuan RuoYi up to 4.8.3. This affects the function checkRoleAll","summary":"A vulnerability has been found in yangzongzhuan RuoYi up to 4.8.3. This affects the function checkRoleAllowed of the file /system/role/authDataScope. Such manipulation of the argument roleKey leads to improper privilege management. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-12T11:17:10.690Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108825","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108825"],"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108825"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108825"}],"epss":null},{"id":"CVE-2026-108824","title":"CVE-2026-108824 — A flaw has been found in DataEase up to 3.0.0. The impacted element is the function Utils.buildCalcField ","summary":"A flaw has been found in DataEase up to 3.0.0. The impacted element is the function Utils.buildCalcField of the file io/dataease/engine/utils/Utils.java. This manipulation of the argument calculated field causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. Patch name: 8509e218e6c1f0080eee9e379f269b2104785ef7. It is recommended to apply a patch to fix this issue.","source":"NVD","date":"2026-10-12T11:17:10.447Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108824","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108824"],"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108824"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108824"}],"epss":null},{"id":"CVE-2026-105412","title":"CVE-2026-105412 — An SQL Injection vulnerability affecting Tuleap Enterprise Edition 17.5 could allow an attacker to have r","summary":"An SQL Injection vulnerability affecting Tuleap Enterprise Edition 17.5 could allow an attacker to have read access the Tuleap database.","source":"NVD","date":"2026-10-12T11:17:10.317Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105412","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-105412"],"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L","source":"3DS.Information-Security@3ds.com"},"read":false,"kev":false,"recordIds":["CVE-2026-105412"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105412"}],"epss":null},{"id":"CVE-2026-105411","title":"CVE-2026-105411 — An Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition fro","summary":"An Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker with tracker administration rights on one tracker to update or delete fields of all the trackers on the instance.","source":"NVD","date":"2026-10-12T11:17:10.187Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105411","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-105411"],"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","source":"3DS.Information-Security@3ds.com"},"read":false,"kev":false,"recordIds":["CVE-2026-105411"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105411"}],"epss":null},{"id":"CVE-2026-105410","title":"CVE-2026-105410 — A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 1","summary":"A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary script code in user's browser session.","source":"NVD","date":"2026-10-12T11:17:10.063Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105410","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-105410"],"cvss":{"score":8.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","source":"3DS.Information-Security@3ds.com"},"read":false,"kev":false,"recordIds":["CVE-2026-105410"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105410"}],"epss":null},{"id":"CVE-2026-105409","title":"CVE-2026-105409 — A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 1","summary":"A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary script code in user's browser session.","source":"NVD","date":"2026-10-12T11:17:09.937Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105409","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-105409"],"cvss":{"score":8.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","source":"3DS.Information-Security@3ds.com"},"read":false,"kev":false,"recordIds":["CVE-2026-105409"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105409"}],"epss":null},{"id":"CVE-2026-105408","title":"CVE-2026-105408 — A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 1","summary":"A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary script code in user's browser session.","source":"NVD","date":"2026-10-12T11:17:09.807Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105408","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-105408"],"cvss":{"score":8.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","source":"3DS.Information-Security@3ds.com"},"read":false,"kev":false,"recordIds":["CVE-2026-105408"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105408"}],"epss":null},{"id":"CVE-2026-105407","title":"CVE-2026-105407 — An OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could al","summary":"An OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary commands on the server.","source":"NVD","date":"2026-10-12T11:17:09.673Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105407","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-105407"],"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"3DS.Information-Security@3ds.com"},"read":false,"kev":false,"recordIds":["CVE-2026-105407"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105407"}],"epss":null},{"id":"CVE-2026-103903","title":"CVE-2026-103903 — An incorrect authorization vulnerability in the WinBox\nauthentication flow of MikroTik RouterOS allows a ","summary":"An incorrect authorization vulnerability in the WinBox\nauthentication flow of MikroTik RouterOS allows a remote authenticated attacker\nwith credentials for a low-privilege account permitted to use WinBox to obtain\nthe authorization policy of a different existing account. The stage-one EC-SRP\nchallenge and proof are verified using the attacker's account, while the\nindependently supplied stage-two username is used to install the target\naccount's privileges. By specifying a higher-privilege account such as admin, a\nlow-privilege user can obtain a full administrative session without knowing the\ntarget account's password and can use that session to increase the privileges\nof the attacker's own account.","source":"NVD","date":"2026-10-12T11:17:09.517Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103903","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-103903"],"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"},"read":false,"kev":false,"recordIds":["CVE-2026-103903"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103903"}],"epss":null},{"id":"CVE-2026-103902","title":"CVE-2026-103902 — Improper verification of cryptographic signature vulnerability in DigiDoc libdigidocpp, DigiDoc DigiDoc4,","summary":"Improper verification of cryptographic signature vulnerability in DigiDoc libdigidocpp, DigiDoc DigiDoc4, DigiDoc DigiDoc Android, and DigiDoc DigiDoc iOS. The vulnerability allows an attacker to create forged digital signatures\n that are displayed a valid by affected DigiDoc software.This issue affects libdigidocpp: from 4.0.0 before 4.5.0; DigiDoc4: from 4.6.0 before 4.11.0; DigiDoc Android: from 2.7.0 before 3.1.0; DigiDoc iOS: from 2.7.0 before 3.1.0.","source":"NVD","date":"2026-10-12T11:17:08.617Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103902","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-103902"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"},"read":false,"kev":false,"recordIds":["CVE-2026-103902"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103902"}],"epss":null},{"id":"https://www.securityweek.com/?p=49938","title":"iRhythm Data Breach Impacts at Least 360,000 People","source":"SecurityWeek","date":"2026-10-12T11:05:43.000Z","summary":"Hackers stole patients’ personal information, including names, addresses, email addresses, dates of birth, and phone numbers.  The post iRhythm Data Breach Impacts at Least 360,000 People appeared first on SecurityWeek .","url":"https://www.securityweek.com/irhythm-data-breach-impacts-over-360000-people/","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://www.securityweek.com/?p=49938"],"sources":["SecurityWeek"],"topics":["Cyber news"],"affected":[],"references":[{"source":"SecurityWeek","url":"https://www.securityweek.com/irhythm-data-breach-impacts-over-360000-people/"}],"epss":null},{"id":"https://thehackernews.com/2026/10/critical-sonicwall-sma-1000-flaw.html","title":"Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch","source":"The Hacker News","date":"2026-10-12T10:36:56.000Z","summary":"Threat actors have been observed exploiting a recently disclosed critical security flaw in SonicWall Secure Mobile Access (SMA) 1000 appliances within days of public disclosure.  0), is a case of pre-authenticated server-side request forgery (SSRF) that could allow a remote attacker \"to direct the appliance to issue requests on their","url":"https://thehackernews.com/2026/10/critical-sonicwall-sma-1000-flaw.html","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://thehackernews.com/2026/10/critical-sonicwall-sma-1000-flaw.html"],"sources":["The Hacker News"],"topics":["Cyber news"],"affected":[],"references":[{"source":"The Hacker News","url":"https://thehackernews.com/2026/10/critical-sonicwall-sma-1000-flaw.html"}],"epss":null},{"id":"https://www.securityweek.com/?p=49936","title":"Ransomware Response Expert Arrested in ShinyHunters FBI Hack Probe","source":"SecurityWeek","date":"2026-10-12T10:32:05.000Z","summary":"The suspect is believed to be Edward Dubrovsky, a Canadian cybersecurity executive who was visiting the United States for a conference.  The post Ransomware Response Expert Arrested in ShinyHunters FBI Hack Probe appeared first on SecurityWeek .","url":"https://www.securityweek.com/ransomware-response-expert-arrested-in-shinyhunters-fbi-hack-probe/","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://www.securityweek.com/?p=49936"],"sources":["SecurityWeek"],"topics":["Cyber news"],"affected":[],"references":[{"source":"SecurityWeek","url":"https://www.securityweek.com/ransomware-response-expert-arrested-in-shinyhunters-fbi-hack-probe/"}],"epss":null},{"id":"CVE-2026-108979","title":"CVE-2026-108979 — Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in erro","summary":"Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.","source":"NVD","date":"2026-10-12T10:16:44.340Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108979","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108979"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-108979"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108979"}],"epss":null},{"id":"CVE-2026-108822","title":"CVE-2026-108822 — A vulnerability was detected in Kamailio up to 6.0.7/6.1.3. The affected element is the function isup_get","summary":"A vulnerability was detected in Kamailio up to 6.0.7/6.1.3. The affected element is the function isup_get_calling_party of the file src/modules/sipt/ss7_parser.c of the component sipt Module. The manipulation of the argument length results in buffer overflow. The attack may be performed from remote. Upgrading to version 6.0.8 and 6.1.4 is sufficient to fix this issue. The patch is identified as 3667bebf8d0bea07ed16218fd921d07db87aeb21. Upgrading the affected component is advised.","source":"NVD","date":"2026-10-12T10:16:44.170Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108822","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108822"],"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108822"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108822"}],"epss":{"score":0.00767,"date":"2026-10-12","percentile":0.54294}},{"id":"CVE-2026-108821","title":"CVE-2026-108821 — A security vulnerability has been detected in Tencent WeKnora up to 0.8.1. Impacted is the function valid","summary":"A security vulnerability has been detected in Tencent WeKnora up to 0.8.1. Impacted is the function validateSubquery of the file internal/utils/inject.go of the component SQL Validator. The manipulation leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.8.2 is recommended to address this issue. The identifier of the patch is d7ccd5ba517cc3968e6d5000a2ab0f4b51ef1dda. It is recommended to upgrade the affected component.","source":"NVD","date":"2026-10-12T10:16:43.983Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108821","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108821"],"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108821"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108821"}],"epss":{"score":0.004,"date":"2026-10-12","percentile":0.32237}},{"id":"CVE-2026-108820","title":"CVE-2026-108820 — A weakness has been identified in agno-agi agno up to 3.0.6/3.1.1. This issue affects the function member","summary":"A weakness has been identified in agno-agi agno up to 3.0.6/3.1.1. This issue affects the function member_agent.run in the library libs/agno/agno/team/_default_tools.py of the component Delegation Feature. Executing a manipulation can lead to execution with unnecessary privileges. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The pull request to fix this issue awaits acceptance.","source":"NVD","date":"2026-10-12T10:16:43.783Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108820","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108820"],"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108820"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108820"}],"epss":{"score":0.00474,"date":"2026-10-12","percentile":0.39177}},{"id":"CVE-2026-108819","title":"CVE-2026-108819 — A security flaw has been discovered in agno-agi agno up to 3.0.6/3.1.1. This vulnerability affects the fu","summary":"A security flaw has been discovered in agno-agi agno up to 3.0.6/3.1.1. This vulnerability affects the function exec of the component Agent Orchestration Layer. Performing a manipulation of the argument code results in dynamically-managed code resources. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance.","source":"NVD","date":"2026-10-12T10:16:43.393Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108819","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108819"],"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108819"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108819"}],"epss":{"score":0.0054,"date":"2026-10-12","percentile":0.43766}},{"id":"https://cyberscoop.com/?p=91050","title":"Your AI agent is only as safe as the packages it downloads","source":"CyberScoop","date":"2026-10-12T10:00:00.000Z","summary":"NVIDIA's new agent safety platform puts enforcement in the right place.  It still must know what it is letting through.","url":"https://cyberscoop.com/ai-agent-software-supply-chain-security-op-ed/","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://cyberscoop.com/?p=91050"],"sources":["CyberScoop"],"topics":["Cyber news"],"affected":[],"references":[{"source":"CyberScoop","url":"https://cyberscoop.com/ai-agent-software-supply-chain-security-op-ed/"}],"epss":null},{"id":"CVE-2026-1907","title":"CVE-2026-1907 — A SQL Injection (SQLi) affects the Kong Gateway (Enterprise and Open Source) clustering communication log","summary":"A SQL Injection (SQLi) affects the Kong Gateway (Enterprise and Open Source) clustering communication logic when operating in Hybrid Mode. The issue can be triggered by sending specially crafted RPC requests to the Control Plane (CP), leading to potential unauthorized database access. Leveraging the issue requires network access to the Control Plane’s clustering port and a valid client certificate and key.","source":"NVD","date":"2026-10-12T09:16:43.683Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1907","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-1907"],"cvss":{"score":7.5,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb"},"read":false,"kev":false,"recordIds":["CVE-2026-1907"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1907"}],"epss":{"score":0.00131,"date":"2026-10-12","percentile":0.02323}},{"id":"CVE-2026-108818","title":"CVE-2026-108818 — A vulnerability was identified in agno-agi agno up to 2.7.3/3.0.6. This affects the function get_authenti","summary":"A vulnerability was identified in agno-agi agno up to 2.7.3/3.0.6. This affects the function get_authentication_dependency of the file auth.py. Such manipulation of the argument security_key leads to missing authentication. The attack may be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.","source":"NVD","date":"2026-10-12T09:16:43.473Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108818","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108818"],"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108818"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108818"}],"epss":{"score":0.00531,"date":"2026-10-12","percentile":0.43277}},{"id":"CVE-2026-108817","title":"CVE-2026-108817 — A vulnerability was determined in agno-agi agno up to 3.0.9. Affected by this issue is the function agno.","summary":"A vulnerability was determined in agno-agi agno up to 3.0.9. Affected by this issue is the function agno.CodingTools.run_shell in the library libs/agno/agno/tools/coding.py of the component CodingTools. This manipulation of the argument command causes os command injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.0.10 can resolve this issue. Patch name: ed64fab5be63d2b15faddc2ef7c733176daa14aa. You should upgrade the affected component.","source":"NVD","date":"2026-10-12T09:16:43.243Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108817","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108817"],"cvss":{"score":2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108817"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108817"}],"epss":{"score":0.01076,"date":"2026-10-12","percentile":0.64059}},{"id":"CVE-2026-108816","title":"CVE-2026-108816 — A vulnerability was found in agno-agi agno up to 3.0.6. Affected by this vulnerability is the function ru","summary":"A vulnerability was found in agno-agi agno up to 3.0.6. Affected by this vulnerability is the function run_python_code of the file python.py of the component PythonTools. The manipulation of the argument code results in code injection. The attack can be launched remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.","source":"NVD","date":"2026-10-12T09:16:43.037Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108816","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108816"],"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108816"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108816"}],"epss":{"score":0.00305,"date":"2026-10-12","percentile":0.21488}},{"id":"CVE-2026-108815","title":"CVE-2026-108815 — A vulnerability has been found in idcCMS 1.70. Affected is an unknown function of the file admin/member_d","summary":"A vulnerability has been found in idcCMS 1.70. Affected is an unknown function of the file admin/member_deal.php. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.","source":"NVD","date":"2026-10-12T09:16:42.847Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108815","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108815"],"cvss":{"score":2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108815"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108815"}],"epss":{"score":0.0024,"date":"2026-10-12","percentile":0.13938}},{"id":"CVE-2026-108168","title":"CVE-2026-108168 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DLX","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DLX Plugins Custom Query Blocks post-type-archive-mapping allows Stored XSS.This issue affects Custom Query Blocks: from n/a through 5.6.0.","source":"NVD","date":"2026-10-12T09:16:42.707Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108168","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108168"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108168"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108168"}],"epss":{"score":0.00161,"date":"2026-10-12","percentile":0.0471}},{"id":"CVE-2026-107869","title":"CVE-2026-107869 — Missing Authorization vulnerability in WP Desk Flexible Subscriptions flexible-subscriptions allows Explo","summary":"Missing Authorization vulnerability in WP Desk Flexible Subscriptions flexible-subscriptions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flexible Subscriptions: from n/a through 1.8.4.","source":"NVD","date":"2026-10-12T09:16:42.577Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107869","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107869"],"cvss":{"score":4.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107869"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107869"}],"epss":{"score":0.00185,"date":"2026-10-12","percentile":0.07455}},{"id":"CVE-2026-107866","title":"CVE-2026-107866 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cro","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.3.","source":"NVD","date":"2026-10-12T09:16:42.447Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107866","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107866"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107866"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107866"}],"epss":{"score":0.00161,"date":"2026-10-12","percentile":0.04708}},{"id":"CVE-2026-107865","title":"CVE-2026-107865 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cro","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetMenu jet-menu allows Stored XSS.This issue affects JetMenu: from n/a through 3.0.5.","source":"NVD","date":"2026-10-12T09:16:42.313Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107865","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107865"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107865"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107865"}],"epss":{"score":0.00161,"date":"2026-10-12","percentile":0.04708}},{"id":"CVE-2026-107864","title":"CVE-2026-107864 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igo","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Funa Ad Inserter ad-inserter allows Stored XSS.This issue affects Ad Inserter: from n/a through 2.8.18.","source":"NVD","date":"2026-10-12T09:16:42.183Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107864","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107864"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107864"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107864"}],"epss":{"score":0.00161,"date":"2026-10-12","percentile":0.04707}},{"id":"CVE-2026-107863","title":"CVE-2026-107863 — Missing Authorization vulnerability in Codection Products Restricted Users for WooCommerce woo-products-r","summary":"Missing Authorization vulnerability in Codection Products Restricted Users for WooCommerce woo-products-restricted-users allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Products Restricted Users for WooCommerce: from n/a through 0.7.","source":"NVD","date":"2026-10-12T09:16:42.050Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107863","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107863"],"cvss":{"score":5.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107863"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107863"}],"epss":{"score":0.00214,"date":"2026-10-12","percentile":0.10825}},{"id":"CVE-2026-107423","title":"CVE-2026-107423 — Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting ","summary":"Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Manager: from n/a through 2.9.22.","source":"NVD","date":"2026-10-12T09:16:41.917Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107423","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107423"],"cvss":{"score":4.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107423"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107423"}],"epss":{"score":0.00185,"date":"2026-10-12","percentile":0.07454}},{"id":"CVE-2026-104710","title":"CVE-2026-104710 — Rejected reason: Duplicate of CVE-2026-71364, which was publicly disclosed and fixed in Red Hat Ansible A","summary":"Rejected reason: Duplicate of CVE-2026-71364, which was publicly disclosed and fixed in Red Hat Ansible Automation Platform on 2026-08-24. No separate identifier is required.","source":"NVD","date":"2026-10-12T09:16:41.740Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104710","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-104710"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-104710"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104710"}],"epss":null},{"id":"CVE-2023-25996","title":"CVE-2023-25996 — Insertion of Sensitive Information Into Sent Data vulnerability in Pluggabl LLC. Booster Elite for WooCom","summary":"Insertion of Sensitive Information Into Sent Data vulnerability in Pluggabl LLC. Booster Elite for WooCommerce booster-elite-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Booster Elite for WooCommerce: from n/a before 8.4.0.","source":"NVD","date":"2026-10-12T09:16:41.257Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-25996","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2023-25996"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2023-25996"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-25996"}],"epss":{"score":0.0027,"date":"2026-10-12","percentile":0.1772}},{"id":"https://thehackernews.com/2026/10/attackers-exploit-cvss-100-bricksforge.html","title":"Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE","source":"The Hacker News","date":"2026-10-12T09:02:14.000Z","summary":"A maximum-severity security flaw impacting the Bricksforge plugin for WordPress has come under active exploitation in the wild, according to Patchstack.  0), which allows unauthenticated attackers to upload and execute arbitrary PHP code on vulnerable WordPress websites, resulting in remote code execution (RCE).","url":"https://thehackernews.com/2026/10/attackers-exploit-cvss-100-bricksforge.html","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://thehackernews.com/2026/10/attackers-exploit-cvss-100-bricksforge.html"],"sources":["The Hacker News"],"topics":["Cyber news"],"affected":[],"references":[{"source":"The Hacker News","url":"https://thehackernews.com/2026/10/attackers-exploit-cvss-100-bricksforge.html"}],"epss":null},{"id":"https://www.securityweek.com/?p=49933","title":"Critical SonicWall Vulnerability Exploited Days After Disclosure","source":"SecurityWeek","date":"2026-10-12T08:36:01.000Z","summary":"CVE-2026-102255 is a pre-authenticated SSRF flaw that could allow attackers to perform unauthorized operations.  The post Critical SonicWall Vulnerability Exploited Days After Disclosure appeared first on SecurityWeek .","url":"https://www.securityweek.com/critical-sonicwall-vulnerability-exploited-days-after-disclosure/","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://www.securityweek.com/?p=49933"],"sources":["SecurityWeek"],"topics":["Cyber news"],"affected":[],"references":[{"source":"SecurityWeek","url":"https://www.securityweek.com/critical-sonicwall-vulnerability-exploited-days-after-disclosure/"}],"epss":null},{"id":"CVE-2026-108814","title":"CVE-2026-108814 — A flaw has been found in SEMCMS up to 5.0. This impacts an unknown function of the file SEMCMS_Banner.php","summary":"A flaw has been found in SEMCMS up to 5.0. This impacts an unknown function of the file SEMCMS_Banner.php. Executing a manipulation can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-12T08:17:19.593Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108814","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108814"],"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108814"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108814"}],"epss":{"score":0.00192,"date":"2026-10-12","percentile":0.0819}},{"id":"CVE-2026-108813","title":"CVE-2026-108813 — A vulnerability was detected in SEMCMS up to 5.0. This affects an unknown function of the file SEMCMS_Dow","summary":"A vulnerability was detected in SEMCMS up to 5.0. This affects an unknown function of the file SEMCMS_Download.php. Performing a manipulation results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-12T08:17:19.380Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108813","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108813"],"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108813"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108813"}],"epss":{"score":0.00192,"date":"2026-10-12","percentile":0.0819}},{"id":"CVE-2026-108812","title":"CVE-2026-108812 — A security vulnerability has been detected in SEMCMS up to 5.0. The impacted element is an unknown functi","summary":"A security vulnerability has been detected in SEMCMS up to 5.0. The impacted element is an unknown function of the file /admin/SEMCMS_User.php?Class=Deleted&CF=user. Such manipulation leads to improper authorization. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-12T08:17:19.187Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108812","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108812"],"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108812"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108812"}],"epss":{"score":0.00307,"date":"2026-10-12","percentile":0.21737}},{"id":"CVE-2026-108811","title":"CVE-2026-108811 — A weakness has been identified in WMCMS 4.446.1257. The affected element is an unknown function of the fi","summary":"A weakness has been identified in WMCMS 4.446.1257. The affected element is an unknown function of the file /index.php. This manipulation of the argument path/file causes information disclosure. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.","source":"NVD","date":"2026-10-12T08:17:19.020Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108811","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108811"],"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108811"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108811"}],"epss":{"score":0.00203,"date":"2026-10-12","percentile":0.09471}},{"id":"CVE-2026-108810","title":"CVE-2026-108810 — A security flaw has been discovered in tsi-coop tsi-dpdp-cms 0.5.0/0.5.1/0.5.2. Impacted is an unknown fu","summary":"A security flaw has been discovered in tsi-coop tsi-dpdp-cms 0.5.0/0.5.1/0.5.2. Impacted is an unknown function of the component JSON Schema Validation. The manipulation of the argument _func results in information disclosure. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.5.3 is recommended to address this issue. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.","source":"NVD","date":"2026-10-12T08:17:18.837Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108810","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108810"],"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108810"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108810"}],"epss":{"score":0.00322,"date":"2026-10-12","percentile":0.2331}},{"id":"CVE-2026-107432","title":"CVE-2026-107432 — Missing Authorization vulnerability in NOUS Ouvert Utile et Simple Event post event-post allows Exploitin","summary":"Missing Authorization vulnerability in NOUS Ouvert Utile et Simple Event post event-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event post: from n/a through 6.1.1.","source":"NVD","date":"2026-10-12T08:17:18.703Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107432","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107432"],"cvss":{"score":5.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107432"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107432"}],"epss":{"score":0.00138,"date":"2026-10-12","percentile":0.02744}},{"id":"CVE-2026-107430","title":"CVE-2026-107430 — Missing Authorization vulnerability in VideoWhisper.com VideoWhisper Site Manager for ChatGPT, Claude, Co","summary":"Missing Authorization vulnerability in VideoWhisper.com VideoWhisper Site Manager for ChatGPT, Claude, Codex videowhisper-site-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VideoWhisper Site Manager for ChatGPT, Claude, Codex: from n/a through 1.2.10.","source":"NVD","date":"2026-10-12T08:17:18.577Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107430","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107430"],"cvss":{"score":5.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107430"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107430"}],"epss":{"score":0.00138,"date":"2026-10-12","percentile":0.02744}},{"id":"CVE-2026-107429","title":"CVE-2026-107429 — Improper Validation of Specified Quantity in Input vulnerability in VideoWhisper.com Paid Videochat Turnk","summary":"Improper Validation of Specified Quantity in Input vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Input Data Manipulation.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.12.","source":"NVD","date":"2026-10-12T08:17:18.447Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107429","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107429"],"cvss":{"score":4.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107429"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107429"}],"epss":{"score":0.00166,"date":"2026-10-12","percentile":0.05338}},{"id":"CVE-2026-107427","title":"CVE-2026-107427 — Authorization Bypass Through User-Controlled Key vulnerability in NOUS Ouvert Utile et Simple Event post ","summary":"Authorization Bypass Through User-Controlled Key vulnerability in NOUS Ouvert Utile et Simple Event post event-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event post: from n/a through 6.1.1.","source":"NVD","date":"2026-10-12T08:17:18.317Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107427","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107427"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107427"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107427"}],"epss":{"score":0.00195,"date":"2026-10-12","percentile":0.08443}},{"id":"CVE-2026-106605","title":"CVE-2026-106605 — Improper Validation of Specified Quantity in Input vulnerability in WP Desk Flexible Quantity – Measureme","summary":"Improper Validation of Specified Quantity in Input vulnerability in WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce allows Input Data Manipulation.This issue affects Flexible Quantity – Measurement Price Calculator for WooCommerce: from n/a through 2.3.22.","source":"NVD","date":"2026-10-12T08:17:18.180Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106605","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-106605"],"cvss":{"score":5.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-106605"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106605"}],"epss":{"score":0.00186,"date":"2026-10-12","percentile":0.07512}},{"id":"CVE-2026-103356","title":"CVE-2026-103356 — Missing Authorization vulnerability in VillaTheme TMDS tmds-dropshipping-for-temu-and-woo allows Exploiti","summary":"Missing Authorization vulnerability in VillaTheme TMDS tmds-dropshipping-for-temu-and-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TMDS: from n/a through 1.0.15.","source":"NVD","date":"2026-10-12T08:17:18.023Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103356","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-103356"],"cvss":{"score":5.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-103356"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103356"}],"epss":{"score":0.0017,"date":"2026-10-12","percentile":0.05769}},{"id":"https://www.securityweek.com/?p=49930","title":"Let’s Encrypt Cuts Default Certificate Validity to 64 Days Ahead of 45-Day Switch","source":"SecurityWeek","date":"2026-10-12T07:53:28.000Z","summary":"Beginning February 2027, all newly issued certificates will have a 64-day validity period by default.  The post Let’s Encrypt Cuts Default Certificate Validity to 64 Days Ahead of 45-Day Switch appeared first on SecurityWeek .","url":"https://www.securityweek.com/lets-encrypt-cuts-default-certificate-validity-to-64-days-ahead-of-45-day-switch/","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://www.securityweek.com/?p=49930"],"sources":["SecurityWeek"],"topics":["Cyber news"],"affected":[],"references":[{"source":"SecurityWeek","url":"https://www.securityweek.com/lets-encrypt-cuts-default-certificate-validity-to-64-days-ahead-of-45-day-switch/"}],"epss":null},{"id":"https://thehackernews.com/2026/10/cyberxero-uses-claude-code-in-campaign.html","title":"CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records","source":"The Hacker News","date":"2026-10-12T07:26:12.000Z","summary":"Cybersecurity researchers have disclosed details of a two-pronged artificial intelligence (AI)-augmented initial access campaign targeting WordPress sites, e-commerce platforms, and critical infrastructure entities in Ukraine.  The activity, which brings together commodity offensive tools like Cobalt Strike with an AI orchestration layer powered by Anthropic's Claude Code, has been attributed","url":"https://thehackernews.com/2026/10/cyberxero-uses-claude-code-in-campaign.html","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://thehackernews.com/2026/10/cyberxero-uses-claude-code-in-campaign.html"],"sources":["The Hacker News"],"topics":["Cyber news"],"affected":[],"references":[{"source":"The Hacker News","url":"https://thehackernews.com/2026/10/cyberxero-uses-claude-code-in-campaign.html"}],"epss":null},{"id":"CVE-2026-93582","title":"CVE-2026-93582 — The HTTP Basic Authentication modules in ((OTRS)) Community Edition 6 and prior accept the authenticated ","summary":"The HTTP Basic Authentication modules in ((OTRS)) Community Edition 6 and prior accept the authenticated username from either the REMOTE_USER or HTTP_REMOTE_USER environment variable. In CGI and mod_perl based deployments, HTTP request headers may be mapped to corresponding HTTP_* environment variables. As a result, an unauthenticated remote attacker can supply a crafted Remote-User request header which is exposed to the application as HTTP_REMOTE_USER. When HTTP Basic Authentication is configured as the authentication backend, OTRS trusts this value as an already authenticated username and does not perform an additional password verification. An attacker may therefore authenticate through the Generic Interface as an existing agent or customer user without knowing the corresponding credentials.\n\nThe resulting privileges depend on the acco","source":"NVD","date":"2026-10-12T07:16:37.717Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93582","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-93582"],"cvss":{"score":9.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","source":"security@otrs.com"},"read":false,"kev":false,"recordIds":["CVE-2026-93582"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93582"}],"epss":{"score":0.00392,"date":"2026-10-12","percentile":0.31323}},{"id":"CVE-2026-93581","title":"CVE-2026-93581 — User-controlled values are not sufficiently neutralized when included in CSV exports. Values originating ","summary":"User-controlled values are not sufficiently neutralized when included in CSV exports. Values originating from user input, including data submitted by authenticated users or received through external communication channels such as email, may be stored in fields that are later included in CSV exports. An attacker can therefore inject values beginning with spreadsheet formula characters such as =, +, -, or @. An attacker does not necessarily require an authenticated account if the affected field can be populated through an external input channel such as incoming email.\n\nWhen an affected CSV file is opened in spreadsheet software, the application may interpret these values as formulas instead of plain text. Depending on the spreadsheet application and its security configuration, a malicious formula may cause unintended actions, disclose infor","source":"NVD","date":"2026-10-12T07:16:37.570Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93581","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-93581"],"cvss":{"score":6.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","source":"security@otrs.com"},"read":false,"kev":false,"recordIds":["CVE-2026-93581"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93581"}],"epss":{"score":0.00189,"date":"2026-10-12","percentile":0.07809}},{"id":"CVE-2026-78359","title":"CVE-2026-78359 — OTRS does not sufficiently enforce the uniqueness of customer user identities across multiple configured ","summary":"OTRS does not sufficiently enforce the uniqueness of customer user identities across multiple configured CustomerUser backends. When multiple backends, such as a database and LDAP, are configured, the uniqueness check for customer user email addresses is performed only within the selected backend. As a result, an authenticated user with permission to create or modify customer users may create a customer user whose email address is already assigned to a customer user in another backend.\n\nThis can result in multiple customer user records representing the same communication identity. Depending on the affected workflow and backend resolution, customer-related information or email communication may subsequently be associated with or exposed to the wrong customer user.\n\nThe vulnerability does not allow unauthenticated users to create customer a","source":"NVD","date":"2026-10-12T07:16:37.423Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78359","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-78359"],"cvss":{"score":5.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","source":"security@otrs.com"},"read":false,"kev":false,"recordIds":["CVE-2026-78359"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78359"}],"epss":{"score":0.00163,"date":"2026-10-12","percentile":0.05084}},{"id":"CVE-2026-78358","title":"CVE-2026-78358 — Several administrative actions do not sufficiently validate whether a request was intentionally initiated","summary":"Several administrative actions do not sufficiently validate whether a request was intentionally initiated by the authenticated user. In particular, the DBUpdateLogCleanUp action can be triggered through a GET request without validating a ChallengeToken. An unauthenticated remote attacker can therefore cause the browser of an authenticated administrator to execute the cleanup action by embedding a crafted request in a malicious web page. Successful exploitation can delete existing DBUpdate log entries. This may reduce the availability of diagnostic and historical information used for troubleshooting and auditing. The impact is limited to DBUpdate log entries that exist at the time the forged request is processed.\n\nAdditional administrative endpoints were identified that do not validate a ChallengeToken. Some of these endpoints can trigger ","source":"NVD","date":"2026-10-12T07:16:37.277Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78358","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-78358"],"cvss":{"score":4.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","source":"security@otrs.com"},"read":false,"kev":false,"recordIds":["CVE-2026-78358"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78358"}],"epss":{"score":0.00139,"date":"2026-10-12","percentile":0.02801}},{"id":"CVE-2026-78357","title":"CVE-2026-78357 — Previously issued authentication tokens are not immediately invalidated when an OTRS agent or customer us","summary":"Previously issued authentication tokens are not immediately invalidated when an OTRS agent or customer user account is deactivated or its password is changed. As a result, an existing JWT may remain valid until its regular expiration time, which can be approximately 16 hours.\n\nAn attacker who has previously obtained a valid authentication token can therefore continue to access OTRS with the privileges of the affected agent or customer user even after the corresponding account has been deactivated or the user's password has been changed.\n\nThe vulnerability does not allow an attacker to obtain authentication tokens by itself. Exploitation requires possession of a previously issued and still valid token. The actual impact depends on the privileges associated with the compromised token. Customer user tokens are limited to the permissions of t","source":"NVD","date":"2026-10-12T07:16:37.073Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78357","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-78357"],"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","source":"security@otrs.com"},"read":false,"kev":false,"recordIds":["CVE-2026-78357"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78357"}],"epss":{"score":0.00304,"date":"2026-10-12","percentile":0.21413}},{"id":"CVE-2026-78356","title":"CVE-2026-78356 — The OTRS Agent Frontend configuration endpoint can be accessed without authentication. This allows unauth","summary":"The OTRS Agent Frontend configuration endpoint can be accessed without authentication. This allows unauthenticated remote users to retrieve internal application configuration that is intended for use by the authenticated Agent Frontend. The exposed information may include configured frontend routes and their associated authorization groups, authentication configuration, enabled product features, third-party integration settings, and other implementation details.\n\nThe exposed configuration does not directly contain user credentials or provide unauthorized modification of the OTRS configuration. However, the disclosed information may assist an attacker in fingerprinting the affected OTRS installation and identifying enabled functionality or security-relevant configuration that could be used to prepare further attacks.\n\nThis issue affects OT","source":"NVD","date":"2026-10-12T07:16:36.890Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78356","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-78356"],"cvss":{"score":5.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","source":"security@otrs.com"},"read":false,"kev":false,"recordIds":["CVE-2026-78356"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78356"}],"epss":{"score":0.00283,"date":"2026-10-12","percentile":0.19197}},{"id":"CVE-2026-78355","title":"CVE-2026-78355 — A path traversal vulnerability in the OTRS SendSupportBundle functionality allows an authenticated admini","summary":"A path traversal vulnerability in the OTRS SendSupportBundle functionality allows an authenticated administrator to reference file paths outside the intended directory.\n\nThis may allow files accessible to the OTRS application process to be deleted. The vulnerability does not bypass operating system file permissions. On OTRS versions prior to OTRS 7, the effective permissions of the web server process are relevant. Starting with OTRS 7, access is limited by the permissions of the dedicated OTRS user. Files with overly permissive ownership or file system permissions may therefore also be affected.\n\nThe affected functionality may additionally attempt to include controlled files in a support bundle. However, support bundles are sent to a predefined OTRS support address, and direct disclosure of arbitrary files to the attacker has not been dem","source":"NVD","date":"2026-10-12T07:16:36.740Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78355","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-78355"],"cvss":{"score":8.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H","source":"security@otrs.com"},"read":false,"kev":false,"recordIds":["CVE-2026-78355"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78355"}],"epss":{"score":0.00722,"date":"2026-10-12","percentile":0.52691}},{"id":"CVE-2026-48212","title":"CVE-2026-48212 — An OTRS administrator can enter arbitrary JavaScript into the content of an OTRS Custom Page, which is st","summary":"An OTRS administrator can enter arbitrary JavaScript into the content of an OTRS Custom Page, which is stored by the application and subsequently executed in the browser of users accessing that page.\n\nThis issue affects OTRS:\n\n  *  7.0.X\n  *  8.0.X\n  *  2023.X\n  *  2024.X\n  *  2025.X\n  *  2026.X before 2026.7.X","source":"NVD","date":"2026-10-12T07:16:36.610Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48212","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-48212"],"cvss":{"score":4.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","source":"security@otrs.com"},"read":false,"kev":false,"recordIds":["CVE-2026-48212"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48212"}],"epss":{"score":0.00142,"date":"2026-10-12","percentile":0.03077}},{"id":"CVE-2026-48211","title":"CVE-2026-48211 — An authenticated administrator can be induced to delete administrative Import/Export templates through a ","summary":"An authenticated administrator can be induced to delete administrative Import/Export templates through a Cross-Site Request Forgery (CSRF) attack. The OTRS AdminImportExport::TemplateDelete action does not validate the request's ChallengeToken, allowing an unauthenticated remote attacker to craft a malicious request that is executed with the privileges of an active administrator session.\n\nThis issue affects OTRS:\n\n  *  7.0.X\n  *  8.0.X\n  *  2023.X\n  *  2024.X\n  *  2025.X\n  *  2026.X before 2026.7.X\n\nPlease note that ((OTRS)) Community Edition 6.x and before are vulnerable. Products based on the ((OTRS)) Community Edition also very likely to be affected","source":"NVD","date":"2026-10-12T07:16:36.453Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48211","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-48211"],"cvss":{"score":5.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","source":"security@otrs.com"},"read":false,"kev":false,"recordIds":["CVE-2026-48211"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48211"}],"epss":{"score":0.00117,"date":"2026-10-12","percentile":0.01547}},{"id":"CVE-2026-109082","title":"CVE-2026-109082 — A flaw was found in the Client-Initiated Backchannel Authentication CIBA implementation within the keyclo","summary":"A flaw was found in the Client-Initiated Backchannel Authentication CIBA implementation within the keycloak-services component of Keycloak. This component handles advanced authentication flows where a client initiates a login on behalf of a user. The issue occurs because Keycloak fails to verify that a client is authorized to use the CIBA flow, allowing public clients to bypass security requirements. An attacker could use this flaw to trick a user into approving a login request, eventually gaining full access to the users account without needing a client secret.","source":"NVD","date":"2026-10-12T07:16:36.303Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109082","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109082"],"cvss":{"score":6.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","source":"secalert@redhat.com"},"read":false,"kev":false,"recordIds":["CVE-2026-109082"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109082"}],"epss":{"score":0.00248,"date":"2026-10-12","percentile":0.14809}},{"id":"CVE-2026-108809","title":"CVE-2026-108809 — A vulnerability was identified in Eleveo Call Recording Software up to 10.3.0. This issue affects some un","summary":"A vulnerability was identified in Eleveo Call Recording Software up to 10.3.0. This issue affects some unknown processing of the file /auth/realms/default/protocol/openid-connect/logout. The manipulation leads to session expiration. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-12T07:16:36.127Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108809","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108809"],"cvss":{"score":2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108809"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108809"}],"epss":{"score":0.0018,"date":"2026-10-12","percentile":0.06933}},{"id":"CVE-2026-108808","title":"CVE-2026-108808 — A vulnerability was determined in Eleveo Call Recording Software up to 10.3.0. This vulnerability affects","summary":"A vulnerability was determined in Eleveo Call Recording Software up to 10.3.0. This vulnerability affects unknown code of the file /auth/realms/default/protocol/openid-connect/logout of the component JWT Token Handler. Executing a manipulation of the argument id_token_hint can lead to use of get request method with sensitive query strings. The attack may be launched remotely. A high complexity level is associated with this attack. It is stated that the exploitability is difficult. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-12T07:16:35.913Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108808","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108808"],"cvss":{"score":1.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108808"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108808"}],"epss":{"score":0.00184,"date":"2026-10-12","percentile":0.07309}},{"id":"CVE-2026-108807","title":"CVE-2026-108807 — A vulnerability was found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356","summary":"A vulnerability was found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. This affects the function mysql_query of the file source/adminregister.php of the component Registration Handler. Performing a manipulation results in sql injection. The attack may be initiated remotely. The exploit has been made public and could be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.","source":"NVD","date":"2026-10-12T07:16:35.707Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108807","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108807"],"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108807"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108807"}],"epss":{"score":0.00254,"date":"2026-10-12","percentile":0.15619}},{"id":"CVE-2026-98385","title":"CVE-2026-98385 — In the Linux kernel, the following vulnerability has been resolved:\n\nsched/cache: Decouple sched_cache_gr","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nsched/cache: Decouple sched_cache_group from mm to fix UAF\n\nCurrently the sched cache grouping is by mm and the scheduling statistics\nsched_cache_stat lives in the mm structure.  This ties the life cycle\nof scheduling stats with mm.\n\nIn account_mm_sched(), the scheduling stats are accessed by\ntask->mm->sc_stat.  However, a task may be switching mm on one CPU when\nanother CPU is running account_mm_sched(), and possibly accessing the\nold mm that was freed.  This problem was found when running tests with\nKASAN by Hyunwoo:\n\n  https://lore.kernel.org/lkml/apPb-Dr4nPYuHQOK@v4bel/\n\nInstead of serializing the mm access by introducing extra acquisition of\nrq lock in the mm free path, extract sched_cache_stat from mm_struct,\nrename it as sched_cache_group and manage its life cycle","source":"NVD","date":"2026-10-12T06:17:00.547Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98385","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-98385"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-98385"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98385"}],"epss":{"score":0.00145,"date":"2026-10-12","percentile":0.03266}},{"id":"CVE-2026-84167","title":"CVE-2026-84167 — The Hotel Booking WordPress plugin through 3.8 does not verify that a booking record belongs to the user ","summary":"The Hotel Booking WordPress plugin through 3.8 does not verify that a booking record belongs to the user requesting it, allowing any authenticated user such as a Subscriber to read other customers' booking details, including their name, email address, phone number and postal address, by referencing an identifier they do not own.","source":"NVD","date":"2026-10-12T06:17:00.420Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84167","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-84167"],"cvss":{"score":4.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-84167"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84167"}],"epss":{"score":0.00144,"date":"2026-10-12","percentile":0.0322}},{"id":"CVE-2026-84166","title":"CVE-2026-84166 — The Hotel Booking WordPress plugin through 3.8 does not implement CSRF protection on its administrative b","summary":"The Hotel Booking WordPress plugin through 3.8 does not implement CSRF protection on its administrative booking order management, allowing attackers to trick a logged-in administrator into creating, deleting, or modifying arbitrary booking order records via a forged request.","source":"NVD","date":"2026-10-12T06:17:00.300Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84166","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-84166"],"cvss":{"score":4.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-84166"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84166"}],"epss":{"score":0.00106,"date":"2026-10-12","percentile":0.01036}},{"id":"CVE-2026-109080","title":"CVE-2026-109080 — SQL injection in the bulk license plate search of the Flock Night Shift hosted service allowed an authent","summary":"SQL injection in the bulk license plate search of the Flock Night Shift hosted service allowed an authenticated user to read other customer organizations' data, including license plate recognition records, via a crafted license plate value. Data could not be modified. Flock identified the issue through internal security review and remediated it on 2026-08-12; no customer action is required.","source":"NVD","date":"2026-10-12T06:17:00.103Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109080","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-109080"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"12dd0b25-a5e8-4486-84b1-59c4a6ebd552"},"read":false,"kev":false,"recordIds":["CVE-2026-109080"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109080"}],"epss":{"score":0.00215,"date":"2026-10-12","percentile":0.11014}},{"id":"CVE-2026-108806","title":"CVE-2026-108806 — A vulnerability has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9","summary":"A vulnerability has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this issue is the function mysql_query of the file source/authprocessing.php of the component Forgot Password Handler. Such manipulation of the argument fpemail leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.","source":"NVD","date":"2026-10-12T06:16:59.877Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108806","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108806"],"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108806"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108806"}],"epss":{"score":0.00254,"date":"2026-10-12","percentile":0.15622}},{"id":"CVE-2026-108805","title":"CVE-2026-108805 — A flaw has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec","summary":"A flaw has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this vulnerability is the function mysql_query of the file source/loginprocessing.php of the component Login Handler. This manipulation of the argument email/password causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.","source":"NVD","date":"2026-10-12T06:16:59.687Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108805","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108805"],"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108805"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108805"}],"epss":{"score":0.00254,"date":"2026-10-12","percentile":0.15619}},{"id":"CVE-2026-108804","title":"CVE-2026-108804 — A vulnerability was detected in TRENDnet TEW-751DR, TEW-752DRU and TEW733GR 1.03B01/1.03B03. Affected is ","summary":"A vulnerability was detected in TRENDnet TEW-751DR, TEW-752DRU and TEW733GR 1.03B01/1.03B03. Affected is the function fwrite of the file pigwidgeon.cgi of the component Web Management Backend. The manipulation of the argument service results in os command injection. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor confirms: \"As this router was EOL'd in 2011, we have no way of testing if such vulnerability exists. We will notify our customers of a potential vulnerability on this product.\" This vulnerability only affects products that are no longer supported by the maintainer.","source":"NVD","date":"2026-10-12T06:16:59.457Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108804","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108804"],"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108804"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108804"}],"epss":{"score":0.02388,"date":"2026-10-12","percentile":0.8349}},{"id":"CVE-2026-108803","title":"CVE-2026-108803 — A security vulnerability has been detected in y_project RuoYi up to 4.8.3. This impacts the function chan","summary":"A security vulnerability has been detected in y_project RuoYi up to 4.8.3. This impacts the function changeStatus of the file /system/config/add of the component Disable API. The manipulation leads to session expiration. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-12T06:16:59.223Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108803","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108803"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108803"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108803"}],"epss":{"score":0.00201,"date":"2026-10-12","percentile":0.0923}},{"id":"CVE-2026-108802","title":"CVE-2026-108802 — A weakness has been identified in y_project RuoYi up to 4.8.3. This affects the function renderDrawer of ","summary":"A weakness has been identified in y_project RuoYi up to 4.8.3. This affects the function renderDrawer of the file /system/dict/data/add of the component Dictionary Data Drawer Preview. Executing a manipulation of the argument cssClass can lead to cross site scripting. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-12T06:16:58.937Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108802","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108802"],"cvss":{"score":2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108802"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108802"}],"epss":{"score":0.00199,"date":"2026-10-12","percentile":0.089}},{"id":"CVE-2026-107791","title":"CVE-2026-107791 — The WP Comment Cleaner  WordPress plugin before 7.2 does not perform a capability check or validate a non","summary":"The WP Comment Cleaner  WordPress plugin before 7.2 does not perform a capability check or validate a nonce on one of its bulk comment-deletion routines, allowing authenticated users with minimal permissions, such as subscribers, to permanently delete all comments on the site.","source":"NVD","date":"2026-10-12T06:16:58.820Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107791","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107791"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-107791"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107791"}],"epss":{"score":0.00144,"date":"2026-10-12","percentile":0.0322}},{"id":"CVE-2026-107203","title":"CVE-2026-107203 — An **incorrect authorization** flaw has been found in **network interface handling** in the **Foreman** p","summary":"An **incorrect authorization** flaw has been found in **network interface handling** in the **Foreman** package. The domain and subnet interface API checks only that the caller holds a host permission. It does not apply the search limit on that permission, so the request is answered from every interface on the domain or subnet. A low-privileged network attacker or user must already be allowed to view some hosts and to view a domain or subnet shared with other hosts. They can request that domain or subnet's interfaces. The response includes interface records of hosts they are not allowed to view. If the attacker or user is also allowed to edit some hosts, they can submit a change to one of those interfaces. The interface is then saved with that change.","source":"NVD","date":"2026-10-12T06:16:58.667Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107203","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107203"],"cvss":{"score":5.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","source":"secalert@redhat.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107203"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107203"}],"epss":{"score":0.00151,"date":"2026-10-12","percentile":0.03787}},{"id":"CVE-2026-107193","title":"CVE-2026-107193 — A flaw has been found in **permission filters** in the **foreman** package. The API loads a filter by its","summary":"A flaw has been found in **permission filters** in the **foreman** package. The API loads a filter by its identifier and does not apply the search limit on the caller's permission. A low-privileged network attacker or user must already be allowed to delete filters for one role only. They can delete filters that belong to other unlocked roles. Those other roles then lose the access the deleted filters had granted.","source":"NVD","date":"2026-10-12T06:16:58.463Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107193","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107193"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","source":"secalert@redhat.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107193"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107193"}],"epss":{"score":0.00181,"date":"2026-10-12","percentile":0.07091}},{"id":"CVE-2025-15703","title":"CVE-2025-15703 — The HireZoot  WordPress plugin before 4.0.0 does not sanitise and escape one of its job specification set","summary":"The HireZoot  WordPress plugin before 4.0.0 does not sanitise and escape one of its job specification settings before it is reflected back into an admin-area settings page, allowing users with the HireZoot  WordPress plugin before 4.0.0's management capability (Administrator by default) to store a payload that is executed in the browser of any administrator who later opens that page. As the unfiltered_html capability is not available to administrators on multisite (or where DISALLOW_UNFILTERED_HTML is set), this leads to Stored Cross-Site Scripting.","source":"NVD","date":"2026-10-12T06:16:58.173Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15703","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2025-15703"],"cvss":{"score":3.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2025-15703"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15703"}],"epss":{"score":0.00166,"date":"2026-10-12","percentile":0.05394}},{"id":"CVE-2026-87690","title":"CVE-2026-87690 — The Metasploit Framework post module post/apple_ios/gather/ios_image_gather is affected by a relative pat","summary":"The Metasploit Framework post module post/apple_ios/gather/ios_image_gather is affected by a relative path traversal vulnerability (CWE-22). The module interpolates file names taken from a Meterpreter directory listing — data fully controlled by a hostile or tampered iOS device — directly into the local destination path passed to client.fs.file.download_file(), with no sanitization. The underlying stdapi sink (lib/rex/post/meterpreter/extensions/stdapi/fs/file.rb) writes to whatever path is supplied, so a listing entry such as ../../msfconsole.rc escapes the intended ~/.msf4/loot/<random> directory and overwrites ~/.msf4/msfconsole.rc, a resource file that every msfconsole invocation automatically executes at startup (lib/msf/ui/console/driver.rb:196). An attacker-controlled device that lures an operator into running this gather module ac","source":"NVD","date":"2026-10-12T05:17:03.250Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87690","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-87690"],"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"cve@rapid7.com"},"read":false,"kev":false,"recordIds":["CVE-2026-87690"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87690"}],"epss":{"score":0.00411,"date":"2026-10-12","percentile":0.33462}},{"id":"CVE-2026-21139","title":"CVE-2026-21139 — Improper access control in Samsung Continuity Service for windows prior to version 4.6.1217.0 allows adja","summary":"Improper access control in Samsung Continuity Service for windows prior to version 4.6.1217.0 allows adjacent attackers to manipulate the connected mobile device.","source":"NVD","date":"2026-10-12T05:17:02.750Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21139","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-21139"],"cvss":{"score":7.3,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"mobile.security@samsung.com"},"read":false,"kev":false,"recordIds":["CVE-2026-21139"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21139"}],"epss":{"score":0.0012,"date":"2026-10-12","percentile":0.01705}},{"id":"CVE-2026-21138","title":"CVE-2026-21138 — Insufficient verification of data authenticity in Smart Switch prior to version 3.7.73 allows physical at","summary":"Insufficient verification of data authenticity in Smart Switch prior to version 3.7.73 allows physical attackers to install arbitrary applications.","source":"NVD","date":"2026-10-12T05:17:02.630Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21138","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-21138"],"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"mobile.security@samsung.com"},"read":false,"kev":false,"recordIds":["CVE-2026-21138"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21138"}],"epss":{"score":0.00099,"date":"2026-10-12","percentile":0.00772}},{"id":"CVE-2026-21137","title":"CVE-2026-21137 — Path traversal in Smart Switch prior to version 3.7.73 allows physical attackers to access files with Sma","summary":"Path traversal in Smart Switch prior to version 3.7.73 allows physical attackers to access files with Smart Switch privilege.","source":"NVD","date":"2026-10-12T05:17:02.507Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21137","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-21137"],"cvss":{"score":5.1,"version":"4.0","vector":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"mobile.security@samsung.com"},"read":false,"kev":false,"recordIds":["CVE-2026-21137"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21137"}],"epss":{"score":0.00174,"date":"2026-10-12","percentile":0.06294}},{"id":"CVE-2026-21136","title":"CVE-2026-21136 — Improper authorization in Smart Switch prior to version 3.7.73 allows physical attackers to invoke applic","summary":"Improper authorization in Smart Switch prior to version 3.7.73 allows physical attackers to invoke application restore process.","source":"NVD","date":"2026-10-12T05:17:02.393Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21136","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-21136"],"cvss":{"score":6.8,"version":"4.0","vector":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"mobile.security@samsung.com"},"read":false,"kev":false,"recordIds":["CVE-2026-21136"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21136"}],"epss":{"score":0.00136,"date":"2026-10-12","percentile":0.02646}},{"id":"CVE-2026-21135","title":"CVE-2026-21135 — Improper access control in Samsung Internet prior to version 30.0.5.6 allows local attackers to access se","summary":"Improper access control in Samsung Internet prior to version 30.0.5.6 allows local attackers to access sensitive information.","source":"NVD","date":"2026-10-12T05:17:02.280Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21135","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-21135"],"cvss":{"score":5.9,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"mobile.security@samsung.com"},"read":false,"kev":false,"recordIds":["CVE-2026-21135"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21135"}],"epss":{"score":0.00105,"date":"2026-10-12","percentile":0.01002}},{"id":"CVE-2026-21134","title":"CVE-2026-21134 — Improper authentication in Samsung Flow prior to version 4.9.22.4 allows adjacent attackers to access sen","summary":"Improper authentication in Samsung Flow prior to version 4.9.22.4 allows adjacent attackers to access sensitive information.","source":"NVD","date":"2026-10-12T05:17:02.163Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21134","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-21134"],"cvss":{"score":6.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"mobile.security@samsung.com"},"read":false,"kev":false,"recordIds":["CVE-2026-21134"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21134"}],"epss":{"score":0.00188,"date":"2026-10-12","percentile":0.07735}},{"id":"CVE-2026-21133","title":"CVE-2026-21133 — Path traversal in Samsung Flow prior to version 4.9.22.1 allows local attackers to access clipboard data.","summary":"Path traversal in Samsung Flow prior to version 4.9.22.1 allows local attackers to access clipboard data.","source":"NVD","date":"2026-10-12T05:17:02.050Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21133","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-21133"],"cvss":{"score":5.1,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"mobile.security@samsung.com"},"read":false,"kev":false,"recordIds":["CVE-2026-21133"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21133"}],"epss":{"score":0.00137,"date":"2026-10-12","percentile":0.0266}},{"id":"CVE-2026-21132","title":"CVE-2026-21132 — Improper input validation in Samsung Internet prior to version 30.0.5.24 allows remote attackers to injec","summary":"Improper input validation in Samsung Internet prior to version 30.0.5.24 allows remote attackers to inject arbitrary script. User interaction is required for triggering this vulnerability.","source":"NVD","date":"2026-10-12T05:17:01.933Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21132","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-21132"],"cvss":{"score":6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"mobile.security@samsung.com"},"read":false,"kev":false,"recordIds":["CVE-2026-21132"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21132"}],"epss":{"score":0.00521,"date":"2026-10-12","percentile":0.42571}},{"id":"CVE-2026-21131","title":"CVE-2026-21131 — Incorrect default permission in Samsung Flow prior to version 4.9.22.4 allows local attackers to launch a","summary":"Incorrect default permission in Samsung Flow prior to version 4.9.22.4 allows local attackers to launch an arbitrary activity with Samsung Flow privileges on the connected device.","source":"NVD","date":"2026-10-12T05:17:01.783Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21131","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-21131"],"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"mobile.security@samsung.com"},"read":false,"kev":false,"recordIds":["CVE-2026-21131"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21131"}],"epss":{"score":0.00105,"date":"2026-10-12","percentile":0.01002}},{"id":"CVE-2026-21130","title":"CVE-2026-21130 — Improper input validation in CreditCardRetrieveActivity of Samsung Checkout prior to version 5.1.03.1 all","summary":"Improper input validation in CreditCardRetrieveActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch an arbitrary activity with Samsung Checkout privileges.","source":"NVD","date":"2026-10-12T05:17:01.667Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21130","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-21130"],"cvss":{"score":5.1,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"mobile.security@samsung.com"},"read":false,"kev":false,"recordIds":["CVE-2026-21130"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21130"}],"epss":{"score":0.00111,"date":"2026-10-12","percentile":0.01235}},{"id":"CVE-2026-21129","title":"CVE-2026-21129 — Improper input validation in GuestCreditCardRegisterActivity of Samsung Checkout prior to version 5.1.03.","summary":"Improper input validation in GuestCreditCardRegisterActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch an arbitrary activity with Samsung Checkout privileges.","source":"NVD","date":"2026-10-12T05:17:01.557Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21129","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-21129"],"cvss":{"score":5.1,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"mobile.security@samsung.com"},"read":false,"kev":false,"recordIds":["CVE-2026-21129"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21129"}],"epss":{"score":0.00111,"date":"2026-10-12","percentile":0.01235}},{"id":"CVE-2026-21128","title":"CVE-2026-21128 — Improper input validation in CreditCardRegisterActivity of Samsung Checkout prior to version 5.1.03.1 all","summary":"Improper input validation in CreditCardRegisterActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch arbitrary activity with Samsung Checkout privileges.","source":"NVD","date":"2026-10-12T05:17:01.440Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21128","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-21128"],"cvss":{"score":5.1,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"mobile.security@samsung.com"},"read":false,"kev":false,"recordIds":["CVE-2026-21128"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21128"}],"epss":{"score":0.00119,"date":"2026-10-12","percentile":0.01627}},{"id":"CVE-2026-21127","title":"CVE-2026-21127 — Improper export of android application components in Samsung Account prior to version 15.7.01.1 allows lo","summary":"Improper export of android application components in Samsung Account prior to version 15.7.01.1 allows local attackers to access sensitive data.","source":"NVD","date":"2026-10-12T05:17:01.323Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21127","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-21127"],"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"mobile.security@samsung.com"},"read":false,"kev":false,"recordIds":["CVE-2026-21127"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21127"}],"epss":{"score":0.00113,"date":"2026-10-12","percentile":0.01322}},{"id":"CVE-2026-21126","title":"CVE-2026-21126 — Improper input validation in getting cover image in libsimba.heifdec.media.samsung.so prior to SMR Oct-20","summary":"Improper input validation in getting cover image in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to write out-of-bounds memory.","source":"NVD","date":"2026-10-12T05:17:01.203Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21126","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-21126"],"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"mobile.security@samsung.com"},"read":false,"kev":false,"recordIds":["CVE-2026-21126"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21126"}],"epss":{"score":0.00159,"date":"2026-10-12","percentile":0.04461}},{"id":"CVE-2026-21125","title":"CVE-2026-21125 — Improper input validation in parsing sheifd in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Re","summary":"Improper input validation in parsing sheifd in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to potentially execute arbitrary code.","source":"NVD","date":"2026-10-12T05:17:01.093Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21125","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-21125"],"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"mobile.security@samsung.com"},"read":false,"kev":false,"recordIds":["CVE-2026-21125"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21125"}],"epss":{"score":0.00174,"date":"2026-10-12","percentile":0.06301}},{"id":"CVE-2026-21124","title":"CVE-2026-21124 — Improper input validation in getting cover image in libsimba.heifdec.media.samsung.so prior to SMR Oct-20","summary":"Improper input validation in getting cover image in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to potentially execute arbitrary code.","source":"NVD","date":"2026-10-12T05:17:00.977Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21124","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-21124"],"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"mobile.security@samsung.com"},"read":false,"kev":false,"recordIds":["CVE-2026-21124"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21124"}],"epss":{"score":0.00174,"date":"2026-10-12","percentile":0.063}},{"id":"CVE-2026-21123","title":"CVE-2026-21123 — Improper privilege management in Locksettings prior to SMR Oct-2026 Release 1 allows local privileged att","summary":"Improper privilege management in Locksettings prior to SMR Oct-2026 Release 1 allows local privileged attackers with root privilege to access data of the tied profile in before first unlock.","source":"NVD","date":"2026-10-12T05:17:00.867Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21123","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-21123"],"cvss":{"score":6.7,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"mobile.security@samsung.com"},"read":false,"kev":false,"recordIds":["CVE-2026-21123"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21123"}],"epss":{"score":0.00144,"date":"2026-10-12","percentile":0.0321}},{"id":"CVE-2026-21122","title":"CVE-2026-21122 — Out-of-bounds write in libsamsungtts.so prior to SMR Oct-2026 Release 1 allows local attackers to execute","summary":"Out-of-bounds write in libsamsungtts.so prior to SMR Oct-2026 Release 1 allows local attackers to execute arbitrary code.","source":"NVD","date":"2026-10-12T05:17:00.750Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21122","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-21122"],"cvss":{"score":7,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"mobile.security@samsung.com"},"read":false,"kev":false,"recordIds":["CVE-2026-21122"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21122"}],"epss":{"score":0.00174,"date":"2026-10-12","percentile":0.06301}},{"id":"CVE-2026-21121","title":"CVE-2026-21121 — Improper handling of insufficient permission in CmcCore prior to SMR Oct-2026 Release 1 allows local atta","summary":"Improper handling of insufficient permission in CmcCore prior to SMR Oct-2026 Release 1 allows local attackers to use the privileged APIs.","source":"NVD","date":"2026-10-12T05:17:00.640Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21121","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-21121"],"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"mobile.security@samsung.com"},"read":false,"kev":false,"recordIds":["CVE-2026-21121"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21121"}],"epss":{"score":0.00151,"date":"2026-10-12","percentile":0.0372}},{"id":"CVE-2026-21120","title":"CVE-2026-21120 — Use after free in WSM service prior to SMR Oct-2026 Release 1 allows local attackers to potentially execu","summary":"Use after free in WSM service prior to SMR Oct-2026 Release 1 allows local attackers to potentially execute arbitrary code with system privilege.","source":"NVD","date":"2026-10-12T05:17:00.520Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21120","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-21120"],"cvss":{"score":8.9,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"mobile.security@samsung.com"},"read":false,"kev":false,"recordIds":["CVE-2026-21120"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21120"}],"epss":{"score":0.00174,"date":"2026-10-12","percentile":0.06302}},{"id":"CVE-2026-21119","title":"CVE-2026-21119 — Out-of-bounds read and write in lib_sag_ai_sound_sep_v2.00.so prior to SMR Oct-2026 Release 1 allows loca","summary":"Out-of-bounds read and write in lib_sag_ai_sound_sep_v2.00.so prior to SMR Oct-2026 Release 1 allows local attackers to read and write out-of-bounds memory.","source":"NVD","date":"2026-10-12T05:17:00.407Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21119","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-21119"],"cvss":{"score":4.8,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"mobile.security@samsung.com"},"read":false,"kev":false,"recordIds":["CVE-2026-21119"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21119"}],"epss":{"score":0.00142,"date":"2026-10-12","percentile":0.03037}},{"id":"CVE-2026-21118","title":"CVE-2026-21118 — Improper access control in DownloadProvider prior to SMR Oct-2026 Release 1 allows local attackers to acc","summary":"Improper access control in DownloadProvider prior to SMR Oct-2026 Release 1 allows local attackers to access files in scoped storage.","source":"NVD","date":"2026-10-12T05:17:00.290Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21118","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-21118"],"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"mobile.security@samsung.com"},"read":false,"kev":false,"recordIds":["CVE-2026-21118"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21118"}],"epss":{"score":0.0013,"date":"2026-10-12","percentile":0.0228}},{"id":"CVE-2026-21117","title":"CVE-2026-21117 — Improper access control in CocktailBarService prior to SMR Oct-2026 Release 1 allows local attackers to a","summary":"Improper access control in CocktailBarService prior to SMR Oct-2026 Release 1 allows local attackers to access sensitive information.","source":"NVD","date":"2026-10-12T05:17:00.170Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21117","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-21117"],"cvss":{"score":5.1,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"mobile.security@samsung.com"},"read":false,"kev":false,"recordIds":["CVE-2026-21117"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21117"}],"epss":{"score":0.00151,"date":"2026-10-12","percentile":0.0372}},{"id":"CVE-2026-21116","title":"CVE-2026-21116 — Out-of-bounds write in libsmkvextractor.so prior to SMR Oct-2026 Release 1 allows local attackers to writ","summary":"Out-of-bounds write in libsmkvextractor.so prior to SMR Oct-2026 Release 1 allows local attackers to write out-of-bounds memory.","source":"NVD","date":"2026-10-12T05:17:00.060Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21116","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-21116"],"cvss":{"score":5.1,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"mobile.security@samsung.com"},"read":false,"kev":false,"recordIds":["CVE-2026-21116"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21116"}],"epss":{"score":0.00159,"date":"2026-10-12","percentile":0.0446}},{"id":"CVE-2026-21115","title":"CVE-2026-21115 — Out-of-bounds write in libcodec2-sec-flacdec.so prior to SMR Oct-2026 Release 1 allows local attackers to","summary":"Out-of-bounds write in libcodec2-sec-flacdec.so prior to SMR Oct-2026 Release 1 allows local attackers to write out-of-bounds memory.","source":"NVD","date":"2026-10-12T05:16:59.940Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21115","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-21115"],"cvss":{"score":5.1,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"mobile.security@samsung.com"},"read":false,"kev":false,"recordIds":["CVE-2026-21115"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21115"}],"epss":{"score":0.00159,"date":"2026-10-12","percentile":0.04461}},{"id":"CVE-2026-21114","title":"CVE-2026-21114 — Out-of-bounds write in libsmkvextractor.so prior to SMR Oct-2026 Release 1 allows local attackers to exec","summary":"Out-of-bounds write in libsmkvextractor.so prior to SMR Oct-2026 Release 1 allows local attackers to execute arbitrary code.","source":"NVD","date":"2026-10-12T05:16:59.807Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21114","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-21114"],"cvss":{"score":7,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"mobile.security@samsung.com"},"read":false,"kev":false,"recordIds":["CVE-2026-21114"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21114"}],"epss":{"score":0.00174,"date":"2026-10-12","percentile":0.06301}},{"id":"CVE-2026-108801","title":"CVE-2026-108801 — A security flaw has been discovered in prasathmani TinyFileManager up to 2.6. The impacted element is the","summary":"A security flaw has been discovered in prasathmani TinyFileManager up to 2.6. The impacted element is the function move_uploaded_file of the file tinyfilemanager.php. Performing a manipulation of the argument fullpath results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-12T05:16:59.630Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108801","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108801"],"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108801"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108801"}],"epss":{"score":0.00333,"date":"2026-10-12","percentile":0.2458}},{"id":"CVE-2026-108800","title":"CVE-2026-108800 — A vulnerability was identified in yangzongzhuan RuoYi 4.8.3. The affected element is an unknown function.","summary":"A vulnerability was identified in yangzongzhuan RuoYi 4.8.3. The affected element is an unknown function. Such manipulation leads to cross-site request forgery. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-12T05:16:59.423Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108800","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108800"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108800"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108800"}],"epss":{"score":0.00211,"date":"2026-10-12","percentile":0.10544}},{"id":"CVE-2026-108799","title":"CVE-2026-108799 — A vulnerability was determined in jackq XCMS up to 3fab5342cc509945a7ce1b8ec39d19f701b89261. Impacted is ","summary":"A vulnerability was determined in jackq XCMS up to 3fab5342cc509945a7ce1b8ec39d19f701b89261. Impacted is the function PublicController::sendFindPwdMail of the file Admin/Home/Controller/PublicController.class.php of the component Password Recovery Mail Endpoint. This manipulation of the argument email causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.","source":"NVD","date":"2026-10-12T05:16:59.173Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108799","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108799"],"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108799"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108799"}],"epss":{"score":0.00393,"date":"2026-10-12","percentile":0.31541}},{"id":"CVE-2026-108798","title":"CVE-2026-108798 — A vulnerability was found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This issue affects some unknown pr","summary":"A vulnerability was found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This issue affects some unknown processing. The manipulation results in use of hard-coded cryptographic key\r . The attack may be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-12T04:16:48.903Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108798","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108798"],"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108798"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108798"}],"epss":{"score":0.00278,"date":"2026-10-12","percentile":0.18698}},{"id":"CVE-2026-108797","title":"CVE-2026-108797 — A vulnerability has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This vulnerability affects un","summary":"A vulnerability has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This vulnerability affects unknown code of the file /personnel/api/employees/ of the component Employee REST API. The manipulation leads to authorization bypass. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-12T04:16:48.563Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108797","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108797"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108797"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108797"}],"epss":{"score":0.00218,"date":"2026-10-12","percentile":0.11299}},{"id":"CVE-2026-108796","title":"CVE-2026-108796 — A flaw has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This affects an unknown part of the fi","summary":"A flaw has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This affects an unknown part of the file /iclock/finger_data/ of the component Biometric Data Endpoint. Executing a manipulation of the argument emp_code can lead to authorization bypass. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-12T04:16:48.173Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108796","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108796"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108796"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108796"}],"epss":{"score":0.00218,"date":"2026-10-12","percentile":0.11299}},{"id":"CVE-2026-108795","title":"CVE-2026-108795 — A vulnerability was detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this issue is some ","summary":"A vulnerability was detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this issue is some unknown functionality of the file /base/api/systemSettings of the component System Settings API. Performing a manipulation results in improper access controls. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-12T04:16:43.580Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108795","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108795"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108795"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108795"}],"epss":{"score":0.00203,"date":"2026-10-12","percentile":0.09471}},{"id":"CVE-2026-108985","title":"CVE-2026-108985 — ZDR decoding in libnfs through 6.0.2 before 7613236 has an out-of-bounds write related to lib/libnfs-zdr.","summary":"ZDR decoding in libnfs through 6.0.2 before 7613236 has an out-of-bounds write related to lib/libnfs-zdr.c with libnfs_zdr_bytes(), libnfs_zdr_string(), and libnfs_zdr_array(). The caller-supplied maxsize value is not honored.","source":"NVD","date":"2026-10-12T03:17:18.837Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108985","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108985"],"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","source":"cve@mitre.org"},"read":false,"kev":false,"recordIds":["CVE-2026-108985"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108985"}],"epss":{"score":0.00177,"date":"2026-10-12","percentile":0.0671}},{"id":"CVE-2026-108982","title":"CVE-2026-108982 — VeraCrypt 1.26.29 (FUSE-T build) on macOS sometimes allows unintended access to decrypted data. It does n","summary":"VeraCrypt 1.26.29 (FUSE-T build) on macOS sometimes allows unintended access to decrypted data. It does not terminate the FUSE-T auxiliary service (go-nfsv4) and its associated VeraCrypt core-service helper processes when a volume is dismounted. After VeraCrypt reports the volume as dismounted, the auxiliary mount continues to serve the decrypted volume image (volume.dmg) over a loopback SMB session, and the leaked processes retain an open handle to the underlying raw device. A local user or process can therefore remount and access the decrypted volume without the passphrase, e.g., by reopening a previously accessed path (such as through a macOS Open Recent menu) or by attaching volume.dmg from the stale auxiliary mount. (The macFUSE build of VeraCrypt is not affected.)","source":"NVD","date":"2026-10-12T03:17:18.667Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108982","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108982"],"cvss":{"score":7.2,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cve@mitre.org"},"read":false,"kev":false,"recordIds":["CVE-2026-108982"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108982"}],"epss":{"score":0.00107,"date":"2026-10-12","percentile":0.01076}},{"id":"CVE-2026-108981","title":"CVE-2026-108981 — ngx_cache_purge before 3.0.4 can allow file deletion via a symlink attack in certain situations where ngi","summary":"ngx_cache_purge before 3.0.4 can allow file deletion via a symlink attack in certain situations where nginx and a served application (e.g., WordPress) run under the same user account. The attacker must be able to create a symlink inside the cache path. Version 3.0.4 fixes this for the case of a symlink created at an arbitrary earlier time, but does not resolve an applicable TOCTOU race condition. (The ngx_cache_purge module follows symlinks while walking the cache directory tree during purge operations. The module relies on nginx's ngx_walk_tree(), which relies on stat() and therefore follows symlinks.)","source":"NVD","date":"2026-10-12T03:17:18.503Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108981","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108981"],"cvss":{"score":3.6,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L","source":"cve@mitre.org"},"read":false,"kev":false,"recordIds":["CVE-2026-108981"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108981"}],"epss":{"score":0.00116,"date":"2026-10-12","percentile":0.01515}},{"id":"CVE-2026-108794","title":"CVE-2026-108794 — A security vulnerability has been detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this ","summary":"A security vulnerability has been detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this vulnerability is an unknown functionality of the file /base/api/v1.0/systemSettings/db_migrate_setting/ of the component Database Migration Functionality. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-12T03:17:18.343Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108794","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108794"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108794"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108794"}],"epss":{"score":0.00196,"date":"2026-10-12","percentile":0.08609}},{"id":"CVE-2026-108791","title":"CVE-2026-108791 — A weakness has been identified in westboy CicadasCMS up to 2431154dac8d0735e04f1fd2a3c3556668fc8dab. Affe","summary":"A weakness has been identified in westboy CicadasCMS up to 2431154dac8d0735e04f1fd2a3c3556668fc8dab. Affected is the function TemplateController.input of the file /system/cms/template/input of the component Template Management. This manipulation of the argument filePath causes path traversal. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-12T03:17:18.177Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108791","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108791"],"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108791"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108791"}],"epss":{"score":0.00365,"date":"2026-10-12","percentile":0.28393}},{"id":"CVE-2026-108790","title":"CVE-2026-108790 — A security flaw has been discovered in westboy CicadasCMS up to 2431154dac8d0735e04f1fd2a3c3556668fc8dab.","summary":"A security flaw has been discovered in westboy CicadasCMS up to 2431154dac8d0735e04f1fd2a3c3556668fc8dab. This impacts the function TemplateController.save of the file /system/cms/template/save of the component Backend Template Editor. The manipulation results in path traversal. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-12T03:17:18.003Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108790","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108790"],"cvss":{"score":2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108790"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108790"}],"epss":{"score":0.00541,"date":"2026-10-12","percentile":0.43856}},{"id":"CVE-2026-108789","title":"CVE-2026-108789 — A vulnerability was identified in deepseek-ai deepseek-harness up to 0.1.1-rc.2. This affects the functio","summary":"A vulnerability was identified in deepseek-ai deepseek-harness up to 0.1.1-rc.2. This affects the function agent of the component dsh-workflow-worker-thread. The manipulation leads to enforcement of behavioral workflow. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-12T03:17:17.820Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108789","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108789"],"cvss":{"score":2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108789"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108789"}],"epss":{"score":0.00176,"date":"2026-10-12","percentile":0.06573}},{"id":"CVE-2026-107437","title":"CVE-2026-107437 — GV-E-Map\nServer V18.2.0A contains a plaintext database password embedded within an\napplication component.","summary":"GV-E-Map\nServer V18.2.0A contains a plaintext database password embedded within an\napplication component. The credential can be recovered through static analysis\nof the distributed binary and may also be exposed in process memory during\nruntime.","source":"NVD","date":"2026-10-12T03:17:17.683Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107437","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107437"],"cvss":{"score":6.2,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","source":"0df08a0e-a200-4957-9bb0-084f562506f9"},"read":false,"kev":false,"recordIds":["CVE-2026-107437"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107437"}],"epss":{"score":0.00114,"date":"2026-10-12","percentile":0.01404}},{"id":"CVE-2026-87765","title":"CVE-2026-87765 — In the kernel apsys DVFS driver, there is a possible out-of-bounds read or hardware register corruption d","summary":"In the kernel apsys DVFS driver, there is a possible out-of-bounds read or hardware register corruption due to improper input validation of the frequency index. This could lead to system instability or denial of service with local privileges.","source":"NVD","date":"2026-10-12T02:16:57.727Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87765","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-87765"],"cvss":{"score":5.5,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","source":"security@unisoc.com"},"read":false,"kev":false,"recordIds":["CVE-2026-87765"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87765"}],"epss":{"score":0.00098,"date":"2026-10-12","percentile":0.0073}},{"id":"CVE-2026-66086","title":"CVE-2026-66086 — In the modem OTA stack, there is a possible stack-based buffer overflow due to improper validation of sch","summary":"In the modem OTA stack, there is a possible stack-based buffer overflow due to improper validation of scheduling information in SIB1 messages. This could lead to remote code execution or denial of service with no additional execution privileges needed.","source":"NVD","date":"2026-10-12T02:16:57.600Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66086","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-66086"],"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"security@unisoc.com"},"read":false,"kev":false,"recordIds":["CVE-2026-66086"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66086"}],"epss":{"score":0.00455,"date":"2026-10-12","percentile":0.37674}},{"id":"CVE-2026-66085","title":"CVE-2026-66085 — In modem, there is a possible information disclosure due to missing filtering of sensitive data in crash ","summary":"In modem, there is a possible information disclosure due to missing filtering of sensitive data in crash dumps. This could lead to local information disclosure with no additional execution privileges needed.","source":"NVD","date":"2026-10-12T02:16:57.460Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66085","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-66085"],"cvss":{"score":5.5,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","source":"security@unisoc.com"},"read":false,"kev":false,"recordIds":["CVE-2026-66085"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66085"}],"epss":{"score":0.00111,"date":"2026-10-12","percentile":0.01244}},{"id":"CVE-2026-108980","title":"CVE-2026-108980 — Blinko through 1.8.8 allows directory traversal, overwriting startup files as root, via installPlugin. It","summary":"Blinko through 1.8.8 allows directory traversal, overwriting startup files as root, via installPlugin. It builds the plugin install path from an unsanitized name in server/routerTrpc/plugin.ts, and the plugin.installPlugin tRPC procedure is open to any authenticated user. Thus, a name containing ../ sequences writes the downloaded plugin files outside the plugins directory. Because the official Docker image runs as root, an authenticated attacker overwrites a root-owned startup file and achieves remote code execution as root. Self-registration for an account may be possible.","source":"NVD","date":"2026-10-12T02:16:57.297Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108980","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108980"],"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"cve@mitre.org"},"read":false,"kev":false,"recordIds":["CVE-2026-108980"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108980"}],"epss":{"score":0.01063,"date":"2026-10-12","percentile":0.63708}},{"id":"CVE-2026-108788","title":"CVE-2026-108788 — A vulnerability was determined in deepseek-ai deepseek-harness up to 0.1.1-rc.2. The impacted element is ","summary":"A vulnerability was determined in deepseek-ai deepseek-harness up to 0.1.1-rc.2. The impacted element is the function spawn of the component Sandbox. Executing a manipulation of the argument Profile can lead to sandbox issue. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-12T02:16:57.090Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108788","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108788"],"cvss":{"score":1.9,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108788"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108788"}],"epss":{"score":0.00112,"date":"2026-10-12","percentile":0.01283}},{"id":"CVE-2026-108787","title":"CVE-2026-108787 — A vulnerability was found in houtini-ai voice-analyser-mcp up to 2.1.1. The affected element is the funct","summary":"A vulnerability was found in houtini-ai voice-analyser-mcp up to 2.1.1. The affected element is the function fetch of the file src/utils/crawler.ts of the component collect_corpus. Performing a manipulation of the argument sitemap_url results in server-side request forgery. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-12T02:16:56.923Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108787","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108787"],"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108787"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108787"}],"epss":{"score":0.00201,"date":"2026-10-12","percentile":0.09231}},{"id":"CVE-2026-108786","title":"CVE-2026-108786 — A vulnerability has been found in houtini-ai seo-crawler-mcp up to 2.1.5. Impacted is the function run_se","summary":"A vulnerability has been found in houtini-ai seo-crawler-mcp up to 2.1.5. Impacted is the function run_seo_audit of the file src/core/CrawlOrchestrator.ts of the component Crawler. Such manipulation leads to server-side request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-12T02:16:56.753Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108786","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108786"],"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108786"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108786"}],"epss":{"score":0.00201,"date":"2026-10-12","percentile":0.0923}},{"id":"CVE-2026-108785","title":"CVE-2026-108785 — A flaw has been found in macrozheng mall up to 1.0.3. This issue affects the function JwtTokenUtil.refres","summary":"A flaw has been found in macrozheng mall up to 1.0.3. This issue affects the function JwtTokenUtil.refreshHeadToken of the file /admin/refreshToken of the component JwtAuthenticationTokenFilter. This manipulation of the argument token causes session expiration. The attack may be initiated remotely. The exploit has been published and may be used. Patch name: 9bfc2fd2c4aaa4ac519e9152e65d673a5380de1a. To fix this issue, it is recommended to deploy a patch.","source":"NVD","date":"2026-10-12T02:16:56.573Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108785","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108785"],"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108785"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108785"}],"epss":{"score":0.00289,"date":"2026-10-12","percentile":0.19785}},{"id":"CVE-2026-108784","title":"CVE-2026-108784 — A vulnerability was detected in macrozheng mall up to 1.0.3. This vulnerability affects the function Alip","summary":"A vulnerability was detected in macrozheng mall up to 1.0.3. This vulnerability affects the function AlipayServiceImpl.pay of the file com/macro/mall/portal/service/impl/AlipayServiceImpl.java of the component Payment Endpoint. The manipulation of the argument total_amount results in business logic errors. The attack can be launched remotely. The exploit is now public and may be used. The patch is identified as dcaa93b3150352e5044708d7211b5bed0af4509f. A patch should be applied to remediate this issue.","source":"NVD","date":"2026-10-12T02:16:56.390Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108784","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108784"],"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108784"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108784"}],"epss":{"score":0.00571,"date":"2026-10-12","percentile":0.45645}},{"id":"CVE-2026-108783","title":"CVE-2026-108783 — A security vulnerability has been detected in PRVTPRO Amnezia-Web-Panel up to 1.6.2/1.7.2. This affects a","summary":"A security vulnerability has been detected in PRVTPRO Amnezia-Web-Panel up to 1.6.2/1.7.2. This affects an unknown part of the file app.py of the component Backup Download. The manipulation leads to use of default credentials. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-12T02:16:56.213Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108783","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108783"],"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108783"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108783"}],"epss":{"score":0.00375,"date":"2026-10-12","percentile":0.29481}},{"id":"CVE-2026-108782","title":"CVE-2026-108782 — A weakness has been identified in erzhongxmu JEEWMS up to 2026.09.27-W39. Affected by this issue is the f","summary":"A weakness has been identified in erzhongxmu JEEWMS up to 2026.09.27-W39. Affected by this issue is the function CommonServiceImpl.getAutoList of the file src/main/java/org/jeecgframework/core/common/service/impl/CommonServiceImpl.java of the component Autocomplete Handler. Executing a manipulation of the argument trem/searchField/entityName can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-12T02:16:56.040Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108782","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108782"],"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108782"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108782"}],"epss":{"score":0.00192,"date":"2026-10-12","percentile":0.08191}},{"id":"CVE-2026-108781","title":"CVE-2026-108781 — A security flaw has been discovered in erzhongxmu JEEWMS up to 2026.09.27-W39. Affected by this vulnerabi","summary":"A security flaw has been discovered in erzhongxmu JEEWMS up to 2026.09.27-W39. Affected by this vulnerability is the function WmToMoveGoodsController.list of the file src/main/java/com/zzjee/wm/controller/WmToMoveGoodsController.java of the component PDA Interface. Performing a manipulation of the argument searchstr results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-12T01:16:29.783Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108781","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108781"],"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108781"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108781"}],"epss":{"score":0.00196,"date":"2026-10-12","percentile":0.08611}},{"id":"CVE-2026-108779","title":"CVE-2026-108779 — A vulnerability was identified in erzhongxmu JEEWMS up to 2026.09.27-W39. Affected is the function WmSttI","summary":"A vulnerability was identified in erzhongxmu JEEWMS up to 2026.09.27-W39. Affected is the function WmSttInGoodsController.list of the file src/main/java/com/zzjee/wm/controller/WmSttInGoodsController.java. Such manipulation of the argument searchstr leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-12T01:16:29.617Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108779","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108779"],"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108779"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108779"}],"epss":{"score":0.00192,"date":"2026-10-12","percentile":0.08191}},{"id":"CVE-2026-108778","title":"CVE-2026-108778 — A vulnerability was determined in erzhongxmu JEEWMS up to 2026.09.27-W39. This impacts the function WmInQ","summary":"A vulnerability was determined in erzhongxmu JEEWMS up to 2026.09.27-W39. This impacts the function WmInQmIController.list of the file src/main/java/com/zzjee/wm/controller/WmInQmIController.java of the component Inbound Quality Check Pda Interface. This manipulation of the argument searchstr causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-12T00:17:01.700Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108778","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108778"],"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108778"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108778"}],"epss":{"score":0.00192,"date":"2026-10-12","percentile":0.08189}},{"id":"CVE-2026-108777","title":"CVE-2026-108777 — A vulnerability was found in erzhongxmu JEEWMS up to 2026.09.27-W39. This affects the function WvGiContro","summary":"A vulnerability was found in erzhongxmu JEEWMS up to 2026.09.27-W39. This affects the function WvGiController.list of the file src/main/java/com/zzjee/wmapi/controller/WvGiController.java. The manipulation of the argument searchstr results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-12T00:17:01.533Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108777","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108777"],"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108777"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108777"}],"epss":{"score":0.00192,"date":"2026-10-12","percentile":0.08189}},{"id":"CVE-2026-108775","title":"CVE-2026-108775 — A vulnerability has been found in erzhongxmu JEEWMS up to 2026.09.27-W39. The impacted element is the fun","summary":"A vulnerability has been found in erzhongxmu JEEWMS up to 2026.09.27-W39. The impacted element is the function WvNoticeController.list of the file com/zzjee/wmapi/controller/WvNoticeController.java of the component Search Endpoint. The manipulation of the argument searchstr leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-12T00:17:01.370Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108775","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108775"],"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108775"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108775"}],"epss":{"score":0.00303,"date":"2026-10-12","percentile":0.21266}},{"id":"CVE-2026-108774","title":"CVE-2026-108774 — A flaw has been found in erzhongxmu JEEWMS up to 2026.09.27-W39. The affected element is the function get","summary":"A flaw has been found in erzhongxmu JEEWMS up to 2026.09.27-W39. The affected element is the function getbinall/getbinallagv of the file src/main/java/com/zzjee/md/controller/MdBinController.java. Executing a manipulation of the argument binstore/binid/des/cengshu can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-12T00:17:01.200Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108774","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108774"],"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108774"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108774"}],"epss":{"score":0.00303,"date":"2026-10-12","percentile":0.21267}},{"id":"CVE-2026-108773","title":"CVE-2026-108773 — A vulnerability was detected in erzhongxmu JEEWMS up to 2026.09.27-W39. Impacted is the function docheck ","summary":"A vulnerability was detected in erzhongxmu JEEWMS up to 2026.09.27-W39. Impacted is the function docheck of the file src/main/java/com/zzjee/wm/controller/WmOmNoticeHController.java. Performing a manipulation of the argument goodscode results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-11T23:16:56.917Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108773","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108773"],"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108773"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108773"}],"epss":{"score":0.00192,"date":"2026-10-12","percentile":0.08188}},{"id":"CVE-2026-108772","title":"CVE-2026-108772 — A security vulnerability has been detected in bleenco abstruse up to 2.1.0. This issue affects the functi","summary":"A security vulnerability has been detected in bleenco abstruse up to 2.1.0. This issue affects the function filepath.Join of the file server/api/worker/download_cache.go of the component Cache Endpoint. Such manipulation of the argument File leads to path traversal. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-11T23:16:56.743Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108772","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108772"],"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108772"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108772"}],"epss":{"score":0.00704,"date":"2026-10-12","percentile":0.52005}},{"id":"CVE-2026-108770","title":"CVE-2026-108770 — A weakness has been identified in Appwrite up to 2.3.0. This vulnerability affects the function PublicHos","summary":"A weakness has been identified in Appwrite up to 2.3.0. This vulnerability affects the function PublicHostname of the file src/Appwrite/Platform/Modules/Avatars/Http/Screenshots/Get.php of the component Browser Screenshot Service. This manipulation of the argument url causes server-side request forgery. The attack can be initiated remotely. Upgrading to version 2.4.0 is able to resolve this issue. Patch name: 393255e7302ae5503331d45802e2eee01c6a47fe. You should upgrade the affected component.","source":"NVD","date":"2026-10-11T23:16:56.543Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108770","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108770"],"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108770"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108770"}],"epss":{"score":0.00406,"date":"2026-10-12","percentile":0.32897}},{"id":"CVE-2026-104703","title":"CVE-2026-104703 — Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.","summary":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.","source":"NVD","date":"2026-10-11T23:16:56.447Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104703","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-104703"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-104703"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104703"}],"epss":null},{"id":"CVE-2026-108978","title":"CVE-2026-108978 — Heap-based buffer overflow vulnerability in Samsung Opensource rlottie allows Buffer Overflow via Environ","summary":"Heap-based buffer overflow vulnerability in Samsung Opensource rlottie allows Buffer Overflow via Environment Variables.\n\nThis issue affects rlottie: e57b094f03c39a751a1fded6f7d6c13f1ed95ec9.","source":"NVD","date":"2026-10-11T22:16:50.787Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108978","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108978"],"cvss":{"score":5.5,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","source":"PSIRT@samsung.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108978"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108978"}],"epss":{"score":0.00148,"date":"2026-10-12","percentile":0.03504}},{"id":"CVE-2026-108769","title":"CVE-2026-108769 — A security flaw has been discovered in zhayujie CowAgent up to 2.2.0. This affects an unknown part of the","summary":"A security flaw has been discovered in zhayujie CowAgent up to 2.2.0. This affects an unknown part of the file Markdown.tsx of the component Markdown Rendering. The manipulation results in denial of service. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-11T22:16:50.617Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108769","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108769"],"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108769"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108769"}],"epss":{"score":0.00451,"date":"2026-10-12","percentile":0.3732}},{"id":"CVE-2026-108976","title":"CVE-2026-108976 — GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-","summary":"GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete fix for CVE-2026-79992.","source":"NVD","date":"2026-10-11T21:16:43.580Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108976","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108976"],"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"cve@mitre.org"},"read":false,"kev":false,"recordIds":["CVE-2026-108976"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108976"}],"epss":{"score":0.00505,"date":"2026-10-12","percentile":0.41371}},{"id":"CVE-2026-108963","title":"CVE-2026-108963 — databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., mariadb-du","summary":"databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., mariadb-dump) with a database name that can be specified by any authenticated user. For example, --result-file=/app/public/index.php can write to index.php. In other words, quoting prevents OS command injection in mariadb-dump, but the argument injection alone is sufficient for code execution indirectly. NOTE: the project's composer.json file does not indicate an independently published databasement Composer package.","source":"NVD","date":"2026-10-11T20:16:32.853Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108963","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108963"],"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"cve@mitre.org"},"read":false,"kev":false,"recordIds":["CVE-2026-108963"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108963"}],"epss":{"score":0.01685,"date":"2026-10-12","percentile":0.76378}},{"id":"CVE-2026-108925","title":"CVE-2026-108925 — Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Cohesity N","summary":"Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Cohesity NetBackup Administration Console web interface.\n\nThis issue affects NetBackup Administration Console web interface:  versions before 11.2.\n\n\n\nhttps://github.com/cohesity/SecAdvisory/blob/master/COH-2026-0002.md","source":"NVD","date":"2026-10-11T19:16:33.957Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108925","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108925"],"cvss":{"score":6.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","source":"cna@cyber.gov.il"},"read":false,"kev":false,"recordIds":["CVE-2026-108925"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108925"}],"epss":{"score":0.00205,"date":"2026-10-12","percentile":0.09624}},{"id":"CVE-2026-108768","title":"CVE-2026-108768 — A vulnerability was identified in zhayujie CowAgent up to 2.2.0. Affected by this issue is the function j","summary":"A vulnerability was identified in zhayujie CowAgent up to 2.2.0. Affected by this issue is the function json.loads of the component Streaming Tool-Call Argument Handler. The manipulation leads to allocation of resources. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-11T19:16:32.870Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108768","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108768"],"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108768"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108768"}],"epss":{"score":0.00451,"date":"2026-10-12","percentile":0.37321}},{"id":"CVE-2026-59508","title":"CVE-2026-59508 — Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Int","summary":"Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Interuse i-Bos.\n\nThis issue affects i-Bos: 3.0.","source":"NVD","date":"2026-10-11T18:16:59.543Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59508","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-59508"],"cvss":{"score":5.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","source":"cna@cyber.gov.il"},"read":false,"kev":false,"recordIds":["CVE-2026-59508"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59508"}],"epss":{"score":0.0028,"date":"2026-10-12","percentile":0.18838}},{"id":"CVE-2026-19935","title":"CVE-2026-19935 — The Bluetooth LE host queues received L2CAP connection-oriented channel (CoC) data for deferred processin","summary":"The Bluetooth LE host queues received L2CAP connection-oriented channel (CoC) data for deferred processing through a struct k_work embedded in the channel object (le_chan->rx_work, handler l2cap_rx_process()) whenever the channel uses a dynamic PSM (0x0080-0x00FF). Channel teardown in l2cap_chan_destroy() in subsys/bluetooth/host/l2cap.c cancels the retransmission-timeout work and drains the RX FIFO, but never cancels rx_work. Because that work item was submitted to the system workqueue while HCI receive processing runs on the dedicated Bluetooth RX workqueue (CONFIG_BT_RECV_WORKQ_BT, the default), a queued rx_work item can outlive the channel it points into.\n\nA remote, unauthenticated peer with an established CoC channel triggers this by sending a data K-frame immediately followed by an L2CAP Disconnect Request. The K-frame submits rx_wo","source":"NVD","date":"2026-10-11T18:16:59.410Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19935","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-19935"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"vulnerabilities@zephyrproject.org"},"read":false,"kev":false,"recordIds":["CVE-2026-19935"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19935"}],"epss":{"score":0.00179,"date":"2026-10-12","percentile":0.06858}},{"id":"CVE-2026-19740","title":"CVE-2026-19740 — The Link Layer Control Procedure (LLCP) implementation of the Zephyr software Bluetooth LE Controller ret","summary":"The Link Layer Control Procedure (LLCP) implementation of the Zephyr software Bluetooth LE Controller retains the receive node that carried an accepted LL_PHY_UPDATE_IND so that it can later be reused for the host notification when the update instant is reached (llcp_rx_node_retain() in subsys/bluetooth/controller/ll_sw/ull_llcp.c, and the node is deliberately not recycled while marked NODE_RX_TYPE_RETAIN). The invalid-PDU arms of llcp_lp_pu_rx() and llcp_rp_pu_rx() in subsys/bluetooth/controller/ll_sw/ull_llcp_phy.c completed the procedure via llcp_lr_complete() / llcp_rr_complete() without first releasing that retained node, so the procedure context — the only remaining reference to the node — was freed while the node was still held out of the receive pool.\n\nA peer device on an established LE connection can drive this deterministically ","source":"NVD","date":"2026-10-11T18:16:59.290Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19740","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-19740"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"vulnerabilities@zephyrproject.org"},"read":false,"kev":false,"recordIds":["CVE-2026-19740"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19740"}],"epss":{"score":0.00104,"date":"2026-10-12","percentile":0.0098}},{"id":"CVE-2026-19739","title":"CVE-2026-19739 — The Bluetooth Link Layer control procedure code in subsys/bluetooth/controller/ll_sw/ull_llcp_conn_upd.c ","summary":"The Bluetooth Link Layer control procedure code in subsys/bluetooth/controller/ll_sw/ull_llcp_conn_upd.c retains the received RX node while a Connection Update / Connection Parameter procedure waits for its instant, so the node can later carry the host notification (llcp_rx_node_retain(), which marks it NODE_RX_TYPE_RETAIN and thereby suppresses the normal recycling in ull.c). The default: arm of llcp_rp_cu_rx() and llcp_lp_cu_rx() — the \"invalid PDU, terminate the connection\" path — completed the procedure without releasing that retained node. llcp_rr_check_done() then dequeued and freed the procedure context with ctx->node_ref.rx still pointing at the retained node, dropping the last reference to it.\n\nA peer device in radio range can reach this without pairing, bonding, or encryption. Against a peripheral, the peer sends a well-formed L","source":"NVD","date":"2026-10-11T18:16:59.170Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19739","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-19739"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"vulnerabilities@zephyrproject.org"},"read":false,"kev":false,"recordIds":["CVE-2026-19739"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19739"}],"epss":{"score":0.00102,"date":"2026-10-12","percentile":0.00885}},{"id":"CVE-2026-19738","title":"CVE-2026-19738 — The Bluetooth Link Layer Control Procedure (LLCP) implementation for Connected Isochronous Stream (CIS) c","summary":"The Bluetooth Link Layer Control Procedure (LLCP) implementation for Connected Isochronous Stream (CIS) creation retains an RX node (ctx->node_ref.rx, marked NODE_RX_TYPE_RETAIN) so it can later be reused as the host notification — on the peripheral while awaiting the Host's reply to an LL_CIS_REQ, and on the central for the whole duration of a locally initiated CIS Create. In subsys/bluetooth/controller/ll_sw/ull_llcp_cc.c, the \"invalid PDU received\" paths of llcp_rp_cc_rx() and llcp_lp_cc_rx() terminated the connection and completed the procedure without releasing that retained node, breaking the invariant checked in llcp_lr_check_done() and llcp_rr_check_done() and orphaning the node's memory.\n\nA peer device within radio range can reach this with a single extra LL Control PDU on an unauthenticated, unencrypted ACL link. Against a perip","source":"NVD","date":"2026-10-11T18:16:59.050Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19738","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-19738"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"vulnerabilities@zephyrproject.org"},"read":false,"kev":false,"recordIds":["CVE-2026-19738"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19738"}],"epss":{"score":0.00104,"date":"2026-10-12","percentile":0.00979}},{"id":"CVE-2026-19737","title":"CVE-2026-19737 — i2s_esp32_trigger_check() in drivers/i2s/i2s_esp32.c validates the requested direction only for I2S_DIR_B","summary":"i2s_esp32_trigger_check() in drivers/i2s/i2s_esp32.c validates the requested direction only for I2S_DIR_BOTH. The I2S_DIR_RX and I2S_DIR_TX branches read dev_cfg->rx.data->configured / dev_cfg->tx.data->configured without first checking the stream pointers. The device instantiation macro I2S_ESP32_STREAM_INIT() sets both .conf and .data to NULL for a direction the devicetree does not describe, so on an instance that wires only one direction — the normal shape for audio output or a worldsemi,ws2812-i2s LED strip — the other direction dereferences a NULL pointer instead of returning an error.\n\ni2s_trigger() is a Zephyr syscall, and z_vrfy_i2s_trigger() in drivers/i2s/i2s_handlers.c validates only the device object and the presence of the trigger API pointer; the dir argument is passed to the driver unvalidated. On a build with CONFIG_USERSP","source":"NVD","date":"2026-10-11T18:16:58.930Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19737","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-19737"],"cvss":{"score":5.5,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","source":"vulnerabilities@zephyrproject.org"},"read":false,"kev":false,"recordIds":["CVE-2026-19737"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19737"}],"epss":{"score":0.001,"date":"2026-10-12","percentile":0.00807}},{"id":"CVE-2026-19736","title":"CVE-2026-19736 — The NXP MCUX TRNG entropy driver in drivers/entropy/entropy_mcux_trng.c passed the caller's byte count st","summary":"The NXP MCUX TRNG entropy driver in drivers/entropy/entropy_mcux_trng.c passed the caller's byte count straight to the vendor SDK routine TRNG_GetRandomData(). On i.MX RT5xx and RT6xx parts the SDK compiles its TRNG_SW_HEALTH_TESTS variant, which always copies whole 32-bit words and draws entropy rounded up to a multiple of 128 bytes. Its \"caller buffer is full\" guard tests dataSize == 0, so a request whose length is not a multiple of four makes dataSize underflow past zero and the SDK keeps writing into the caller's buffer for the entire extraction: a 1-byte request results in 128 bytes written, and any non-word-multiple length overflows by up to 127 bytes.\n\nentropy_get_entropy() is a syscall, and its verifier in drivers/entropy/entropy_handlers.c validates only the requested length via K_SYSCALL_MEMORY_WRITE(). With CONFIG_USERSPACE ena","source":"NVD","date":"2026-10-11T18:16:58.810Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19736","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-19736"],"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"vulnerabilities@zephyrproject.org"},"read":false,"kev":false,"recordIds":["CVE-2026-19736"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19736"}],"epss":{"score":0.00112,"date":"2026-10-12","percentile":0.01295}},{"id":"CVE-2026-19735","title":"CVE-2026-19735 — The RFC 6528 initial-sequence-number implementation in subsys/net/ip/tcp.c derived every TCP ISN from SHA","summary":"The RFC 6528 initial-sequence-number implementation in subsys/net/ip/tcp.c derived every TCP ISN from SHA-256(unique_key || four-tuple) plus a uptime-derived offset, where unique_key is a 128-bit secret filled once by sys_csrand_get(). The return value of that call was discarded and the once guard was latched to true even when the call failed. Because sys_csrand_get() leaves the destination buffer untouched on failure (it deliberately propagates the entropy-driver error rather than filling the buffer), a single failed call left unique_key as its all-zero BSS content for the remainder of the boot, with no retry, no log message and no fallback.\n\nA failure of the cryptographic random source is required to reach the weak state — for example -ENODEV/-EIO from the entropy driver in subsys/random/random_entropy_device.c (the in-tree comment note","source":"NVD","date":"2026-10-11T18:16:58.683Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19735","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-19735"],"cvss":{"score":4.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","source":"vulnerabilities@zephyrproject.org"},"read":false,"kev":false,"recordIds":["CVE-2026-19735"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19735"}],"epss":{"score":0.0016,"date":"2026-10-12","percentile":0.0469}},{"id":"CVE-2026-19669","title":"CVE-2026-19669 — The user-mode syscall verifiers z_vrfy_fuel_gauge_get_props() and z_vrfy_fuel_gauge_set_props() in driver","summary":"The user-mode syscall verifiers z_vrfy_fuel_gauge_get_props() and z_vrfy_fuel_gauge_set_props() in drivers/fuel_gauge/fuel_gauge_syscall_handlers.c declared two variable-length arrays, union fuel_gauge_prop_val k_vals[len] and fuel_gauge_prop_t k_props[len], sized directly by the caller-supplied len argument. len is an unvalidated size_t taken straight from the syscall ABI, and the VLAs were allocated before any check at all — including before the K_SYSCALL_DRIVER_FUEL_GAUGE() object-permission check. The subsequent k_usermode_from_copy() calls validated only that the user source buffer was readable; the kernel destination was never bounds-checked, since it was sized by the same attacker-chosen len.\n\nAny thread running in user mode with CONFIG_USERSPACE enabled can invoke fuel_gauge_get_props() or fuel_gauge_set_props() with a large len. ","source":"NVD","date":"2026-10-11T18:16:58.563Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19669","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-19669"],"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"vulnerabilities@zephyrproject.org"},"read":false,"kev":false,"recordIds":["CVE-2026-19669"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19669"}],"epss":{"score":0.0012,"date":"2026-10-12","percentile":0.01684}},{"id":"CVE-2026-19577","title":"CVE-2026-19577 — net_route_ipv6_packet() in subsys/net/ip/route_ipv6.c resolved the nexthop's link-layer address with net_","summary":"net_route_ipv6_packet() in subsys/net/ip/route_ipv6.c resolved the nexthop's link-layer address with net_nbr_get_lladdr(nbr->idx) without first checking whether the neighbor cache entry actually had a linked link-layer address. An unresolved neighbor carries idx == NET_NBR_LLADDR_UNKNOWN (0xff), and net_nbr_get_lladdr() in subsys/net/ip/nbr.c performs no runtime bounds check beyond a NET_ASSERT, returning &net_neighbor_lladdr[255] — roughly 2.5 KB past the end of an array whose default size is CONFIG_NET_IPV6_MAX_NEIGHBORS (8). Because the returned pointer is never NULL, the following lladdr == NULL guard does not catch it.\n\nThe function is reached from ipv6_route_packet() in subsys/net/ip/ipv6.c for every received unicast IPv6 packet whose destination is not a local address on the receiving interface; CONFIG_NET_IPV6_ROUTE is enabled by ","source":"NVD","date":"2026-10-11T18:16:58.433Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19577","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-19577"],"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","source":"vulnerabilities@zephyrproject.org"},"read":false,"kev":false,"recordIds":["CVE-2026-19577"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19577"}],"epss":{"score":0.00217,"date":"2026-10-12","percentile":0.11194}},{"id":"CVE-2026-19576","title":"CVE-2026-19576 — The Goodix GT9xx input driver in drivers/input/input_gt911.c reads the touch point count from the control","summary":"The Goodix GT9xx input driver in drivers/input/input_gt911.c reads the touch point count from the controller's status register and masks it with GT911_TOUCH_POINTS_MSK (0x0F), yielding a value of 0..15. In gt911_process() that value is used directly as the loop bound for filling point_reg[], a stack array sized to CONFIG_INPUT_GT911_MAX_TOUCH_POINTS, whose Kconfig range is 1..5 with a default of 1. No other check constrains the count; the driver relied only on a comment asserting that the controller had been programmed at init to report no more points than configured.\n\nEach loop iteration issues an I2C read of eight bytes straight into point_reg[i], so a controller that reports more points than the array holds causes up to 112 bytes of peer-supplied data to be written past the end of the array, over the stack frame of gt911_process() in t","source":"NVD","date":"2026-10-11T18:16:58.300Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19576","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-19576"],"cvss":{"score":6.8,"version":"3.1","vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"vulnerabilities@zephyrproject.org"},"read":false,"kev":false,"recordIds":["CVE-2026-19576"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19576"}],"epss":{"score":0.00169,"date":"2026-10-12","percentile":0.05753}},{"id":"CVE-2026-18418","title":"CVE-2026-18418 — The zbus proxy agent IPC backend in subsys/zbus/proxy_agent/zbus_proxy_agent_ipc.c logged the channel nam","summary":"The zbus proxy agent IPC backend in subsys/zbus/proxy_agent/zbus_proxy_agent_ipc.c logged the channel name of a rejected inter-domain frame with a plain %s conversion. The frame type struct zbus_proxy_msg carries a fixed-size channel_name[] array as its last member, and nothing in the transport guarantees the array is NUL-terminated. The only code that verifies termination is zbus_proxy_agent_receive_cb() in subsys/zbus/proxy_agent/zbus_proxy_agent.c, which rejects the frame in precisely those cases — so the warning printed a non-terminated buffer exactly on the error paths where the name had been found invalid (or, for an invalid message_size, had not been inspected at all).\n\nAny peer domain able to place a frame of sizeof(struct zbus_proxy_msg) bytes on the bound ipc_service endpoint can trigger it, by sending a frame with an out-of-ran","source":"NVD","date":"2026-10-11T18:16:58.113Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18418","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-18418"],"cvss":{"score":3.4,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:L","source":"vulnerabilities@zephyrproject.org"},"read":false,"kev":false,"recordIds":["CVE-2026-18418"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18418"}],"epss":{"score":0.00109,"date":"2026-10-12","percentile":0.01143}},{"id":"CVE-2026-108913","title":"CVE-2026-108913 — omarchy-theme-set in Omarchy 4 before 4.0.1 allows code execution via a third-party theme because the fil","summary":"omarchy-theme-set in Omarchy 4 before 4.0.1 allows code execution via a third-party theme because the files placed into ~/.local/state/omarchy/current/theme may include executable content from an untrusted Git repository.","source":"NVD","date":"2026-10-11T16:16:31.713Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108913","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108913"],"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L","source":"cve@mitre.org"},"read":false,"kev":false,"recordIds":["CVE-2026-108913"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108913"}],"epss":{"score":0.00368,"date":"2026-10-12","percentile":0.28785}},{"id":"CVE-2026-107761","title":"CVE-2026-107761 — Several Postiz endpoints return the complete database row of the record they operate on instead of only t","summary":"Several Postiz endpoints return the complete database row of the record they operate on instead of only the fields the client needs. Two of them include secrets the caller is not meant to receive.\n\nThe public API's channel delete returns the deleted integration row, including the channel's platform access token and refresh token. A third-party OAuth app permitted to delete a channel therefore receives that channel's social platform credentials and can use them against the connected account directly, outside Postiz.\n\n`GET /user/organizations` returns each organization row, including its API key, to every member of the organization. The API key is intended for admins only, so a member with a lower role can obtain it and call the public API on behalf of the organization.\n\nBoth endpoints require a valid session, API key or OAuth token and are","source":"NVD","date":"2026-10-11T16:16:30.490Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107761","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107761"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"4cdc9741-f887-419a-a2fd-acbbd2729276"},"read":false,"kev":false,"recordIds":["CVE-2026-107761"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107761"}],"epss":{"score":0.00283,"date":"2026-10-12","percentile":0.19237}},{"id":"CVE-2026-108905","title":"CVE-2026-108905 — pH7Builder (pH7 Social Dating CMS) before 18.6.0 contains a hard-coded API key vulnerability in Tool.clas","summary":"pH7Builder (pH7 Social Dating CMS) before 18.6.0 contains a hard-coded API key vulnerability in Tool.class.php that allows unauthenticated attackers to bypass API access checks by spoofing the Host header. Attackers can send Host: localhost with private_api_key=dev772277 and the default allowed URL to retrieve member emails, IP addresses, phone numbers, and bank account fields.","source":"NVD","date":"2026-10-11T15:16:56.803Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108905","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108905"],"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108905"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108905"}],"epss":{"score":0.00306,"date":"2026-10-12","percentile":0.21611}},{"id":"CVE-2026-108904","title":"CVE-2026-108904 — pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an information disclosure vulnerability that al","summary":"pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an information disclosure vulnerability that allows API clients to obtain sensitive member data because UserController::users() and user() return unfiltered database rows. Attackers holding a valid private API key can retrieve bcrypt password hashes, non-expiring hashValidation reset tokens, and TOTP secrets to take over accounts and bypass two-factor authentication.","source":"NVD","date":"2026-10-11T15:16:56.640Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108904","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108904"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108904"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108904"}],"epss":{"score":0.00316,"date":"2026-10-12","percentile":0.22618}},{"id":"CVE-2026-108903","title":"CVE-2026-108903 — pH7Builder (pH7 Social Dating CMS) before 19.3.0 contains a CAPTCHA bypass vulnerability that allows unau","summary":"pH7Builder (pH7 Social Dating CMS) before 19.3.0 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to skip form validation by supplying a client-chosen form ID to PFBC Form::isValid(). Attackers can load a CAPTCHA-free form like login or search, then submit its ID with contact, comment, forum, invite or signup data to automate abuse.","source":"NVD","date":"2026-10-11T15:16:56.490Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108903","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108903"],"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108903"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108903"}],"epss":{"score":0.0027,"date":"2026-10-12","percentile":0.17768}},{"id":"CVE-2026-108902","title":"CVE-2026-108902 — pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains a path traversal vulnerability in the picture m","summary":"pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains a path traversal vulnerability in the picture module deletePhoto() action that allows authenticated members to delete arbitrary files. Attackers can supply ../ sequences in the POST picture_link parameter to remove other members' photos or configuration and cache files, causing content loss and denial of service.","source":"NVD","date":"2026-10-11T15:16:56.337Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108902","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108902"],"cvss":{"score":7.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108902"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108902"}],"epss":{"score":0.00375,"date":"2026-10-12","percentile":0.29499}},{"id":"CVE-2026-108891","title":"CVE-2026-108891 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController getUserDe","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController getUserDetailByUserId handler that allows any authenticated user to read other users' details. Low-privileged attackers can supply arbitrary userId values to retrieve real names, usernames, emails, phone numbers, birthdays, employee numbers, department paths and posts.","source":"NVD","date":"2026-10-11T15:16:56.203Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108891","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108891"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108891"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108891"}],"epss":{"score":0.00193,"date":"2026-10-12","percentile":0.08235}},{"id":"CVE-2026-108888","title":"CVE-2026-108888 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartRoleController exp","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartRoleController exportXls handler that allows any authenticated user to export department roles. Low-privileged attackers holding only the default minimal role can call /sys/sysDepartRole/exportXls to download all sys_depart_role records, including role names, codes, descriptions and creating users.","source":"NVD","date":"2026-10-11T15:16:56.067Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108888","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108888"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108888"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108888"}],"epss":{"score":0.00193,"date":"2026-10-12","percentile":0.08237}},{"id":"CVE-2026-108887","title":"CVE-2026-108887 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysCommentController export","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysCommentController exportXls handler that allows any authenticated user to export all comments. Low-privileged attackers can request /sys/comment/exportXls to download every sys_comment row, including comment text and user ids on records they cannot access.","source":"NVD","date":"2026-10-11T15:16:55.930Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108887","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108887"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108887"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108887"}],"epss":{"score":0.00193,"date":"2026-10-12","percentile":0.0824}},{"id":"CVE-2026-108886","title":"CVE-2026-108886 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController queryChil","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController queryChildrenByUsername handler that allows any authenticated user to retrieve other users' account records. Low-privileged attackers can supply arbitrary userId values to obtain names, emails, phone numbers, employee numbers, department assignments, and staff lists of departments those users head.","source":"NVD","date":"2026-10-11T15:16:55.800Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108886","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108886"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108886"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108886"}],"epss":{"score":0.00193,"date":"2026-10-12","percentile":0.08238}},{"id":"CVE-2026-108885","title":"CVE-2026-108885 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController delete","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController delete handler that allows low-privileged authenticated users to delete message records. Attackers can send DELETE requests with arbitrary id values to remove any sys_sms row, erasing records of sent notifications without ownership checks.","source":"NVD","date":"2026-10-11T15:16:55.670Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108885","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108885"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108885"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108885"}],"epss":{"score":0.00211,"date":"2026-10-12","percentile":0.10548}},{"id":"CVE-2026-108884","title":"CVE-2026-108884 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageTemplateControlle","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageTemplateController delete handler that allows any authenticated user to delete message templates. Low-privileged attackers can obtain template ids from the unguarded list endpoint and delete shipped notification templates, causing system notices and workflow reminders to fail.","source":"NVD","date":"2026-10-11T15:16:55.533Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108884","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108884"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108884"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108884"}],"epss":{"score":0.00211,"date":"2026-10-12","percentile":0.10548}},{"id":"CVE-2026-108883","title":"CVE-2026-108883 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the editThirdAppConfig handler ","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the editThirdAppConfig handler that allows any authenticated user to modify third-party application configurations. Low-privileged attackers can replace client id, client secret, agent id and corp id of DingTalk, WeCom or Feishu integrations to redirect directory synchronisation and messaging to attacker-controlled applications or break them.","source":"NVD","date":"2026-10-11T15:16:55.400Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108883","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108883"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108883"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108883"}],"epss":{"score":0.00213,"date":"2026-10-12","percentile":0.10729}},{"id":"CVE-2026-108882","title":"CVE-2026-108882 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController remov","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController removeUserPosition handler that allows any authenticated user to remove position members. Low-privileged attackers can send DELETE requests with arbitrary userIds and positionId values to delete sys_user_position rows, detaching users from positions without logging.","source":"NVD","date":"2026-10-11T15:16:55.263Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108882","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108882"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108882"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108882"}],"epss":{"score":0.00211,"date":"2026-10-12","percentile":0.10547}},{"id":"CVE-2026-108881","title":"CVE-2026-108881 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getTenantPackInfo handler t","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getTenantPackInfo handler that allows any authenticated user to read other tenants' product pack membership. Low-privileged attackers can supply a tenantId and fixed packCode values such as superAdmin, accountAdmin or appAdmin to disclose administrator usernames, real names, phones and departments.","source":"NVD","date":"2026-10-11T15:16:55.133Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108881","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108881"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108881"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108881"}],"epss":{"score":0.00193,"date":"2026-10-12","percentile":0.0824}},{"id":"CVE-2026-108880","title":"CVE-2026-108880 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the PUT /sys/dict/editDictByLow","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the PUT /sys/dict/editDictByLowAppId endpoint that allows any authenticated user to modify low-code application dictionaries. Attackers can supply a dictionary's low_app_id, obtained from GET /sys/dict/list, via the lowAppId parameter or X-Low-App-ID header to rename dictionaries and replace their items.","source":"NVD","date":"2026-10-11T15:16:55.000Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108880","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108880"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108880"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108880"}],"epss":{"score":0.0019,"date":"2026-10-12","percentile":0.07915}},{"id":"CVE-2026-108879","title":"CVE-2026-108879 — JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability in AiragBaseApiControl","summary":"JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability in AiragBaseApiController that allows authenticated users to read other users' AI chat variables via the username parameter. Attackers can send POST requests to /airag/api/getChatVariable with a target appId, username, and variable name to retrieve stored chat memory values from Redis.","source":"NVD","date":"2026-10-11T15:16:54.870Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108879","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108879"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108879"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108879"}],"epss":{"score":0.00193,"date":"2026-10-12","percentile":0.0824}},{"id":"CVE-2026-108878","title":"CVE-2026-108878 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragAppController queryByI","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragAppController queryById handler that allows low-privileged authenticated users to read any AI application configuration. Attackers can enumerate application ids via the unguarded /airag/app/listDict endpoint and query each id to obtain system prompts, memory prompts, model ids, knowledge base ids, and plugin bindings of other users' applications.","source":"NVD","date":"2026-10-11T15:16:54.733Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108878","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108878"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108878"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108878"}],"epss":{"score":0.00193,"date":"2026-10-12","percentile":0.08234}},{"id":"CVE-2026-108877","title":"CVE-2026-108877 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability in AiragPromptsController that all","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability in AiragPromptsController that allows any authenticated user to delete AI prompt templates by calling DELETE /airag/prompts/delete. Low-privileged attackers can obtain template ids from the unguarded GET /airag/prompts/list endpoint and logically delete any user's prompt template, making it unavailable to all users.","source":"NVD","date":"2026-10-11T15:16:54.600Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108877","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108877"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108877"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108877"}],"epss":{"score":0.00211,"date":"2026-10-12","percentile":0.10546}},{"id":"CVE-2026-108876","title":"CVE-2026-108876 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the putCancelQuit handler of Sy","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the putCancelQuit handler of SysUserController, allowing any authenticated user to cancel user resignations. Low-privileged attackers can supply user ids and a tenantId parameter or X-Tenant-Id header to restore ended, pending, or refused tenant memberships to normal.","source":"NVD","date":"2026-10-11T15:16:54.463Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108876","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108876"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108876"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108876"}],"epss":{"score":0.0019,"date":"2026-10-12","percentile":0.07918}},{"id":"CVE-2026-108875","title":"CVE-2026-108875 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController addSysUse","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController addSysUserGroup handler that allows any authenticated user to modify user group membership. Low-privileged attackers can send POST requests with arbitrary user ids and a groupId to add any users to administrator-maintained groups without permission checks.","source":"NVD","date":"2026-10-11T15:16:54.330Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108875","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108875"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108875"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108875"}],"epss":{"score":0.0019,"date":"2026-10-12","percentile":0.07917}},{"id":"CVE-2026-108874","title":"CVE-2026-108874 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to assign or remove department heads by calling PUT /sys/user/changeDepartChargePerson. Low-privileged attackers can supply arbitrary userId, department id, and status values to make any user a department head, widening department-scoped views, or demote existing heads.","source":"NVD","date":"2026-10-11T15:16:54.193Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108874","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108874"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108874"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108874"}],"epss":{"score":0.0019,"date":"2026-10-12","percentile":0.07916}},{"id":"CVE-2026-108873","title":"CVE-2026-108873 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authent","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify any department by calling PUT /sys/user/doUpdateDepartInfo. Attackers can supply a department id to rename or re-parent it and replace or remove its department heads without ownership or tenant checks.","source":"NVD","date":"2026-10-11T15:16:54.060Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108873","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108873"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108873"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108873"}],"epss":{"score":0.0019,"date":"2026-10-12","percentile":0.07918}},{"id":"CVE-2026-108872","title":"CVE-2026-108872 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the batchEditUsers handler of S","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the batchEditUsers handler of SysUserController that allows any authenticated user to edit user department assignments. Low-privileged attackers can send PUT requests to /sys/user/batchEditUsers with arbitrary user and department ids to move users, including administrators, between departments and overwrite positions.","source":"NVD","date":"2026-10-11T15:16:53.910Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108872","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108872"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108872"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108872"}],"epss":{"score":0.0019,"date":"2026-10-12","percentile":0.07917}},{"id":"CVE-2026-108871","title":"CVE-2026-108871 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDatarule handler of Sys","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDatarule handler of SysDepartRoleController that lets low-privileged authenticated users modify department role data rules. Attackers can send crafted permissionId, roleId and dataRuleIds values to overwrite data_rule_ids, widening row-level data access or altering filtering for other department roles.","source":"NVD","date":"2026-10-11T15:16:53.777Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108871","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108871"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108871"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108871"}],"epss":{"score":0.00171,"date":"2026-10-12","percentile":0.05978}},{"id":"CVE-2026-108870","title":"CVE-2026-108870 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysRoleController saveDatar","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysRoleController saveDatarule handler that allows low-privileged authenticated users to modify role data rules. Attackers can send permissionId, roleId and dataRuleIds to overwrite data_rule_ids, clearing row-level filters to widen readable records or altering filtering for other roles.","source":"NVD","date":"2026-10-11T15:16:53.643Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108870","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108870"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108870"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108870"}],"epss":{"score":0.00171,"date":"2026-10-12","percentile":0.05979}},{"id":"CVE-2026-108869","title":"CVE-2026-108869 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authent","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to send system announcements by calling POST /sys/api/sendSysAnnouncement. Attackers can supply arbitrary title, content, fromUser and toUser values to deliver forged announcements to any users via WebSocket, WeCom, DingTalk and Feishu.","source":"NVD","date":"2026-10-11T15:16:53.510Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108869","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108869"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108869"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108869"}],"epss":{"score":0.00206,"date":"2026-10-12","percentile":0.09796}},{"id":"CVE-2026-108868","title":"CVE-2026-108868 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to publish templated system announcements via POST /sys/api/sendBusTemplateAnnouncement. Low-privileged attackers can supply templateCode, toUser, and a forged fromUser to send notifications to arbitrary users through WebSocket, DingTalk, WeCom, Feishu and UniPush channels.","source":"NVD","date":"2026-10-11T15:16:53.380Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108868","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108868"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108868"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108868"}],"epss":{"score":0.00206,"date":"2026-10-12","percentile":0.09796}},{"id":"CVE-2026-108867","title":"CVE-2026-108867 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SystemApiController getUser","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SystemApiController getUserRoleSetById handler that allows any authenticated user to read other users' role assignments. Low-privileged attackers can supply an arbitrary userId parameter to retrieve assigned role codes and identify administrator accounts without the system:user:queryUserRole permission.","source":"NVD","date":"2026-10-11T15:16:53.247Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108867","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108867"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108867"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108867"}],"epss":{"score":0.00193,"date":"2026-10-12","percentile":0.08235}},{"id":"CVE-2026-108866","title":"CVE-2026-108866 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows authenticated users to","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows authenticated users to read any account's permissions via the queryUserAuths handler. Low-privileged attackers can supply an arbitrary userId parameter to retrieve another user's complete permission set and identify administrator accounts.","source":"NVD","date":"2026-10-11T15:16:53.110Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108866","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108866"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108866"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108866"}],"epss":{"score":0.00193,"date":"2026-10-12","percentile":0.08235}},{"id":"CVE-2026-108684","title":"CVE-2026-108684 — A vulnerability was detected in erzhongxmu Jeewms up to 3.7. This affects the function getTreeData of the","summary":"A vulnerability was detected in erzhongxmu Jeewms up to 3.7. This affects the function getTreeData of the file src/main/java/com/jeecg/demo/controller/JeecgFormDemoController.java of the component Autocomplete Data Handler. Performing a manipulation of the argument searchVal results in sql injection. The attack can be initiated remotely. The patch is named 6e29bd57972a499e9c8a81a2dbe94d0d5cf23af0. It is recommended to apply a patch to fix this issue.","source":"NVD","date":"2026-10-11T15:16:52.947Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108684","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108684"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108684"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108684"}],"epss":{"score":0.00256,"date":"2026-10-12","percentile":0.15846}},{"id":"CVE-2026-108683","title":"CVE-2026-108683 — A security vulnerability has been detected in zhayujie CowAgent up to 2.1.9. The impacted element is an u","summary":"A security vulnerability has been detected in zhayujie CowAgent up to 2.1.9. The impacted element is an unknown function of the component Media Download Handler. Such manipulation leads to uncontrolled memory allocation. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.2.0 is sufficient to resolve this issue. The name of the patch is b7967210268fc4c0afea1078223e74e7e96a8a54. You should upgrade the affected component.","source":"NVD","date":"2026-10-11T15:16:52.780Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108683","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108683"],"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108683"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108683"}],"epss":{"score":0.0031,"date":"2026-10-12","percentile":0.21977}},{"id":"CVE-2026-108682","title":"CVE-2026-108682 — A weakness has been identified in zhayujie CowAgent up to 2.1.6. The affected element is the function rea","summary":"A weakness has been identified in zhayujie CowAgent up to 2.1.6. The affected element is the function read of the file /upload of the component Web Console. This manipulation causes denial of service. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-11T15:16:52.610Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108682","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108682"],"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108682"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108682"}],"epss":{"score":0.00398,"date":"2026-10-12","percentile":0.32012}},{"id":"CVE-2026-108865","title":"CVE-2026-108865 — AmoyLab Unla through 0.10.0 contains an authentication bypass vulnerability that allows unauthenticated a","summary":"AmoyLab Unla through 0.10.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid access tokens because the OAuth2 server never authenticates a resource owner. Attackers can register a client, request a code from /authorize, and exchange it at /token to access OAuth2-protected MCP prefixes, proxied upstream APIs and injected credentials.","source":"NVD","date":"2026-10-11T14:17:06.640Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108865","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108865"],"cvss":{"score":8.8,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108865"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108865"}],"epss":{"score":0.00324,"date":"2026-10-12","percentile":0.23528}},{"id":"CVE-2026-108864","title":"CVE-2026-108864 — iFlytek Astron Agent through 1.1.2 contains an insecure direct object reference vulnerability that allows","summary":"iFlytek Astron Agent through 1.1.2 contains an insecure direct object reference vulnerability that allows authenticated applications to resume other applications' paused workflows by supplying their event_id to POST /workflow/v1/resume. Attackers can predict Snowflake event IDs to inject resume content into victim workflows and read their continuation output stream, breaking cross-tenant isolation.","source":"NVD","date":"2026-10-11T14:17:06.500Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108864","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108864"],"cvss":{"score":2.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108864"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108864"}],"epss":{"score":0.00169,"date":"2026-10-12","percentile":0.05711}},{"id":"CVE-2026-108863","title":"CVE-2026-108863 — Katanemo Plano through 0.4.37 contains a missing authentication vulnerability that allows unauthenticated","summary":"Katanemo Plano through 0.4.37 contains a missing authentication vulnerability that allows unauthenticated network attackers to access the Envoy admin interface, which is bound to all host interfaces on port 9901. Attackers can request the /config_dump endpoint to read configured LLM provider API keys in plaintext from the WASM filter configuration.","source":"NVD","date":"2026-10-11T14:17:06.360Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108863","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108863"],"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108863"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108863"}],"epss":{"score":0.00423,"date":"2026-10-12","percentile":0.34718}},{"id":"CVE-2026-108862","title":"CVE-2026-108862 — APIPark through 1.9.7-beta contains an insecure direct object reference vulnerability that allows authent","summary":"APIPark through 1.9.7-beta contains an insecure direct object reference vulnerability that allows authenticated users to read other applications' credentials by supplying a foreign authorization UUID. Attackers with authorization-view permission on one application can query /api/v1/app/authorization or its details route to retrieve plaintext API keys regardless of HideCredential.","source":"NVD","date":"2026-10-11T14:17:06.220Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108862","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108862"],"cvss":{"score":6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108862"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108862"}],"epss":{"score":0.00227,"date":"2026-10-12","percentile":0.12418}},{"id":"CVE-2026-108861","title":"CVE-2026-108861 — Odoo MCP 1.0.0 through 1.3.2 contains an information disclosure vulnerability that allows MCP clients to ","summary":"Odoo MCP 1.0.0 through 1.3.2 contains an information disclosure vulnerability that allows MCP clients to bypass the field-level ACL by invoking the execute_method tool. Attackers or prompt-injected agents can call read or search_read through execute_method naming denied fields to receive their values unredacted.","source":"NVD","date":"2026-10-11T14:17:06.077Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108861","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108861"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108861"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108861"}],"epss":{"score":0.00233,"date":"2026-10-12","percentile":0.13109}},{"id":"CVE-2026-108860","title":"CVE-2026-108860 — BotSharp through 5.2.0 contains an authentication bypass vulnerability that allows unauthenticated remote","summary":"BotSharp through 5.2.0 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge bearer tokens using the hard-coded Jwt:Key in WebStarter appsettings.json. Attackers can sign tokens with the committed HMAC secret and fixed botsharp issuer and audience to impersonate any known user, including administrators, on Authorize-protected API routes.","source":"NVD","date":"2026-10-11T14:17:05.933Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108860","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108860"],"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108860"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108860"}],"epss":{"score":0.00476,"date":"2026-10-12","percentile":0.39334}},{"id":"CVE-2026-108859","title":"CVE-2026-108859 — mcp-go through 1.2.1 contains a denial of service vulnerability in StreamableHTTPServer.ServeHTTP that al","summary":"mcp-go through 1.2.1 contains a denial of service vulnerability in StreamableHTTPServer.ServeHTTP that allows remote unauthenticated attackers to exhaust memory by sending oversized POST bodies. Attackers can send arbitrarily large or many concurrent POST requests, read fully via io.ReadAll before validation, to degrade or OOM-kill the server process.","source":"NVD","date":"2026-10-11T14:17:05.780Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108859","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108859"],"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108859"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108859"}],"epss":{"score":0.00545,"date":"2026-10-12","percentile":0.4414}},{"id":"CVE-2026-108858","title":"CVE-2026-108858 — Predibase LoRAX through 0.12.1 contains a sensitive information exposure vulnerability that writes the ca","summary":"Predibase LoRAX through 0.12.1 contains a sensitive information exposure vulnerability that writes the caller-supplied api_token from POST /generate request bodies into router logs. Attackers with access to router logs or OTLP trace backends can recover other users' private-adapter tokens recorded through the instrumented GenerateParameters span field.","source":"NVD","date":"2026-10-11T14:17:05.640Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108858","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108858"],"cvss":{"score":6.8,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108858"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108858"}],"epss":{"score":0.00114,"date":"2026-10-12","percentile":0.0139}},{"id":"CVE-2026-108857","title":"CVE-2026-108857 — Hugging Face Text Embeddings Inference through 1.9.4 contains a cleartext logging vulnerability that expo","summary":"Hugging Face Text Embeddings Inference through 1.9.4 contains a cleartext logging vulnerability that exposes the configured api_key because the router's Args struct lacks a redact attribute for it. Attackers with access to router logs, container output, or OTLP telemetry can recover the Bearer token and call the protected embedding and rerank endpoints.","source":"NVD","date":"2026-10-11T14:17:05.503Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108857","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108857"],"cvss":{"score":4.8,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108857"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108857"}],"epss":{"score":0.0011,"date":"2026-10-12","percentile":0.01211}},{"id":"CVE-2026-108856","title":"CVE-2026-108856 — UnicomAI Wanwu through 0.6.5 contains an authorization bypass vulnerability that allows authenticated use","summary":"UnicomAI Wanwu through 0.6.5 contains an authorization bypass vulnerability that allows authenticated users to mint AppKeys bound to other users' MCP servers via POST /v1/appspace/app/key. Attackers supplying a victim's MCP server UUID with appType mcpserver can open MCP sessions and invoke the server's tools using the victim's upstream authentication.","source":"NVD","date":"2026-10-11T14:17:05.370Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108856","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108856"],"cvss":{"score":2.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108856"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108856"}],"epss":{"score":0.0022,"date":"2026-10-12","percentile":0.11612}},{"id":"CVE-2026-108855","title":"CVE-2026-108855 — UnicomAI Wanwu through 0.6.5 contains a missing authorization vulnerability that allows any authenticated","summary":"UnicomAI Wanwu through 0.6.5 contains a missing authorization vulnerability that allows any authenticated enabled user to revoke other users' AppKeys for arbitrary apps via the unpublish endpoint. Attackers can supply a target appId and appType from the exploration marketplace to delete other users' api_key rows across organizations, cutting off MCP and OpenAPI client access.","source":"NVD","date":"2026-10-11T14:17:05.233Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108855","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108855"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108855"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108855"}],"epss":{"score":0.00219,"date":"2026-10-12","percentile":0.11338}},{"id":"CVE-2026-108854","title":"CVE-2026-108854 — Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows any authenticat","summary":"Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows any authenticated enabled user to delete other users' legacy AppKeys by supplying a numeric apiId. Attackers can iterate sequential key IDs against DELETE /v1/appspace/app/key to revoke AppKeys across organizations, breaking MCP and OpenAPI clients until owners issue new keys.","source":"NVD","date":"2026-10-11T14:17:05.100Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108854","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108854"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108854"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108854"}],"epss":{"score":0.00227,"date":"2026-10-12","percentile":0.1243}},{"id":"CVE-2026-108853","title":"CVE-2026-108853 — UnicomAI Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows authen","summary":"UnicomAI Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to delete other tenants' agent or RAG applications by supplying their appId. Attackers can send requests to DELETE /v1/appspace/app with guessed sequential assistant IDs to permanently delete victims' applications, workflows, conversations, and associated data.","source":"NVD","date":"2026-10-11T14:17:04.960Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108853","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108853"],"cvss":{"score":7.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108853"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108853"}],"epss":{"score":0.00294,"date":"2026-10-12","percentile":0.20348}},{"id":"CVE-2026-108852","title":"CVE-2026-108852 — Deep Chat through 2.5.1 contains a cross-site scripting vulnerability that allows attackers to inject jav","summary":"Deep Chat through 2.5.1 contains a cross-site scripting vulnerability that allows attackers to inject javascript: links because RemarkableConfig.createNew disables Remarkable link validation. Attackers can place crafted Markdown links in AI responses, addMessage content, or loaded history to execute script in the embedding page when victims click them.","source":"NVD","date":"2026-10-11T14:17:04.827Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108852","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108852"],"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108852"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108852"}],"epss":{"score":0.00185,"date":"2026-10-12","percentile":0.0741}},{"id":"CVE-2026-108851","title":"CVE-2026-108851 — phpMyFAQ through 4.1.10 contains a missing authorization vulnerability in the MCP server faq_search tool ","summary":"phpMyFAQ through 4.1.10 contains a missing authorization vulnerability in the MCP server faq_search tool that allows MCP clients to read restricted FAQs because Search::searchDatabase() never applies user or group permission checks. Attackers connected to the phpmyfaq:mcp:server can issue search queries to retrieve the full question and answer text of active FAQs restricted to specific users or groups.","source":"NVD","date":"2026-10-11T14:17:04.667Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108851","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108851"],"cvss":{"score":4.8,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108851"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108851"}],"epss":{"score":0.00101,"date":"2026-10-12","percentile":0.00857}},{"id":"CVE-2026-108850","title":"CVE-2026-108850 — Company Research Agent through 2.2.0 contains a server-side request forgery vulnerability that allows una","summary":"Company Research Agent through 2.2.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound requests by injecting unescaped ReportLab paragraph markup into the /generate-pdf endpoint. Attackers can embed inline img elements in report_content to make the server fetch internal or external hosts, leaking image responses in returned PDFs and probing reachability.","source":"NVD","date":"2026-10-11T14:17:04.530Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108850","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108850"],"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108850"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108850"}],"epss":{"score":0.00239,"date":"2026-10-12","percentile":0.13811}},{"id":"CVE-2026-108839","title":"CVE-2026-108839 — thClaws through 0.141.0 contains a link-following vulnerability in the post_inputs handler of the v1 API ","summary":"thClaws through 0.141.0 contains a link-following vulnerability in the post_inputs handler of the v1 API POST /v1/inputs endpoint that allows writes outside the workspace by following symlinks. Attackers who plant a symlink under the allowed inputs/ prefix can cause later authenticated uploads to write or truncate files outside the workspace with daemon privileges.","source":"NVD","date":"2026-10-11T14:17:04.390Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108839","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108839"],"cvss":{"score":2.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108839"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108839"}],"epss":{"score":0.00251,"date":"2026-10-12","percentile":0.15206}},{"id":"CVE-2026-108699","title":"CVE-2026-108699 — hyper-mcp through 0.8.3 contains an improper signature verification vulnerability that allows attackers t","summary":"hyper-mcp through 0.8.3 contains an improper signature verification vulnerability that allows attackers to load malicious WebAssembly plugins because cosign_verify_args() accepts any signer identity and OIDC issuer by default. Attackers controlling a plugin image reference can sign a malicious image with a free Sigstore keyless certificate to execute plugins with configured host, filesystem, and environment capabilities.","source":"NVD","date":"2026-10-11T14:17:04.257Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108699","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108699"],"cvss":{"score":8.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108699"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108699"}],"epss":{"score":0.00123,"date":"2026-10-12","percentile":0.01852}},{"id":"CVE-2026-108698","title":"CVE-2026-108698 — hyper-mcp through 0.8.3 contains a signature verification bypass vulnerability in load_wasm in src/wasm/o","summary":"hyper-mcp through 0.8.3 contains a signature verification bypass vulnerability in load_wasm in src/wasm/oci.rs that verifies the Cosign signature of a separately resolved tag rather than the loaded manifest. Attackers controlling registry responses for the tag can serve an unsigned malicious manifest to the loader and a signed one to Cosign, executing unsigned WebAssembly plugins with configured host capabilities.","source":"NVD","date":"2026-10-11T14:17:04.113Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108698","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108698"],"cvss":{"score":8.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108698"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108698"}],"epss":{"score":0.00243,"date":"2026-10-12","percentile":0.14276}},{"id":"CVE-2026-108697","title":"CVE-2026-108697 — CoreShop through 2026.2.2 contains a missing authorization vulnerability that allows low-privileged backe","summary":"CoreShop through 2026.2.2 contains a missing authorization vulnerability that allows low-privileged backend users to list permission-restricted resources because ResourceController listAction skips the isGrantedOr403() check. Authenticated Pimcore users lacking resource permissions can request the generated list routes to enumerate payment providers, carriers, price rules, stores, and tax rules including ids, names, and identifiers.","source":"NVD","date":"2026-10-11T14:17:03.973Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108697","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108697"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108697"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108697"}],"epss":{"score":0.00199,"date":"2026-10-12","percentile":0.08994}},{"id":"CVE-2026-108681","title":"CVE-2026-108681 — A security flaw has been discovered in zhayujie CowAgent up to 2.1.7. Impacted is an unknown function of ","summary":"A security flaw has been discovered in zhayujie CowAgent up to 2.1.7. Impacted is an unknown function of the file channel/web/web_channel.py of the component Web Console. The manipulation of the argument session_id results in denial of service. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. Version 2.1.7 (commit dec28324) only partly mitigates via a 512MB body cap. The vendor was contacted early about this disclosure.","source":"NVD","date":"2026-10-11T14:17:03.220Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108681","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108681"],"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108681"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108681"}],"epss":{"score":0.00451,"date":"2026-10-12","percentile":0.3732}},{"id":"CVE-2026-108760","title":"CVE-2026-108760 — LlamaFarm through 0.0.34 contains an insecure default configuration that binds its unauthenticated FastAP","summary":"LlamaFarm through 0.0.34 contains an insecure default configuration that binds its unauthenticated FastAPI server to 0.0.0.0 on port 14345, while the lf CLI silently discards HOST overrides. Network-adjacent attackers can call the project and dataset management API to read stored provider API keys, modify projects, trigger ingestion, and irreversibly delete projects.","source":"NVD","date":"2026-10-11T13:17:21.310Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108760","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108760"],"cvss":{"score":7.2,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108760"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108760"}],"epss":{"score":0.00242,"date":"2026-10-12","percentile":0.14141}},{"id":"CVE-2026-108759","title":"CVE-2026-108759 — mistral.rs 0.9.0 through 0.9.4 contains a link following vulnerability in mistralrs-code-exec that allows","summary":"mistral.rs 0.9.0 through 0.9.4 contains a link following vulnerability in mistralrs-code-exec that allows sandboxed shell code to read and overwrite files outside the sandbox via symlinks. Attackers or prompt-injected agents can name symlinks as outputs or reuse sessions with symlinked input paths to access files with the server process's permissions.","source":"NVD","date":"2026-10-11T13:17:21.167Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108759","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108759"],"cvss":{"score":7.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108759"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108759"}],"epss":{"score":0.00321,"date":"2026-10-12","percentile":0.23176}},{"id":"CVE-2026-108758","title":"CVE-2026-108758 — Easy!Appointments through 1.6.0 contains an authorization bypass vulnerability in Booking::register() tha","summary":"Easy!Appointments through 1.6.0 contains an authorization bypass vulnerability in Booking::register() that allows unauthenticated attackers to modify any appointment by supplying an appointment id without its hash. Attackers can enumerate sequential appointment ids with a self-asserted manage_mode flag to rewrite appointment details, rebind them to attacker-controlled customers, and obtain management hashes for rescheduling or cancellation.","source":"NVD","date":"2026-10-11T13:17:21.020Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108758","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108758"],"cvss":{"score":8.8,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108758"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108758"}],"epss":{"score":0.00262,"date":"2026-10-12","percentile":0.16615}},{"id":"CVE-2026-108757","title":"CVE-2026-108757 — Nexting pinclaw OpenClaw channel plugin through 0.3.0 contains a missing authentication vulnerability in ","summary":"Nexting pinclaw OpenClaw channel plugin through 0.3.0 contains a missing authentication vulnerability in src/core/http-router.ts that skips the authToken check on POST /pinclaw/send. Unauthenticated attackers reaching port 18790, which binds all interfaces by default, can inject blind prompts into the user's main OpenClaw agent session as user instructions.","source":"NVD","date":"2026-10-11T13:17:20.840Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108757","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108757"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108757"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108757"}],"epss":{"score":0.00229,"date":"2026-10-12","percentile":0.12622}},{"id":"CVE-2026-108756","title":"CVE-2026-108756 — Abilityai Trinity through 0.9.5 contains a missing authorization vulnerability in the Telegram router tha","summary":"Abilityai Trinity through 0.9.5 contains a missing authorization vulnerability in the Telegram router that allows agent-scoped MCP API keys to perform human-only binding operations. Attackers controlling an agent, typically via prompt injection, can send messages through the owner's bot token, replace the binding with their own token, or delete it.","source":"NVD","date":"2026-10-11T13:17:20.680Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108756","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108756"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108756"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108756"}],"epss":{"score":0.00219,"date":"2026-10-12","percentile":0.11338}},{"id":"CVE-2026-108755","title":"CVE-2026-108755 — Hatchet through 0.110.5 contains an allocation of resources without limits vulnerability that allows unau","summary":"Hatchet through 0.110.5 contains an allocation of resources without limits vulnerability that allows unauthenticated attackers to exhaust memory via the SNS ingestion endpoint. Attackers can send arbitrarily large or concurrent request bodies to POST /api/v1/sns/{tenant}/{event} with any UUID, which the SnsUpdate handler buffers before signature verification, degrading availability.","source":"NVD","date":"2026-10-11T13:17:20.517Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108755","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108755"],"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108755"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108755"}],"epss":{"score":0.00315,"date":"2026-10-12","percentile":0.22515}},{"id":"CVE-2026-108754","title":"CVE-2026-108754 — GPT-Load through 1.4.11 contains a cleartext logging vulnerability that exposes client proxy keys because","summary":"GPT-Load through 1.4.11 contains a cleartext logging vulnerability that exposes client proxy keys because the Gin Logger middleware records the raw query string before extractAuthKey strips the key parameter. Attackers with read access to console logs or ./data/logs/app.log can recover proxy keys from Gemini-style requests and use them against the corresponding group.","source":"NVD","date":"2026-10-11T13:17:20.380Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108754","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108754"],"cvss":{"score":4.8,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108754"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108754"}],"epss":{"score":0.0011,"date":"2026-10-12","percentile":0.01211}},{"id":"CVE-2026-108753","title":"CVE-2026-108753 — Agnaistic agnai through 1.0.555 contains a hard-coded credentials vulnerability in self-host.docker-compo","summary":"Agnaistic agnai through 1.0.555 contains a hard-coded credentials vulnerability in self-host.docker-compose.yml, which sets a fixed admin password and public JWT secret. Unauthenticated attackers can log in as admin or sign their own JWT with admin: true to impersonate users, reset passwords, and change server configuration.","source":"NVD","date":"2026-10-11T13:17:20.237Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108753","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108753"],"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108753"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108753"}],"epss":{"score":0.00342,"date":"2026-10-12","percentile":0.2581}},{"id":"CVE-2026-108752","title":"CVE-2026-108752 — JupyterHub through 6.0.1 contains an identifier collision vulnerability that allows authenticated users t","summary":"JupyterHub through 6.0.1 contains an identifier collision vulnerability that allows authenticated users to overwrite another user's named-server OAuth client by registering a hyphenated username. Attackers holding a name like alice-prod can overwrite the client for alice's server prod, breaking OAuth login and revoking tokens by stopping their own server.","source":"NVD","date":"2026-10-11T13:17:20.097Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108752","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108752"],"cvss":{"score":2.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108752"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108752"}],"epss":{"score":0.00245,"date":"2026-10-12","percentile":0.14533}},{"id":"CVE-2026-108751","title":"CVE-2026-108751 — MoAI-ADK through 3.1.2 contains an improper link resolution vulnerability in the moai init template deplo","summary":"MoAI-ADK through 3.1.2 contains an improper link resolution vulnerability in the moai init template deployer that allows malicious repositories to overwrite files outside the project via a symlinked .moai-tmp staging path. Attackers can commit a symlink such as .claude/settings.json.moai-tmp so atomicWriteFile truncates and overwrites victim-writable files with MoAI template content.","source":"NVD","date":"2026-10-11T13:17:19.957Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108751","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108751"],"cvss":{"score":4.8,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108751"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108751"}],"epss":{"score":0.00142,"date":"2026-10-12","percentile":0.03004}},{"id":"CVE-2026-108750","title":"CVE-2026-108750 — OpenDocMan 2.4.0 through 2.10.0 contains a decompression bomb vulnerability that allows authenticated use","summary":"OpenDocMan 2.4.0 through 2.10.0 contains a decompression bomb vulnerability that allows authenticated users to exhaust PHP memory by uploading crafted office documents. Attackers can upload a small ODT, DOCX, or XLSX file whose XML entries decompress to hundreds of megabytes, crashing PHP workers and degrading availability.","source":"NVD","date":"2026-10-11T13:17:19.810Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108750","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108750"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108750"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108750"}],"epss":{"score":0.00268,"date":"2026-10-12","percentile":0.17488}},{"id":"CVE-2026-108749","title":"CVE-2026-108749 — docling-serve 1.14.0 through 1.36.0 contains a missing authentication vulnerability that allows unauthent","summary":"docling-serve 1.14.0 through 1.36.0 contains a missing authentication vulnerability that allows unauthenticated attackers to access /v1/memory/stats and /v1/memory/counts because they omit the require_auth dependency. Attackers can bypass the configured DOCLING_SERVE_API_KEY to read process and cgroup memory telemetry, object type histograms, and force repeated gc.collect() heap enumeration.","source":"NVD","date":"2026-10-11T13:17:19.670Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108749","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108749"],"cvss":{"score":6.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108749"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108749"}],"epss":{"score":0.00296,"date":"2026-10-12","percentile":0.20516}},{"id":"CVE-2026-108748","title":"CVE-2026-108748 — Quarkus LangChain4j 1.9.0 through 1.14.1 contains a missing release of memory vulnerability in the chat-s","summary":"Quarkus LangChain4j 1.9.0 through 1.14.1 contains a missing release of memory vulnerability in the chat-scopes WebSocket /_chat/routes endpoint that allows unauthenticated remote clients to exhaust server memory. Attackers can send repeated CONNECT frames reusing one chatId, leaving orphaned scopes in activeScopes until the JVM exits and degrading availability.","source":"NVD","date":"2026-10-11T13:17:19.523Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108748","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108748"],"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108748"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108748"}],"epss":{"score":0.00301,"date":"2026-10-12","percentile":0.21086}},{"id":"CVE-2026-108747","title":"CVE-2026-108747 — Lightdash through 2.556.0 contains an authorization bypass vulnerability that allows authenticated organi","summary":"Lightdash through 2.556.0 contains an authorization bypass vulnerability that allows authenticated organization members to delete other users' personal access tokens by supplying their UUID. Attackers can send DELETE requests to the personal-access-tokens route with a victim's token UUID, even across organizations, to revoke it and break API integrations.","source":"NVD","date":"2026-10-11T13:17:19.367Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108747","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108747"],"cvss":{"score":2.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108747"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108747"}],"epss":{"score":0.00212,"date":"2026-10-12","percentile":0.10614}},{"id":"CVE-2026-108746","title":"CVE-2026-108746 — Vearch 3.5.2 through 3.5.9 contains an incorrect authorization vulnerability in Role.HasPermissionForReso","summary":"Vearch 3.5.2 through 3.5.9 contains an incorrect authorization vulnerability in Role.HasPermissionForResources that ignores stored ReadOnly or None privilege levels for resources listed in a role. Authenticated non-root users can upsert and delete documents with read-only access, or call PUT /roles to grant their role WriteRead privileges, escalating toward cluster administrator access.","source":"NVD","date":"2026-10-11T13:17:19.230Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108746","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108746"],"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108746"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108746"}],"epss":{"score":0.00283,"date":"2026-10-12","percentile":0.19236}},{"id":"CVE-2026-108745","title":"CVE-2026-108745 — CloudBeaver through 25.3.5 contains a missing authorization vulnerability in WebSQLResultServlet that all","summary":"CloudBeaver through 25.3.5 contains a missing authorization vulnerability in WebSQLResultServlet that allows any web session holder to read other users' LOB export files from a shared folder. Attackers can guess table and column names and enumerate second-resolution timestamps to download victims' LOB values, including data from connections they cannot query.","source":"NVD","date":"2026-10-11T13:17:19.097Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108745","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108745"],"cvss":{"score":2.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108745"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108745"}],"epss":{"score":0.00207,"date":"2026-10-12","percentile":0.09923}},{"id":"CVE-2026-108744","title":"CVE-2026-108744 — pbi-cli 3.10.1 through 3.12.0 contains an OS command injection vulnerability in desktop_sync.py that pass","summary":"pbi-cli 3.10.1 through 3.12.0 contains an OS command injection vulnerability in desktop_sync.py that passes unquoted .pbip paths to cmd /c start when reopening projects. Attackers can lure victims into opening a Power BI project from a space-free path containing & to run commands with victim privileges during report write or reload.","source":"NVD","date":"2026-10-11T13:17:18.957Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108744","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108744"],"cvss":{"score":7.3,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108744"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108744"}],"epss":{"score":0.00547,"date":"2026-10-12","percentile":0.44214}},{"id":"CVE-2026-108742","title":"CVE-2026-108742 — CloudBeaver through 25.3.5 contains a missing authorization vulnerability in the initConnection GraphQL m","summary":"CloudBeaver through 25.3.5 contains a missing authorization vulnerability in the initConnection GraphQL mutation that lets view-only shared-project members persist credentials without datasource-edit permission. Attackers can set saveCredentials and sharedCredentials flags with chosen authProperties so other users connect to the shared connection under the attacker's database identity.","source":"NVD","date":"2026-10-11T13:17:18.810Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108742","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108742"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108742"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108742"}],"epss":{"score":0.00196,"date":"2026-10-12","percentile":0.08554}},{"id":"CVE-2026-108741","title":"CVE-2026-108741 — Shepherd (shepherd-ai) through 0.3.1 contains a server-side request forgery guard bypass in the citation-","summary":"Shepherd (shepherd-ai) through 0.3.1 contains a server-side request forgery guard bypass in the citation-checker extra because the public_url guard validates a resolved address but fetch re-resolves the hostname at connect time. Attackers who plant a crafted reference URL in a checked document and control its DNS can rebind it to internal addresses, sending GET requests to internal HTTP(S) services and capturing responses in evidence files.","source":"NVD","date":"2026-10-11T13:17:18.673Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108741","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108741"],"cvss":{"score":2.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108741"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108741"}],"epss":{"score":0.00182,"date":"2026-10-12","percentile":0.07134}},{"id":"CVE-2026-108740","title":"CVE-2026-108740 — GoatCounter through 2.7.0 contains a mass assignment privilege escalation vulnerability in the userPrefSa","summary":"GoatCounter through 2.7.0 contains a mass assignment privilege escalation vulnerability in the userPrefSave handler that allows logged-in users to modify protected account fields via form-encoded requests. Attackers with read-only access can POST user.access[all]=* and user.email_verified=true to /user/pref, bypassing readonly tags to gain superuser or admin access.","source":"NVD","date":"2026-10-11T13:17:18.527Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108740","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108740"],"cvss":{"score":7.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108740"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108740"}],"epss":{"score":0.00328,"date":"2026-10-12","percentile":0.24039}},{"id":"CVE-2026-108739","title":"CVE-2026-108739 — OpenAgents Workspace backend through launcher-v1.0.17 contains an information disclosure vulnerability th","summary":"OpenAgents Workspace backend through launcher-v1.0.17 contains an information disclosure vulnerability that allows unauthenticated attackers to list all workspaces via GET /v1/workspaces. Attackers can read the unmasked browserfabric_api_key in each workspace's settings map, along with workspace ids, slugs, creator emails and member lists.","source":"NVD","date":"2026-10-11T13:17:18.383Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108739","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108739"],"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108739"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108739"}],"epss":{"score":0.00323,"date":"2026-10-12","percentile":0.23401}},{"id":"CVE-2026-108738","title":"CVE-2026-108738 — Traccar 5.7 through 6.16.0 contains a cross-site request forgery vulnerability that allows attackers to l","summary":"Traccar 5.7 through 6.16.0 contains a cross-site request forgery vulnerability that allows attackers to log victims into attacker-controlled accounts because the OpenID Connect callback never validates the OAuth state parameter. Attackers can induce a victim's browser to load /api/session/openid/callback with their own authorization code, causing data the victim enters, such as registered devices, to land in the attacker's account.","source":"NVD","date":"2026-10-11T13:17:18.220Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108738","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108738"],"cvss":{"score":2.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108738"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108738"}],"epss":{"score":0.00113,"date":"2026-10-12","percentile":0.01356}},{"id":"CVE-2026-108737","title":"CVE-2026-108737 — Traccar through 6.16.0 contains a weak password recovery vulnerability that allows attackers to reuse pas","summary":"Traccar through 6.16.0 contains a weak password recovery vulnerability that allows attackers to reuse password reset tokens as session credentials because TokenManager does not bind tokens to a purpose. Attackers holding a leaked reset link can obtain a full session via /api/session or change passwords via /api/password/update, retaining access for seven days even after the victim resets their password.","source":"NVD","date":"2026-10-11T13:17:18.053Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108737","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108737"],"cvss":{"score":7.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108737"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108737"}],"epss":{"score":0.00253,"date":"2026-10-12","percentile":0.15518}},{"id":"CVE-2026-108736","title":"CVE-2026-108736 — Speedtest Tracker through 1.15.0 contains an IP allowlist bypass vulnerability that allows unauthenticate","summary":"Speedtest Tracker through 1.15.0 contains an IP allowlist bypass vulnerability that allows unauthenticated remote attackers to evade ALLOWED_IPS and Prometheus allowlists by spoofing X-Forwarded-For headers. Because bootstrap/app.php trusts every peer as a proxy, attackers can supply an allowlisted address to read /prometheus metrics and reach protected web and API endpoints.","source":"NVD","date":"2026-10-11T13:17:17.913Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108736","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108736"],"cvss":{"score":6.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108736"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108736"}],"epss":{"score":0.00206,"date":"2026-10-12","percentile":0.09745}},{"id":"CVE-2026-108735","title":"CVE-2026-108735 — Miniflux 2.3.0 through 2.3.3 contains a server-side request forgery vulnerability that allows authenticat","summary":"Miniflux 2.3.0 through 2.3.3 contains a server-side request forgery vulnerability that allows authenticated users to reach internal addresses by setting a feed's proxy_url. Attackers can point proxy_url at loopback or internal hosts, bypassing FETCHER_ALLOW_PRIVATE_NETWORKS checks to probe internal ports and send proxy-style requests to internal services.","source":"NVD","date":"2026-10-11T13:17:17.767Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108735","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108735"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108735"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108735"}],"epss":{"score":0.00269,"date":"2026-10-12","percentile":0.17602}},{"id":"CVE-2026-108734","title":"CVE-2026-108734 — Frappe CRM 1.49.0 through 1.87.0 contains a missing authorization vulnerability in crm.api.doc.get_linked","summary":"Frappe CRM 1.49.0 through 1.87.0 contains a missing authorization vulnerability in crm.api.doc.get_linked_docs_of_document that allows authenticated users to read linked documents without permission checks. Attackers can name a lead, deal, comment or user they cannot read to obtain linked call log phone numbers, deal organizations and mention notification text.","source":"NVD","date":"2026-10-11T13:17:17.627Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108734","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108734"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108734"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108734"}],"epss":{"score":0.00251,"date":"2026-10-12","percentile":0.15163}},{"id":"CVE-2026-108733","title":"CVE-2026-108733 — Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing","summary":"Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted expire_allocation method that allows authenticated users to expire any leave allocation. Attackers without HR roles can name another employee's Leave Allocation in a POST request to zero its allocated leaves and wipe that employee's remaining leave balance.","source":"NVD","date":"2026-10-11T13:17:17.490Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108733","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108733"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108733"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108733"}],"epss":{"score":0.00259,"date":"2026-10-12","percentile":0.16269}},{"id":"CVE-2026-108732","title":"CVE-2026-108732 — Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing","summary":"Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted get_account_and_amount method that lets authenticated users read payroll amounts. Attackers without HR roles can call the method over /api/method with enumerable Salary Slip or claim document names to disclose other employees' net pay and loan, advance, and claim balances.","source":"NVD","date":"2026-10-11T13:17:17.350Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108732","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108732"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108732"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108732"}],"epss":{"score":0.00277,"date":"2026-10-12","percentile":0.18604}},{"id":"CVE-2026-108731","title":"CVE-2026-108731 — Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability that allows authenticated users ","summary":"Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability that allows authenticated users to join invite-only Public workspaces by ignoring the can_only_join_via_invite setting. Attackers with the Raven User role can call the join_workspace method to become persistent members, reading and posting in Public and Open channels.","source":"NVD","date":"2026-10-11T13:17:17.207Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108731","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108731"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108731"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108731"}],"epss":{"score":0.00223,"date":"2026-10-12","percentile":0.1187}},{"id":"CVE-2026-108730","title":"CVE-2026-108730 — Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability in legacy methods in raven/api/r","summary":"Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability in legacy methods in raven/api/raven_message.py that skip the workspace membership check. Authenticated non-members can call get_messages_with_dates or get_all_files_shared_in_channel with predictable channel IDs to read Public channel history and Open/Public channel file metadata across workspaces.","source":"NVD","date":"2026-10-11T13:17:17.067Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108730","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108730"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108730"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108730"}],"epss":{"score":0.00251,"date":"2026-10-12","percentile":0.15163}},{"id":"CVE-2026-108729","title":"CVE-2026-108729 — Corteza through 2024.9.10 contains an incorrect authorization vulnerability in compose attachment endpoin","summary":"Corteza through 2024.9.10 contains an incorrect authorization vulnerability in compose attachment endpoints that allows unauthenticated attackers to download private attachments by setting the URL kind segment to page, icon, or namespace. Attackers who know a private record or module attachment id can request the original or preview route without a token or signature to retrieve files across namespace and record permission boundaries.","source":"NVD","date":"2026-10-11T13:17:16.750Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108729","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108729"],"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108729"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108729"}],"epss":{"score":0.00293,"date":"2026-10-12","percentile":0.20185}},{"id":"CVE-2026-108728","title":"CVE-2026-108728 — Flyte 2.0.1 through 2.0.51 contains a cleartext secret storage vulnerability that allows users with Pod r","summary":"Flyte 2.0.1 through 2.0.51 contains a cleartext secret storage vulnerability that allows users with Pod read access to obtain secrets by reading init container environment variables. The embedded secret manager webhook writes base64-encoded FILE-mounted secret values into the SECRETS environment variable, letting principals without Secret store access decode them from the Pod spec.","source":"NVD","date":"2026-10-11T13:17:16.590Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108728","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108728"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108728"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108728"}],"epss":{"score":0.00232,"date":"2026-10-12","percentile":0.12918}},{"id":"CVE-2026-108727","title":"CVE-2026-108727 — EdgeEver through 1.108.0 contains a missing authorization vulnerability in the Hono API memo-template rou","summary":"EdgeEver through 1.108.0 contains a missing authorization vulnerability in the Hono API memo-template routes that allows holders of scoped API tokens to bypass token scope restrictions because template handlers never call requireScopes. Attackers with a token lacking write:memos can save a template and invoke POST /api/v1/templates/:id/use to create memos, and list, modify, or delete templates in the token owner's workspace.","source":"NVD","date":"2026-10-11T13:17:16.440Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108727","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108727"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108727"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108727"}],"epss":{"score":0.00268,"date":"2026-10-12","percentile":0.17474}},{"id":"CVE-2026-108726","title":"CVE-2026-108726 — GLPI through 12.0.0 contains a missing authorization vulnerability in ajax/map.php that allows authentica","summary":"GLPI through 12.0.0 contains a missing authorization vulnerability in ajax/map.php that allows authenticated low-privileged users to search itemtypes they cannot view by omitting the canView() check. Attackers can submit crafted itemtype and search criteria for types like Contact, Supplier, Contract and Budget to obtain match counts, titles and coordinates within their entities.","source":"NVD","date":"2026-10-11T13:17:16.277Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108726","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108726"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108726"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108726"}],"epss":{"score":0.00251,"date":"2026-10-12","percentile":0.15163}},{"id":"CVE-2026-108725","title":"CVE-2026-108725 — Cheshire Cat AI core through 2.0.23 contains a stored cross-site scripting vulnerability in the uploads p","summary":"Cheshire Cat AI core through 2.0.23 contains a stored cross-site scripting vulnerability in the uploads plugin that allows authenticated users to upload HTML files via POST /uploads without type restrictions. Attackers can send the public GET /uploads/{path} URL to a signed-in victim, executing script in the application origin with the victim's access_token cookie, including administrators.","source":"NVD","date":"2026-10-11T13:17:16.137Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108725","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108725"],"cvss":{"score":5.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108725"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108725"}],"epss":{"score":0.00215,"date":"2026-10-12","percentile":0.10988}},{"id":"CVE-2026-108724","title":"CVE-2026-108724 — Sylius through 2.3.0 contains an authorization bypass vulnerability that allows unauthenticated attackers","summary":"Sylius through 2.3.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unmoderated and rejected product reviews because the AcceptedExtension filter is not applied to the item operation. Attackers can enumerate sequential ids on GET /api/v2/shop/product-reviews/{id} to retrieve review titles, ratings, comments, timestamps and author first names, bypassing merchant moderation.","source":"NVD","date":"2026-10-11T13:17:16.000Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108724","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108724"],"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108724"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108724"}],"epss":{"score":0.00323,"date":"2026-10-12","percentile":0.23396}},{"id":"CVE-2026-108723","title":"CVE-2026-108723 — answer-me-with-html through 0.5.0 contains a link following vulnerability in the am CLI code block src= e","summary":"answer-me-with-html through 0.5.0 contains a link following vulnerability in the am CLI code block src= embedding, where localPath() checks only path text without resolving symlinks. Attackers can ship a repository with a symlink pointing outside the checkout so am render embeds readable external files into generated HTML, disclosing them when shared.","source":"NVD","date":"2026-10-11T13:17:15.840Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108723","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108723"],"cvss":{"score":2,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108723"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108723"}],"epss":{"score":0.00136,"date":"2026-10-12","percentile":0.02643}},{"id":"CVE-2026-108722","title":"CVE-2026-108722 — open-computer-use through commit 610bac8 contains a stored cross-site scripting vulnerability in Logger.w","summary":"open-computer-use through commit 610bac8 contains a stored cross-site scripting vulnerability in Logger.write_log_file in os_computer_use/logging.py, which writes transcript text into log.html without HTML escaping. Attackers controlling sandbox content, such as web pages or files appearing in run_command output, can inject script that runs when operators open the log, exfiltrating transcript contents.","source":"NVD","date":"2026-10-11T13:17:15.673Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108722","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108722"],"cvss":{"score":2.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108722"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108722"}],"epss":{"score":0.00232,"date":"2026-10-12","percentile":0.12971}},{"id":"CVE-2026-108721","title":"CVE-2026-108721 — Open Computer Use through 1.0.0 on macOS contains an improper case sensitivity handling vulnerability tha","summary":"Open Computer Use through 1.0.0 on macOS contains an improper case sensitivity handling vulnerability that allows local MCP callers to bypass the password-manager denylist using case-variant bundle identifiers. Attackers, including prompt-injected model turns, can pass identifiers like com.1Password.1Password to get_app_state and action tools to read accessibility trees, capture screenshots, and drive unlocked password manager interfaces.","source":"NVD","date":"2026-10-11T13:17:15.470Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108721","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108721"],"cvss":{"score":5.8,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108721"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108721"}],"epss":{"score":0.00132,"date":"2026-10-12","percentile":0.0242}},{"id":"CVE-2026-108720","title":"CVE-2026-108720 — phpIPAM through 1.8.3 contains a missing authorization vulnerability that allows authenticated low-privil","summary":"phpIPAM through 1.8.3 contains a missing authorization vulnerability that allows authenticated low-privilege users to view restricted subnets and addresses because customer, location and NAT pages skip Subnets::check_permission. Attackers can open customer objects.php, single-location.php or nat_details.php to read IP addresses, CIDRs, hostnames and MAC addresses from sections they cannot access.","source":"NVD","date":"2026-10-11T13:17:15.307Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108720","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108720"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108720"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108720"}],"epss":{"score":0.00277,"date":"2026-10-12","percentile":0.18604}},{"id":"CVE-2026-108719","title":"CVE-2026-108719 — LLMGateway through 1.20.0 contains a blind server-side request forgery vulnerability that allows API key ","summary":"LLMGateway through 1.20.0 contains a blind server-side request forgery vulnerability that allows API key holders to reach internal hosts via the video-generation callback_url extension. Attackers can supply loopback, private, or cloud-metadata URLs that deliverWebhook POSTs to without the assertSafeWebhookTarget check, reaching internal services from the worker's network.","source":"NVD","date":"2026-10-11T13:17:15.163Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108719","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108719"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108719"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108719"}],"epss":{"score":0.00282,"date":"2026-10-12","percentile":0.19108}},{"id":"CVE-2026-108718","title":"CVE-2026-108718 — Rill 0.77.0 through 0.90.5 contains a missing authorization vulnerability in the admin OAuth server that ","summary":"Rill 0.77.0 through 0.90.5 contains a missing authorization vulnerability in the admin OAuth server that issues authorization codes to dynamically registered clients without user consent. Attackers can register a client with the long_lived_access_token scope and lure a user to an authorization link, obtaining a non-expiring API token with the user's full permissions.","source":"NVD","date":"2026-10-11T13:17:15.020Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108718","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108718"],"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108718"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108718"}],"epss":{"score":0.00271,"date":"2026-10-12","percentile":0.17838}},{"id":"CVE-2026-108717","title":"CVE-2026-108717 — Combodo iTop 3.1.0 through 3.3.0 contains a missing authorization vulnerability in LinkSetController.php ","summary":"Combodo iTop 3.1.0 through 3.3.0 contains a missing authorization vulnerability in LinkSetController.php that allows authenticated console users to bypass profile grants by supplying arbitrary class and key parameters. Attackers can invoke the linkset delete, detach and get-remote-object routes to delete objects, clear external keys, and read object attributes without permission.","source":"NVD","date":"2026-10-11T13:17:14.870Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108717","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108717"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108717"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108717"}],"epss":{"score":0.00264,"date":"2026-10-12","percentile":0.16942}},{"id":"CVE-2026-108716","title":"CVE-2026-108716 — mcp-remote 0.8.0 through 0.14.3 contains a cleartext transmission vulnerability in authorizeWithDeviceCod","summary":"mcp-remote 0.8.0 through 0.14.3 contains a cleartext transmission vulnerability in authorizeWithDeviceCode that sends client secrets and receives tokens without enforcing HTTPS endpoints. When discovered device authorization and token endpoints are non-loopback http URLs, on-path network attackers can capture the client secret plus issued access and refresh tokens.","source":"NVD","date":"2026-10-11T13:17:14.720Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108716","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108716"],"cvss":{"score":6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108716"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108716"}],"epss":{"score":0.002,"date":"2026-10-12","percentile":0.09038}},{"id":"CVE-2026-108715","title":"CVE-2026-108715 — LibreNMS through 26.9.1.1 contains an authorization bypass vulnerability in includes/html/graphs/smokepin","summary":"LibreNMS through 26.9.1.1 contains an authorization bypass vulnerability in includes/html/graphs/smokeping/auth.inc.php that checks the src probe device instead of the rendered target device. Restricted users permitted on a probe device can request smokeping_in or smokeping_out graphs with arbitrary device ids to view latency data and enumerate device names.","source":"NVD","date":"2026-10-11T13:17:14.577Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108715","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108715"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108715"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108715"}],"epss":{"score":0.00269,"date":"2026-10-12","percentile":0.17602}},{"id":"CVE-2026-108714","title":"CVE-2026-108714 — MCP Kotlin SDK through 0.15.0 contains an uncontrolled memory allocation vulnerability that allows remote","summary":"MCP Kotlin SDK through 0.15.0 contains an uncontrolled memory allocation vulnerability that allows remote clients to exhaust server memory because Application.mcpWebSocket installs Ktor WebSockets without a maxFrameSize limit. Attackers can send small frame headers declaring payloads near 2 GiB over one or a few connections, forcing huge heap allocations and causing denial of service.","source":"NVD","date":"2026-10-11T13:17:14.430Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108714","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108714"],"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108714"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108714"}],"epss":{"score":0.00358,"date":"2026-10-12","percentile":0.27586}},{"id":"CVE-2026-108713","title":"CVE-2026-108713 — SuiteCRM through 7.15.2 and 8.x through 8.10.2 contains a missing authorization vulnerability that allows","summary":"SuiteCRM through 7.15.2 and 8.x through 8.10.2 contains a missing authorization vulnerability that allows authenticated users to create and modify EmailMarketing records via the setCampaignMarketingAndTemplate entry point. Low-privileged users denied Campaigns access can post marketingId, campaignId, and templateId to reattach marketing messages or swap the template EmailMan sends in campaign emails.","source":"NVD","date":"2026-10-11T13:17:14.293Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108713","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108713"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108713"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108713"}],"epss":{"score":0.00259,"date":"2026-10-12","percentile":0.16268}},{"id":"CVE-2026-108712","title":"CVE-2026-108712 — SuiteCRM through 7.15.2 and 8.10.2 contains a missing authorization vulnerability in the DetailUserRole e","summary":"SuiteCRM through 7.15.2 and 8.10.2 contains a missing authorization vulnerability in the DetailUserRole entry point that allows authenticated non-admin users to view other users' ACL data. Attackers can supply another non-admin user's id in the record parameter to read that user's assigned roles and per-module ACL action matrix.","source":"NVD","date":"2026-10-11T13:17:14.047Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108712","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108712"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108712"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108712"}],"epss":{"score":0.00277,"date":"2026-10-12","percentile":0.18604}},{"id":"CVE-2026-108711","title":"CVE-2026-108711 — Plastic Labs Honcho through 3.3.0 contains an incorrect authorization vulnerability that allows peer- or ","summary":"Plastic Labs Honcho through 3.3.0 contains an incorrect authorization vulnerability that allows peer- or session-scoped API key holders to read workspace data because get_or_create_workspace checks only the workspace claim. Attackers can submit their parent workspace name to the POST /v3/workspaces endpoint to retrieve workspace metadata and configuration, including custom_instructions, reserved for workspace or admin keys.","source":"NVD","date":"2026-10-11T13:17:13.877Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108711","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108711"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108711"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108711"}],"epss":{"score":0.00277,"date":"2026-10-12","percentile":0.18604}},{"id":"CVE-2026-108710","title":"CVE-2026-108710 — NornicDB through 1.4.1 contains a missing authorization vulnerability that allows authenticated users to ","summary":"NornicDB through 1.4.1 contains a missing authorization vulnerability that allows authenticated users to bypass per-database read restrictions on the /nornicdb/search and /nornicdb/similar endpoints. Viewer-role users allowlisted for a database but denied read can submit search queries or node IDs to retrieve node IDs, labels and full property maps.","source":"NVD","date":"2026-10-11T13:17:13.720Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108710","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108710"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108710"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108710"}],"epss":{"score":0.00349,"date":"2026-10-12","percentile":0.26589}},{"id":"CVE-2026-108584","title":"CVE-2026-108584 — A security flaw has been discovered in FunnyWolf Viper up to 3.1.11. The affected element is an unknown f","summary":"A security flaw has been discovered in FunnyWolf Viper up to 3.1.11. The affected element is an unknown function of the file /root/viper/.git/config. Performing a manipulation results in hard-coded credentials. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.","source":"NVD","date":"2026-10-11T13:17:13.557Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108584","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108584"],"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108584"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108584"}],"epss":{"score":0.0036,"date":"2026-10-12","percentile":0.27833}},{"id":"CVE-2026-108578","title":"CVE-2026-108578 — A vulnerability was identified in Neterbit NW-431F 20250715. Impacted is an unknown function of the file ","summary":"A vulnerability was identified in Neterbit NW-431F 20250715. Impacted is an unknown function of the file /sms.json of the component Embedded Web Server. Such manipulation leads to information disclosure. The attack may be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-11T13:17:13.397Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108578","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108578"],"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108578"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108578"}],"epss":{"score":0.00485,"date":"2026-10-12","percentile":0.39932}},{"id":"CVE-2026-108577","title":"CVE-2026-108577 — A vulnerability was determined in Konstanty Bialkowski libmodplug up to 0.8.9.1. This issue affects the f","summary":"A vulnerability was determined in Konstanty Bialkowski libmodplug up to 0.8.9.1. This issue affects the function abc_add_gchord of the file src/load_abc.cpp of the component ABC Music Format Parser. This manipulation causes resource consumption. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-11T13:17:13.230Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108577","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108577"],"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108577"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108577"}],"epss":{"score":0.00293,"date":"2026-10-12","percentile":0.20238}},{"id":"CVE-2026-108576","title":"CVE-2026-108576 — A vulnerability was found in TOZED X300 up to 6.01.3. This vulnerability affects the function process_pin","summary":"A vulnerability was found in TOZED X300 up to 6.01.3. This vulnerability affects the function process_ping of the component IPPingDiagnostics Handler. The manipulation of the argument Host results in os command injection. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-11T13:17:13.067Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108576","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108576"],"cvss":{"score":10,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108576"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108576"}],"epss":{"score":0.02451,"date":"2026-10-12","percentile":0.8395}},{"id":"CVE-2026-108575","title":"CVE-2026-108575 — A vulnerability has been found in BerriAI LiteLLM up to 1.94.0. This affects the function get_secret of t","summary":"A vulnerability has been found in BerriAI LiteLLM up to 1.94.0. This affects the function get_secret of the file secret_managers/main.py of the component Secret Resolution. The manipulation of the argument api_key leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-11T12:16:53.210Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108575","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108575"],"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108575"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108575"}],"epss":{"score":0.00201,"date":"2026-10-12","percentile":0.09229}},{"id":"CVE-2026-108574","title":"CVE-2026-108574 — A flaw has been found in BerriAI LiteLLM up to 1.95.0. Affected by this issue is the function ui_view_ses","summary":"A flaw has been found in BerriAI LiteLLM up to 1.95.0. Affected by this issue is the function ui_view_session_spend_logs of the file litellm/proxy/spend_tracking/spend_management_endpoints.py of the component Spend Tracking. Executing a manipulation of the argument session_id can lead to authorization bypass. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 1.96.0 can resolve this issue. This patch is called 722d9ffa4f6c5ae15702ab9ab2c5f6bf1688308b. The affected component should be upgraded.","source":"NVD","date":"2026-10-11T12:16:52.990Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108574","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108574"],"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108574"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108574"}],"epss":{"score":0.00238,"date":"2026-10-12","percentile":0.1371}},{"id":"CVE-2026-108573","title":"CVE-2026-108573 — A vulnerability was detected in Open Asset Import Library Assimp up to 6.0.5. Affected by this vulnerabil","summary":"A vulnerability was detected in Open Asset Import Library Assimp up to 6.0.5. Affected by this vulnerability is the function IOStreamBuffer::getNextBlock of the component PLY File Handler. Performing a manipulation results in out-of-bounds read. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-11T12:16:52.783Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108573","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108573"],"cvss":{"score":5.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108573"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108573"}],"epss":{"score":0.00169,"date":"2026-10-12","percentile":0.05724}},{"id":"CVE-2026-108572","title":"CVE-2026-108572 — A security vulnerability has been detected in Casdoor up to 3.164.0/4.10.0. Affected is the function CasP","summary":"A security vulnerability has been detected in Casdoor up to 3.164.0/4.10.0. Affected is the function CasP3ProxyValidate of the file controllers/cas.go of the component Proxy Validation. Such manipulation of the argument pgtUrl leads to server-side request forgery. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. Upgrading to version 4.11.0 is able to address this issue. The name of the patch is 03c6c9aaa2eda5b085ce128ce0d60b34094efbd9/ada08ecd10cbf158f593dee23a8bab63efecf995. It is advisable to upgrade the affected component.","source":"NVD","date":"2026-10-11T11:17:00.370Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108572","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108572"],"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108572"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108572"}],"epss":{"score":0.00222,"date":"2026-10-12","percentile":0.11755}},{"id":"CVE-2026-108571","title":"CVE-2026-108571 — A weakness has been identified in Xinhu Rainrock RockOA up to 2.7.6. This impacts the function kqjcmdMode","summary":"A weakness has been identified in Xinhu Rainrock RockOA up to 2.7.6. This impacts the function kqjcmdModel::returnchuli of the file webmain/task/openapi/openkqjAction.php of the component Openkqj Action. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-11T11:17:00.197Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108571","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108571"],"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108571"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108571"}],"epss":{"score":0.00318,"date":"2026-10-12","percentile":0.22883}},{"id":"CVE-2026-108570","title":"CVE-2026-108570 — A security flaw has been discovered in Furion .NET Framework up to 4.9.9.95. This affects the function Ru","summary":"A security flaw has been discovered in Furion .NET Framework up to 4.9.9.95. This affects the function RunCompile of the file framework/Furion/ViewEngine/Engines/ViewEngine.cs of the component View Engine. The manipulation of the argument content results in improper neutralization of special elements used in a template engine. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-11T11:16:59.980Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108570","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108570"],"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108570"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108570"}],"epss":{"score":0.00228,"date":"2026-10-12","percentile":0.1246}},{"id":"CVE-2026-108569","title":"CVE-2026-108569 — A vulnerability was identified in Furion .NET Framework up to 4.9.9.92. The impacted element is the funct","summary":"A vulnerability was identified in Furion .NET Framework up to 4.9.9.92. The impacted element is the function String.Replace of the file framework/Furion/Templates/Extensions/StringRenderExtensions.cs. The manipulation of the argument Name leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-11T11:16:58.727Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108569","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108569"],"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108569"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108569"}],"epss":{"score":0.00303,"date":"2026-10-12","percentile":0.21266}},{"id":"CVE-2026-108568","title":"CVE-2026-108568 — A vulnerability was determined in InstantSoft icms2 up to 2.18.2. The affected element is the function va","summary":"A vulnerability was determined in InstantSoft icms2 up to 2.18.2. The affected element is the function validatePaypalOrder of the file system/controllers/billing/actions/paypal.php of the component Billing Module. Executing a manipulation of the argument bid/sig can lead to insufficient verification of data authenticity. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-11T10:16:40.340Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108568","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108568"],"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108568"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108568"}],"epss":{"score":0.00133,"date":"2026-10-12","percentile":0.02466}},{"id":"CVE-2026-108567","title":"CVE-2026-108567 — A vulnerability was found in InstantSoft icms2 up to 2.18.2. Impacted is the function files_delete_file o","summary":"A vulnerability was found in InstantSoft icms2 up to 2.18.2. Impacted is the function files_delete_file of the file system/fields/image.php of the component Image Handler. Performing a manipulation of the argument size results in path traversal. The attack may be initiated remotely. The exploit has been made public and could be used. The patch is named 03d70937f1ff97031523222808726994b8b79379. It is recommended to apply a patch to fix this issue.","source":"NVD","date":"2026-10-11T10:16:40.173Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108567","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108567"],"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108567"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108567"}],"epss":{"score":0.00531,"date":"2026-10-12","percentile":0.43231}},{"id":"CVE-2026-108566","title":"CVE-2026-108566 — A vulnerability has been found in InstantSoft icms2 up to 2.18.2. This issue affects the function index o","summary":"A vulnerability has been found in InstantSoft icms2 up to 2.18.2. This issue affects the function index of the file templates/default/controllers/messages/index.tpl.php of the component Private Message Handler. Such manipulation of the argument nickname leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 3a1ec8fcb073a46d06a2ab83bc2bf68225834281. It is best practice to apply a patch to resolve this issue.","source":"NVD","date":"2026-10-11T10:16:38.727Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108566","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108566"],"cvss":{"score":2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108566"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108566"}],"epss":{"score":0.00199,"date":"2026-10-12","percentile":0.08902}},{"id":"CVE-2026-108544","title":"CVE-2026-108544 — A vulnerability was identified in Lippu Docx Reader Office Viewer App up to 1.4.5 on Android. This affect","summary":"A vulnerability was identified in Lippu Docx Reader Office Viewer App up to 1.4.5 on Android. This affects the function word.office.docxviewer.document.docx.reader.ViewTxt. Such manipulation of the argument _display_name leads to path traversal. The attack may be performed from remote.","source":"NVD","date":"2026-10-11T08:16:33.913Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108544","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108544"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108544"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108544"}],"epss":{"score":0.00335,"date":"2026-10-12","percentile":0.24935}},{"id":"CVE-2026-108543","title":"CVE-2026-108543 — A vulnerability was determined in ag2ai ag2 up to 0.13.4. Affected by this issue is the function os.path.","summary":"A vulnerability was determined in ag2ai ag2 up to 0.13.4. Affected by this issue is the function os.path.join of the component UserProxyAgent. This manipulation of the argument filename causes path traversal. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-11T08:16:33.723Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108543","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108543"],"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108543"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108543"}],"epss":{"score":0.00339,"date":"2026-10-12","percentile":0.2544}},{"id":"CVE-2026-108542","title":"CVE-2026-108542 — A vulnerability was found in 021is elvix-sdk up to 0.10.1. Affected by this vulnerability is an unknown f","summary":"A vulnerability was found in 021is elvix-sdk up to 0.10.1. Affected by this vulnerability is an unknown functionality of the file src/mcp/index.ts of the component MCP Request Handler. The manipulation of the argument path results in server-side request forgery. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-11T08:16:33.540Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108542","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108542"],"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108542"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108542"}],"epss":{"score":0.00201,"date":"2026-10-12","percentile":0.09231}},{"id":"CVE-2026-97183","title":"CVE-2026-97183 — The WP-Invoice  WordPress plugin through 4.3.1 does not perform capability checks in several of its AJAX ","summary":"The WP-Invoice  WordPress plugin through 4.3.1 does not perform capability checks in several of its AJAX handlers, allowing any authenticated user, such as a Subscriber, to retrieve the email addresses, display names and profile details of all registered users.","source":"NVD","date":"2026-10-11T07:17:29.707Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97183","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-97183"],"cvss":{"score":4.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-97183"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97183"}],"epss":{"score":0.00176,"date":"2026-10-12","percentile":0.06612}},{"id":"CVE-2026-96227","title":"CVE-2026-96227 — The Piotnet Forms WordPress plugin through 1.0.30 does not authenticate or validate a form-submission fil","summary":"The Piotnet Forms WordPress plugin through 1.0.30 does not authenticate or validate a form-submission file-upload request and permits browser-renderable file types to be stored, allowing unauthenticated attackers to store a file that executes arbitrary JavaScript in the site's origin when it is opened (Stored XSS).","source":"NVD","date":"2026-10-11T07:17:29.543Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96227","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-96227"],"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-96227"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96227"}],"epss":{"score":0.00276,"date":"2026-10-12","percentile":0.18472}},{"id":"CVE-2026-94235","title":"CVE-2026-94235 — The MemberHero  WordPress plugin through 6.9 does not perform any capability or nonce check on one of its","summary":"The MemberHero  WordPress plugin through 6.9 does not perform any capability or nonce check on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to make the site send arbitrary HTML emails to arbitrary recipients from its own mail system, which can be abused to relay phishing carrying the site's identity and domain reputation.","source":"NVD","date":"2026-10-11T07:17:29.420Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94235","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-94235"],"cvss":{"score":4.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-94235"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94235"}],"epss":{"score":0.00152,"date":"2026-10-12","percentile":0.03839}},{"id":"CVE-2026-93550","title":"CVE-2026-93550 — The Veeqo for WooCommerce WordPress plugin through 2.2.8 does not restrict who can trigger its remote bri","summary":"The Veeqo for WooCommerce WordPress plugin through 2.2.8 does not restrict who can trigger its remote bridge-installation process or validate the URL it is given before downloading and extracting it, allowing users with Subscriber-level access and above to make the Veeqo for WooCommerce WordPress plugin through 2.2.8 download and extract an attacker-controlled archive containing arbitrary PHP files into the WordPress root.","source":"NVD","date":"2026-10-11T07:17:29.307Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93550","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-93550"],"cvss":{"score":4.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-93550"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93550"}],"epss":{"score":0.00176,"date":"2026-10-12","percentile":0.06611}},{"id":"CVE-2026-91829","title":"CVE-2026-91829 — The Subscribe to Comments WordPress plugin before 2.3.3 does not properly validate a parameter before ref","summary":"The Subscribe to Comments WordPress plugin before 2.3.3 does not properly validate a parameter before reflecting it into a link target, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting via a crafted URL against anyone who clicks it, including administrators.","source":"NVD","date":"2026-10-11T07:17:29.193Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91829","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-91829"],"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-91829"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91829"}],"epss":{"score":0.00164,"date":"2026-10-12","percentile":0.051}},{"id":"CVE-2026-89305","title":"CVE-2026-89305 — The paymendo  WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using","summary":"The paymendo  WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using it in a SQL query, allowing any authenticated user to perform SQL injection attacks.","source":"NVD","date":"2026-10-11T07:17:29.083Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89305","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-89305"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-89305"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89305"}],"epss":{"score":0.00215,"date":"2026-10-12","percentile":0.11014}},{"id":"CVE-2026-89304","title":"CVE-2026-89304 — The paymendo  WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using","summary":"The paymendo  WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform blind SQL injection attacks.","source":"NVD","date":"2026-10-11T07:17:28.980Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89304","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-89304"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-89304"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89304"}],"epss":{"score":0.00234,"date":"2026-10-12","percentile":0.13206}},{"id":"CVE-2026-89302","title":"CVE-2026-89302 — The Post Voting System WordPress plugin through 1.0 does not properly sanitize and escape a parameter bef","summary":"The Post Voting System WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.","source":"NVD","date":"2026-10-11T07:17:28.873Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89302","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-89302"],"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-89302"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89302"}],"epss":{"score":0.00262,"date":"2026-10-12","percentile":0.16658}},{"id":"CVE-2026-89299","title":"CVE-2026-89299 — The WP Verify API WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter before","summary":"The WP Verify API WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.","source":"NVD","date":"2026-10-11T07:17:28.770Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89299","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-89299"],"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-89299"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89299"}],"epss":{"score":0.00262,"date":"2026-10-12","percentile":0.16657}},{"id":"CVE-2026-89297","title":"CVE-2026-89297 — The Loja Automática WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter befo","summary":"The Loja Automática WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.","source":"NVD","date":"2026-10-11T07:17:28.670Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89297","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-89297"],"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-89297"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89297"}],"epss":{"score":0.00262,"date":"2026-10-12","percentile":0.16658}},{"id":"CVE-2026-89287","title":"CVE-2026-89287 — The ASPL Product Quotation WordPress plugin through 1.1.0 does not sanitize and escape a parameter before","summary":"The ASPL Product Quotation WordPress plugin through 1.1.0 does not sanitize and escape a parameter before using it in SQL statements, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database.","source":"NVD","date":"2026-10-11T07:17:28.560Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89287","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-89287"],"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-89287"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89287"}],"epss":{"score":0.00262,"date":"2026-10-12","percentile":0.16657}},{"id":"CVE-2026-89285","title":"CVE-2026-89285 — The Datalist it WordPress plugin through 0.0.3 does not sanitize and escape several request parameters be","summary":"The Datalist it WordPress plugin through 0.0.3 does not sanitize and escape several request parameters before using them to build a SQL query, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database.","source":"NVD","date":"2026-10-11T07:17:28.440Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89285","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-89285"],"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-89285"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89285"}],"epss":{"score":0.00262,"date":"2026-10-12","percentile":0.16659}},{"id":"CVE-2026-89283","title":"CVE-2026-89283 — The WP Posts Password Batch Manager WordPress plugin through 1.1 does not perform any capability or nonce","summary":"The WP Posts Password Batch Manager WordPress plugin through 1.1 does not perform any capability or nonce check on a bulk post-password action that runs on an always-loaded admin handler, allowing unauthenticated attackers to reset or overwrite the password of every published post, disclosing password-protected content or locking all posts behind an attacker-chosen password.","source":"NVD","date":"2026-10-11T07:17:28.330Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89283","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-89283"],"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-89283"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89283"}],"epss":{"score":0.00215,"date":"2026-10-12","percentile":0.11028}},{"id":"CVE-2026-89234","title":"CVE-2026-89234 — The WP-Partner WordPress plugin through 1.2.1 does not sanitise and escape a parameter before using it in","summary":"The WP-Partner WordPress plugin through 1.2.1 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database.","source":"NVD","date":"2026-10-11T07:17:28.217Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89234","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-89234"],"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-89234"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89234"}],"epss":{"score":0.00267,"date":"2026-10-12","percentile":0.17352}},{"id":"CVE-2026-89232","title":"CVE-2026-89232 — The Recordbrowser WordPress plugin through 1.1.7 does not sanitise and escape a parameter before using it","summary":"The Recordbrowser WordPress plugin through 1.1.7 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database.","source":"NVD","date":"2026-10-11T07:17:28.070Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89232","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-89232"],"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-89232"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89232"}],"epss":{"score":0.00267,"date":"2026-10-12","percentile":0.17352}},{"id":"CVE-2026-89214","title":"CVE-2026-89214 — The WpCues Basic Quiz WordPress plugin through 1.6.5 does not properly sanitise and escape values before ","summary":"The WpCues Basic Quiz WordPress plugin through 1.6.5 does not properly sanitise and escape values before using them in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database.","source":"NVD","date":"2026-10-11T07:17:27.957Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89214","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-89214"],"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-89214"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89214"}],"epss":{"score":0.00262,"date":"2026-10-12","percentile":0.1666}},{"id":"CVE-2026-89213","title":"CVE-2026-89213 — The Llavero.io WordPress plugin through 0.1.4 does not properly sanitise and escape a parameter before us","summary":"The Llavero.io WordPress plugin through 0.1.4 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database.","source":"NVD","date":"2026-10-11T07:17:27.840Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89213","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-89213"],"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-89213"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89213"}],"epss":{"score":0.00262,"date":"2026-10-12","percentile":0.16658}},{"id":"CVE-2026-89195","title":"CVE-2026-89195 — The Site Setup Wizard WordPress plugin through 1.5.8 does not properly sanitise and escape a parameter be","summary":"The Site Setup Wizard WordPress plugin through 1.5.8 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database.","source":"NVD","date":"2026-10-11T07:17:27.720Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89195","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-89195"],"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-89195"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89195"}],"epss":{"score":0.00262,"date":"2026-10-12","percentile":0.16659}},{"id":"CVE-2026-88930","title":"CVE-2026-88930 — The Social Web Suite  WordPress plugin through 4.1.12 does not require its shared secret to be set before","summary":"The Social Web Suite  WordPress plugin through 4.1.12 does not require its shared secret to be set before accepting requests authorised by it, and does not sanitise and escape a parameter before using it in an SQL statement, allowing unauthenticated users to perform SQL injection attacks.","source":"NVD","date":"2026-10-11T07:17:27.603Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88930","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-88930"],"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-88930"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88930"}],"epss":{"score":0.00262,"date":"2026-10-12","percentile":0.16659}},{"id":"CVE-2026-88905","title":"CVE-2026-88905 — The KeyWord Collector WordPress plugin through 1.4 does not have any authorisation or nonce check when sa","summary":"The KeyWord Collector WordPress plugin through 1.4 does not have any authorisation or nonce check when saving its settings, and does not escape them before output, allowing unauthenticated attackers to store malicious JavaScript that executes when an administrator opens the KeyWord Collector WordPress plugin through 1.4's settings page or when a visitor loads a page displaying its output.","source":"NVD","date":"2026-10-11T07:17:27.493Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88905","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-88905"],"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-88905"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88905"}],"epss":{"score":0.00276,"date":"2026-10-12","percentile":0.18472}},{"id":"CVE-2026-88903","title":"CVE-2026-88903 — The Topcontent WordPress plugin through 1.2.1 does not properly authorise one of its request handlers and","summary":"The Topcontent WordPress plugin through 1.2.1 does not properly authorise one of its request handlers and disables HTML sanitisation before storing the submitted content, allowing unauthenticated attackers to publish arbitrary posts containing malicious JavaScript on any site where its API key has never been configured.","source":"NVD","date":"2026-10-11T07:17:27.377Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88903","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-88903"],"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-88903"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88903"}],"epss":{"score":0.00276,"date":"2026-10-12","percentile":0.18473}},{"id":"CVE-2026-88827","title":"CVE-2026-88827 — The Disable Users WordPress plugin through 1.0.5 does not enforce its account-disabling control on all au","summary":"The Disable Users WordPress plugin through 1.0.5 does not enforce its account-disabling control on all authentication paths, allowing the holder of an account an administrator has disabled to continue authenticating with the account's full privileges.","source":"NVD","date":"2026-10-11T07:17:27.267Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88827","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-88827"],"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-88827"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88827"}],"epss":{"score":0.00282,"date":"2026-10-12","percentile":0.19077}},{"id":"CVE-2026-88826","title":"CVE-2026-88826 — The SmugMug Embed WordPress plugin through 3.13 does not have authorisation or CSRF checks on an AJAX act","summary":"The SmugMug Embed WordPress plugin through 3.13 does not have authorisation or CSRF checks on an AJAX action that stores gallery data, and does not sanitise or escape that data before outputting it, allowing unauthenticated users to store arbitrary web scripts that execute when an administrator views the SmugMug Embed WordPress plugin through 3.13's settings screen.","source":"NVD","date":"2026-10-11T07:17:27.153Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88826","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-88826"],"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-88826"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88826"}],"epss":{"score":0.00152,"date":"2026-10-12","percentile":0.03855}},{"id":"CVE-2026-88785","title":"CVE-2026-88785 — The Simple Membership WordPress plugin before 4.8.3 does not avoid transmitting a newly registered member","summary":"The Simple Membership WordPress plugin before 4.8.3 does not avoid transmitting a newly registered member's plaintext password in a URL query string when an optional auto-login-after-registration feature is enabled, exposing the credential in browser history and in web server, proxy, and CDN access logs to anyone able to read them.","source":"NVD","date":"2026-10-11T07:17:27.030Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88785","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-88785"],"cvss":{"score":4.7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-88785"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88785"}],"epss":{"score":0.0009,"date":"2026-10-12","percentile":0.00414}},{"id":"CVE-2026-87764","title":"CVE-2026-87764 — The BuddyPress Instant Chat WordPress plugin through 1.6 does not check that the sender of a chat message","summary":"The BuddyPress Instant Chat WordPress plugin through 1.6 does not check that the sender of a chat message belongs to the conversation it is being added to, nor does it escape message content before outputting it back, allowing unauthenticated users to store arbitrary web scripts that will execute in the session of any member who later views that conversation.","source":"NVD","date":"2026-10-11T07:17:26.913Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87764","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-87764"],"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-87764"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87764"}],"epss":{"score":0.00276,"date":"2026-10-12","percentile":0.18472}},{"id":"CVE-2026-87762","title":"CVE-2026-87762 — The Adwised Web Push Notification WordPress plugin through 2.5.7 does not have authorisation checks on se","summary":"The Adwised Web Push Notification WordPress plugin through 2.5.7 does not have authorisation checks on several state-changing operations, and the secret comparison it uses instead can be bypassed on installations where the secret key has never been set, allowing unauthenticated users to store arbitrary JavaScript that is executed in the browser of every site visitor.","source":"NVD","date":"2026-10-11T07:17:26.803Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87762","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-87762"],"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-87762"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87762"}],"epss":{"score":0.00361,"date":"2026-10-12","percentile":0.2796}},{"id":"CVE-2026-87761","title":"CVE-2026-87761 — The Adwised Web Push Notification WordPress plugin through 2.5.7 does not perform any capability or nonce","summary":"The Adwised Web Push Notification WordPress plugin through 2.5.7 does not perform any capability or nonce check before allowing an authenticated user to overwrite its site-wide configuration, and does not escape those configuration values before printing them inside an inline script block on every front-end page, allowing any authenticated user, such as a subscriber, to perform Stored Cross-Site Scripting attacks against every visitor, including administrators.","source":"NVD","date":"2026-10-11T07:17:26.690Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87761","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-87761"],"cvss":{"score":8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-87761"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87761"}],"epss":{"score":0.00279,"date":"2026-10-12","percentile":0.1873}},{"id":"CVE-2026-87760","title":"CVE-2026-87760 — The Web Vitals Tracking WordPress plugin through 5.4.2 does not validate or escape performance measuremen","summary":"The Web Vitals Tracking WordPress plugin through 5.4.2 does not validate or escape performance measurements submitted by unauthenticated visitors before storing them and outputting them in a script context on an administrative page, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks against administrators.","source":"NVD","date":"2026-10-11T07:17:26.573Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87760","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-87760"],"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-87760"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87760"}],"epss":{"score":0.0034,"date":"2026-10-12","percentile":0.25532}},{"id":"CVE-2026-86798","title":"CVE-2026-86798 — The HootBoard  WordPress plugin through 3.1.4 does not perform any authorisation check on some of its RES","summary":"The HootBoard  WordPress plugin through 3.1.4 does not perform any authorisation check on some of its REST endpoints, and does not escape the values stored through them before outputting them in a public page, allowing unauthenticated users to inject arbitrary web scripts that will execute in the browser of anyone visiting that page, including administrators.","source":"NVD","date":"2026-10-11T07:17:26.450Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86798","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-86798"],"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-86798"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86798"}],"epss":{"score":0.0034,"date":"2026-10-12","percentile":0.25532}},{"id":"CVE-2026-86717","title":"CVE-2026-86717 — The Insurify  WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJA","summary":"The Insurify  WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to delete arbitrary WordPress options, which can take the site offline and strip every user of their role.","source":"NVD","date":"2026-10-11T07:17:26.337Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86717","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-86717"],"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-86717"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86717"}],"epss":{"score":0.00309,"date":"2026-10-12","percentile":0.21923}},{"id":"CVE-2026-86706","title":"CVE-2026-86706 — The Quick quotes  WordPress plugin through 1.0.0 does not perform any capability or nonce check on one of","summary":"The Quick quotes  WordPress plugin through 1.0.0 does not perform any capability or nonce check on one of its AJAX actions and lets the caller choose which option is written, allowing unauthenticated users to alter arbitrary site settings and to make the site unavailable.","source":"NVD","date":"2026-10-11T07:17:26.220Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86706","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-86706"],"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-86706"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86706"}],"epss":{"score":0.00309,"date":"2026-10-12","percentile":0.21922}},{"id":"CVE-2026-85126","title":"CVE-2026-85126 — The Crowdfundly WordPress plugin through 2.2.2 does not have capability checks on some of its AJAX action","summary":"The Crowdfundly WordPress plugin through 2.2.2 does not have capability checks on some of its AJAX actions, allowing users holding one of its own low privileged roles to grant themselves the administrator role or arbitrary capabilities, leading to a full site takeover.","source":"NVD","date":"2026-10-11T07:17:26.113Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85126","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-85126"],"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-85126"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85126"}],"epss":{"score":0.00316,"date":"2026-10-12","percentile":0.22716}},{"id":"CVE-2026-85121","title":"CVE-2026-85121 — The Insurify  WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJA","summary":"The Insurify  WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to create and overwrite arbitrary WordPress options with request data, which can take the site offline and deactivate all of its Insurify  WordPress plugin through 1.0.","source":"NVD","date":"2026-10-11T07:17:26.007Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85121","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-85121"],"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-85121"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85121"}],"epss":{"score":0.00309,"date":"2026-10-12","percentile":0.21922}},{"id":"CVE-2026-85118","title":"CVE-2026-85118 — The AI Content Generator Marketing WordPress plugin through 1.0.0 does not enforce a nonce or capability ","summary":"The AI Content Generator Marketing WordPress plugin through 1.0.0 does not enforce a nonce or capability check on some of its AJAX actions, allowing unauthenticated users to update and delete arbitrary WordPress options, which can be used to gain administrator access to the site.","source":"NVD","date":"2026-10-11T07:17:25.900Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85118","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-85118"],"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-85118"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85118"}],"epss":{"score":0.00341,"date":"2026-10-12","percentile":0.2571}},{"id":"CVE-2026-84737","title":"CVE-2026-84737 — The Freeton WP WordPress plugin through 1.0.0 does not correctly validate the activation code when authen","summary":"The Freeton WP WordPress plugin through 1.0.0 does not correctly validate the activation code when authenticating a user, allowing unauthenticated attackers to log in as any user whose email address they know, including administrators.","source":"NVD","date":"2026-10-11T07:17:25.797Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84737","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-84737"],"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-84737"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84737"}],"epss":{"score":0.00341,"date":"2026-10-12","percentile":0.25709}},{"id":"CVE-2026-84734","title":"CVE-2026-84734 — The Mindstien Quick Login WordPress plugin through 1.0 does not correctly validate a value supplied in th","summary":"The Mindstien Quick Login WordPress plugin through 1.0 does not correctly validate a value supplied in the request against the visitor's own session before authenticating them, allowing unauthenticated attackers to obtain a session as the administrator account the Mindstien Quick Login WordPress plugin through 1.0 is configured with.","source":"NVD","date":"2026-10-11T07:17:25.687Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84734","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-84734"],"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-84734"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84734"}],"epss":{"score":0.00341,"date":"2026-10-12","percentile":0.25709}},{"id":"CVE-2026-84261","title":"CVE-2026-84261 — The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not sanitise and escape conte","summary":"The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin.","source":"NVD","date":"2026-10-11T07:17:25.590Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84261","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-84261"],"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-84261"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84261"}],"epss":{"score":0.00303,"date":"2026-10-12","percentile":0.21311}},{"id":"CVE-2026-84260","title":"CVE-2026-84260 — The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not sanitise and escape conten","summary":"The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin.","source":"NVD","date":"2026-10-11T07:17:25.483Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84260","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-84260"],"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-84260"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84260"}],"epss":{"score":0.00303,"date":"2026-10-12","percentile":0.2131}},{"id":"CVE-2026-84259","title":"CVE-2026-84259 — The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not sanitise and escape content subm","summary":"The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin.","source":"NVD","date":"2026-10-11T07:17:25.390Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84259","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-84259"],"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-84259"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84259"}],"epss":{"score":0.00303,"date":"2026-10-12","percentile":0.2131}},{"id":"CVE-2026-84258","title":"CVE-2026-84258 — The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not sanitise and escape content ","summary":"The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin.","source":"NVD","date":"2026-10-11T07:17:25.287Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84258","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-84258"],"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-84258"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84258"}],"epss":{"score":0.00303,"date":"2026-10-12","percentile":0.21311}},{"id":"CVE-2026-84254","title":"CVE-2026-84254 — The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not have authorisation and CS","summary":"The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new administrator account and take over the site.","source":"NVD","date":"2026-10-11T07:17:25.180Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84254","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-84254"],"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-84254"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84254"}],"epss":{"score":0.00185,"date":"2026-10-12","percentile":0.07409}},{"id":"CVE-2026-84253","title":"CVE-2026-84253 — The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not have authorisation and CSR","summary":"The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new administrator account and take over the site.","source":"NVD","date":"2026-10-11T07:17:25.057Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84253","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-84253"],"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-84253"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84253"}],"epss":{"score":0.00185,"date":"2026-10-12","percentile":0.07409}},{"id":"CVE-2026-84252","title":"CVE-2026-84252 — The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not have authorisation and CSRF chec","summary":"The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to WPForms WordPress plugin through 1.0.3. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new administrator account and take over the site.","source":"NVD","date":"2026-10-11T07:17:24.943Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84252","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-84252"],"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-84252"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84252"}],"epss":{"score":0.00185,"date":"2026-10-12","percentile":0.07409}},{"id":"CVE-2026-84251","title":"CVE-2026-84251 — The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not have authorisation and CSRF ","summary":"The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new administrator account and take over the site.","source":"NVD","date":"2026-10-11T07:17:24.820Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84251","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-84251"],"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-84251"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84251"}],"epss":{"score":0.00185,"date":"2026-10-12","percentile":0.0741}},{"id":"CVE-2026-81649","title":"CVE-2026-81649 — The Fundiin cho WooCommerce WordPress plugin through 3.4.0 does not have proper authorisation on several ","summary":"The Fundiin cho WooCommerce WordPress plugin through 3.4.0 does not have proper authorisation on several of its REST API routes, relying instead on a credential that is identical on every installation, allowing unauthenticated attackers to disclose the store's payment credentials and customer order data, overwrite the payment gateway configuration so that payments are credited elsewhere, and mark unpaid orders as paid. The same missing authorisation also allows arbitrary script to be stored in a field which is output unescaped on the classic checkout, leading to unauthenticated stored XSS on stores that do not use the block-based checkout.","source":"NVD","date":"2026-10-11T07:17:24.703Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81649","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-81649"],"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-81649"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81649"}],"epss":{"score":0.00291,"date":"2026-10-12","percentile":0.19999}},{"id":"CVE-2026-81420","title":"CVE-2026-81420 — The Tcard WP WordPress plugin through 1.8.0 does not sanitise and escape a parameter before using it in a","summary":"The Tcard WP WordPress plugin through 1.8.0 does not sanitise and escape a parameter before using it in a SQL statement in one of its unauthenticated AJAX actions, allowing unauthenticated users to perform SQL injection attacks.","source":"NVD","date":"2026-10-11T07:17:24.593Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81420","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-81420"],"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-81420"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81420"}],"epss":{"score":0.00324,"date":"2026-10-12","percentile":0.23567}},{"id":"CVE-2026-81156","title":"CVE-2026-81156 — The Robo Gallery  WordPress plugin before 5.2.6 does not sanitise and escape some of its gallery settings","summary":"The Robo Gallery  WordPress plugin before 5.2.6 does not sanitise and escape some of its gallery settings before outputting them on the gallery edit screen, allowing users with the Contributor role and above to store JavaScript that executes in the context of an administrator who opens the gallery for editing.","source":"NVD","date":"2026-10-11T07:17:24.493Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81156","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-81156"],"cvss":{"score":6.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-81156"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81156"}],"epss":{"score":0.0029,"date":"2026-10-12","percentile":0.19928}},{"id":"CVE-2026-81155","title":"CVE-2026-81155 — The Robo Gallery  WordPress plugin before 5.2.6 does not sanitise and escape a gallery setting before out","summary":"The Robo Gallery  WordPress plugin before 5.2.6 does not sanitise and escape a gallery setting before outputting it on a frontend page, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing a gallery, including administrators.","source":"NVD","date":"2026-10-11T07:17:24.387Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81155","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-81155"],"cvss":{"score":6.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-81155"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81155"}],"epss":{"score":0.0029,"date":"2026-10-12","percentile":0.19928}},{"id":"CVE-2026-81154","title":"CVE-2026-81154 — The Robo Gallery  WordPress plugin before 5.2.6 does not sanitise and escape image alt text before output","summary":"The Robo Gallery  WordPress plugin before 5.2.6 does not sanitise and escape image alt text before outputting it in one of its gallery layouts, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the affected gallery, including administrators.","source":"NVD","date":"2026-10-11T07:17:24.267Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81154","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-81154"],"cvss":{"score":6.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-81154"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81154"}],"epss":{"score":0.0029,"date":"2026-10-12","percentile":0.19928}},{"id":"CVE-2026-81153","title":"CVE-2026-81153 — The Robo Gallery  WordPress plugin before 5.2.6 does not sanitise and escape some of its image settings b","summary":"The Robo Gallery  WordPress plugin before 5.2.6 does not sanitise and escape some of its image settings before outputting them in a gallery page, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing the gallery, including administrators, even where the unfiltered_html capability is disallowed such as on multisite.","source":"NVD","date":"2026-10-11T07:17:24.143Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81153","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-81153"],"cvss":{"score":6.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-81153"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81153"}],"epss":{"score":0.0029,"date":"2026-10-12","percentile":0.19928}},{"id":"CVE-2026-14854","title":"CVE-2026-14854 — The WooCommerce Bookings WordPress plugin before 3.11.0 does not limit a user-supplied value before using","summary":"The WooCommerce Bookings WordPress plugin before 3.11.0 does not limit a user-supplied value before using it to allocate memory in one of its unauthenticated AJAX actions, allowing unauthenticated attackers to exhaust server memory and cause a Denial of Service with a single request.","source":"NVD","date":"2026-10-11T07:17:24.003Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14854","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-14854"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-14854"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14854"}],"epss":{"score":0.00338,"date":"2026-10-12","percentile":0.25349}},{"id":"CVE-2026-12980","title":"CVE-2026-12980 — The Post Snippets  WordPress plugin through 4.2.4 does not properly escape variable values substituted in","summary":"The Post Snippets  WordPress plugin through 4.2.4 does not properly escape variable values substituted into snippets before outputting them, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when the content is viewed.","source":"NVD","date":"2026-10-11T07:17:23.890Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12980","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-12980"],"cvss":{"score":6.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-12980"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12980"}],"epss":{"score":0.0029,"date":"2026-10-12","percentile":0.19929}},{"id":"CVE-2026-108541","title":"CVE-2026-108541 — A vulnerability has been found in highwarden Super Store Finder up to 3.8. Affected is an unknown functio","summary":"A vulnerability has been found in highwarden Super Store Finder up to 3.8. Affected is an unknown function of the file /products/superstorefinder/index.php. The manipulation of the argument lat/lng leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. Upgrading to version 3.9 is able to address this issue. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.","source":"NVD","date":"2026-10-11T07:17:23.700Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108541","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108541"],"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108541"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108541"}],"epss":{"score":0.00237,"date":"2026-10-12","percentile":0.1359}},{"id":"CVE-2026-108540","title":"CVE-2026-108540 — A flaw has been found in OpenSpug Spug up to 3.4.0/4.0.1. This impacts an unknown function of the file /e","summary":"A flaw has been found in OpenSpug Spug up to 3.4.0/4.0.1. This impacts an unknown function of the file /exec/transfer of the component File Transfer. Executing a manipulation can lead to os command injection. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-11T07:17:23.303Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108540","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108540"],"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108540"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108540"}],"epss":{"score":0.01703,"date":"2026-10-12","percentile":0.7663}},{"id":"CVE-2026-107694","title":"CVE-2026-107694 — The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution  WordPress plugin before 5.2.0 does no","summary":"The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution  WordPress plugin before 5.2.0 does not verify that the vendor a commission calculation is requested for is the requesting vendor, allowing vendors to disclose the commission rate and fixed fee the marketplace administrator configured for other vendors.","source":"NVD","date":"2026-10-11T07:17:23.187Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107694","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107694"],"cvss":{"score":2.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-107694"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107694"}],"epss":{"score":0.0023,"date":"2026-10-12","percentile":0.12701}},{"id":"CVE-2026-107507","title":"CVE-2026-107507 — The Squadeno  WordPress plugin before 1.12.0 does not enforce its restrictions on every way a sport can b","summary":"The Squadeno  WordPress plugin before 1.12.0 does not enforce its restrictions on every way a sport can be saved, allowing users with the lowest-tier Trainer role to change the section, age group, author, password, comment settings and date of a sport they are assigned to.","source":"NVD","date":"2026-10-11T07:17:23.087Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107507","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107507"],"cvss":{"score":2.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-107507"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107507"}],"epss":{"score":0.00205,"date":"2026-10-12","percentile":0.09637}},{"id":"CVE-2026-106029","title":"CVE-2026-106029 — The WeddingCity Lite  WordPress plugin through 1.0.4 does not perform any authorisation or validity check","summary":"The WeddingCity Lite  WordPress plugin through 1.0.4 does not perform any authorisation or validity checks before deleting posts, pages and media attachments, allowing unauthenticated attackers to permanently delete arbitrary content site-wide.","source":"NVD","date":"2026-10-11T07:17:22.963Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106029","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-106029"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-106029"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106029"}],"epss":{"score":0.00253,"date":"2026-10-12","percentile":0.15573}},{"id":"CVE-2026-104684","title":"CVE-2026-104684 — The Envira Gallery  WordPress plugin before 1.16.2 does not verify that a user is authorized to read a ga","summary":"The Envira Gallery  WordPress plugin before 1.16.2 does not verify that a user is authorized to read a gallery before rendering it, allowing authors to embed and expose other users' non-public gallery metadata to unauthenticated visitors.","source":"NVD","date":"2026-10-11T07:17:22.867Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104684","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-104684"],"cvss":{"score":2.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-104684"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104684"}],"epss":{"score":0.00218,"date":"2026-10-12","percentile":0.11266}},{"id":"CVE-2026-104682","title":"CVE-2026-104682 — The Envira Gallery  WordPress plugin before 1.16.2 does not correctly check authorization on its gallery-","summary":"The Envira Gallery  WordPress plugin before 1.16.2 does not correctly check authorization on its gallery-conversion feature, verifying that the requester can edit an arbitrary post they name rather than that they are allowed to create the Envira Gallery  WordPress plugin before 1.16.2's own gallery content, allowing users with contributor-level access to create and publish gallery posts that the Envira Gallery  WordPress plugin before 1.16.2's settings otherwise withhold from them.","source":"NVD","date":"2026-10-11T07:17:22.763Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104682","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-104682"],"cvss":{"score":2.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-104682"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104682"}],"epss":{"score":0.00205,"date":"2026-10-12","percentile":0.09638}},{"id":"CVE-2026-104681","title":"CVE-2026-104681 — The Envira Gallery  WordPress plugin before 1.16.2 does not verify that an image identifier added to a ga","summary":"The Envira Gallery  WordPress plugin before 1.16.2 does not verify that an image identifier added to a gallery refers to a media attachment the caller is permitted to view, allowing any user able to create and edit a gallery (Author and above by default) to disclose the title and excerpt of other users' private, draft, pending and trashed posts that WordPress would otherwise withhold from them.","source":"NVD","date":"2026-10-11T07:17:22.660Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104681","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-104681"],"cvss":{"score":2.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-104681"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104681"}],"epss":{"score":0.0023,"date":"2026-10-12","percentile":0.127}},{"id":"CVE-2026-104680","title":"CVE-2026-104680 — The Envira Gallery  WordPress plugin before 1.16.2 does not verify that a user holds the capability WordP","summary":"The Envira Gallery  WordPress plugin before 1.16.2 does not verify that a user holds the capability WordPress reserves for installing Envira Gallery  WordPress plugin before 1.16.2 code before processing its setup-wizard Envira Gallery  WordPress plugin before 1.16.2-installation request, and does not restrict the installation to its own curated list, allowing a Multisite subsite Administrator to install an arbitrary WordPress.org-published Envira Gallery  WordPress plugin before 1.16.2 into the network-shared Envira Gallery  WordPress plugin before 1.16.2 directory, a privilege Multisite reserves for the network Super Admin.","source":"NVD","date":"2026-10-11T07:17:22.550Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104680","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-104680"],"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-104680"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104680"}],"epss":{"score":0.00316,"date":"2026-10-12","percentile":0.22715}},{"id":"CVE-2026-104028","title":"CVE-2026-104028 — The Anton Extensions WordPress plugin through 1.2.2 does not perform any capability check, nonce verifica","summary":"The Anton Extensions WordPress plugin through 1.2.2 does not perform any capability check, nonce verification, or file-type validation before writing attacker-supplied content to an attacker-chosen path, allowing unauthenticated attackers to upload arbitrary PHP files and achieve remote code execution.","source":"NVD","date":"2026-10-11T07:17:22.440Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104028","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-104028"],"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-104028"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104028"}],"epss":{"score":0.00553,"date":"2026-10-12","percentile":0.44586}},{"id":"CVE-2026-103695","title":"CVE-2026-103695 — The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using i","summary":"The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks.","source":"NVD","date":"2026-10-11T07:17:22.340Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103695","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-103695"],"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-103695"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103695"}],"epss":{"score":0.00324,"date":"2026-10-12","percentile":0.23568}},{"id":"CVE-2026-103694","title":"CVE-2026-103694 — The Mobile builder WordPress plugin through 1.4.2 does not properly restrict which user meta keys a logge","summary":"The Mobile builder WordPress plugin through 1.4.2 does not properly restrict which user meta keys a logged-in user can update through one of its REST routes, allowing any user with a self-registered account, such as a customer, to grant themselves the administrator role.","source":"NVD","date":"2026-10-11T07:17:22.230Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103694","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-103694"],"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-103694"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103694"}],"epss":{"score":0.00286,"date":"2026-10-12","percentile":0.1948}},{"id":"CVE-2026-103305","title":"CVE-2026-103305 — The Prenotazioni WordPress plugin through 1.7.5 does not have authorisation and CSRF checks when saving i","summary":"The Prenotazioni WordPress plugin through 1.7.5 does not have authorisation and CSRF checks when saving its settings, and does not escape some of them when outputting them, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators and site visitors.","source":"NVD","date":"2026-10-11T07:17:21.007Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103305","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-103305"],"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-103305"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103305"}],"epss":{"score":0.00167,"date":"2026-10-12","percentile":0.05439}},{"id":"CVE-2026-108539","title":"CVE-2026-108539 — A vulnerability was detected in GPAC up to 26.07.0. This affects the function gf_fq_pop of the file filte","summary":"A vulnerability was detected in GPAC up to 26.07.0. This affects the function gf_fq_pop of the file filter_core/filter_queue.c of the component MP4Box. Performing a manipulation results in use after free. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-11T05:16:53.680Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108539","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108539"],"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108539"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108539"}],"epss":{"score":0.00301,"date":"2026-10-12","percentile":0.21025}},{"id":"CVE-2026-108538","title":"CVE-2026-108538 — A security vulnerability has been detected in GPAC up to 26.07.0. The impacted element is the function gf","summary":"A security vulnerability has been detected in GPAC up to 26.07.0. The impacted element is the function gf_mx_v of the file utils/os_thread.c of the component MP4Box. Such manipulation leads to use after free. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-11T05:16:53.477Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108538","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108538"],"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108538"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108538"}],"epss":{"score":0.0022,"date":"2026-10-12","percentile":0.11437}},{"id":"CVE-2026-108523","title":"CVE-2026-108523 — A vulnerability was determined in Studio-Saelix Sencho up to 0.94.1. This vulnerability affects unknown c","summary":"A vulnerability was determined in Studio-Saelix Sencho up to 0.94.1. This vulnerability affects unknown code of the file outboundTarget.ts of the component git-sources Browse API Endpoint. Executing a manipulation of the argument repo_url can lead to server-side request forgery. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The presence of this vulnerability remains uncertain at this time. This patch is called 79b86ddcd4aefdd6941f098e35990ab397b13c72. It is advisable to implement a patch to correct this issue. The vendor explains: \"Git repository access is an intentional, privileged administrative function. Sencho explicitly supports repositories hosted on private LAN, VPC, VPN, CGNAT, and IPv6 ULA networks. The report does not demonstrate a privilege-boundary bypass or access by an ","source":"NVD","date":"2026-10-11T05:16:52.630Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108523","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108523"],"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108523"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108523"}],"epss":{"score":0.00263,"date":"2026-10-12","percentile":0.16756}},{"id":"https://thehackernews.com/2026/10/p7-darksword-ios-exploit-kit-adds.html","title":"P7 DarkSword iOS Exploit Kit Adds Crypto Wallet Data Theft and Remote Commands","source":"The Hacker News","date":"2026-10-11T04:24:34.000Z","summary":"Cybersecurity researchers have disclosed details of a previously unseen variant of the DarkSword iOS exploit kit called P7 DarkSword.  \"Compared with the variants we usually observe, P7 reduces its on-device footprint, adds on-device keychain and crypto-wallet theft, and adds two way C2 communication with the attacker's infrastructure,\" iVerify said in a new report published Thursday.","url":"https://thehackernews.com/2026/10/p7-darksword-ios-exploit-kit-adds.html","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://thehackernews.com/2026/10/p7-darksword-ios-exploit-kit-adds.html"],"sources":["The Hacker News"],"topics":["Cyber news"],"affected":[],"references":[{"source":"The Hacker News","url":"https://thehackernews.com/2026/10/p7-darksword-ios-exploit-kit-adds.html"}],"epss":null},{"id":"CVE-2026-108522","title":"CVE-2026-108522 — A vulnerability was found in Studio-Saelix Sencho up to 0.94.1. This affects an unknown part of the file ","summary":"A vulnerability was found in Studio-Saelix Sencho up to 0.94.1. This affects an unknown part of the file /api/auth/login of the component Login Endpoint. Performing a manipulation of the argument X-Forwarded-For results in improper authentication. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The patch is named 79b86ddcd4aefdd6941f098e35990ab397b13c72. To fix this issue, it is recommended to deploy a patch. The vendor confirms: \"The login limiter relied on client-supplied X-Forwarded-For data without an explicit trusted-proxy boundary, allowing an attacker to rotate the apparent client address. The remediation now ignores forwarding headers by default, accepts them only from explicitly configured proxy CIDRs, and adds a separate failed-attempt limit keyed by normalized account ident","source":"NVD","date":"2026-10-11T04:17:31.737Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108522","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108522"],"cvss":{"score":5.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108522"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108522"}],"epss":{"score":0.00419,"date":"2026-10-12","percentile":0.3433}},{"id":"CVE-2026-108521","title":"CVE-2026-108521 — A vulnerability has been found in Studio-Saelix Sencho up to 0.97.1. Affected by this issue is the functi","summary":"A vulnerability has been found in Studio-Saelix Sencho up to 0.97.1. Affected by this issue is the function isValidRemoteUrl of the file backend/src/utils/validation.ts of the component Add Remote Node API Endpoint. Such manipulation leads to server-side request forgery. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor confirms: \"The node API URL could be configured by an authenticated user with node-management permission and used to initiate server-side requests. [T]he report demonstrates server-side request capability but not arbitrary internal response exfiltration.\"","source":"NVD","date":"2026-10-11T03:16:39.350Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108521","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108521"],"cvss":{"score":2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@vuldb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108521"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108521"}],"epss":{"score":0.00218,"date":"2026-10-12","percentile":0.11306}},{"id":"CVE-2026-108708","title":"CVE-2026-108708 — Wukong_HRM through commit 186115e contains a missing authorization vulnerability because EmployeeAspect a","summary":"Wukong_HRM through commit 186115e contains a missing authorization vulnerability because EmployeeAspect assigns every caller the HR administrator role and EmployeeUtil data-scope checks return all employees. Any authenticated low-privileged employee can read payslips, salary records, bank cards and personal data, edit bank cards, and delete employees, departments and contracts company-wide.","source":"NVD","date":"2026-10-11T02:16:39.650Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108708","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108708"],"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108708"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108708"}],"epss":{"score":0.00283,"date":"2026-10-12","percentile":0.19236}},{"id":"CVE-2026-108707","title":"CVE-2026-108707 — Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that all","summary":"Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header. Attackers gain HR administrator access to read payslips, salary history and employee personal data, download attachments, and modify or delete company-wide HR records.","source":"NVD","date":"2026-10-11T02:16:39.477Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108707","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108707"],"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108707"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108707"}],"epss":{"score":0.00552,"date":"2026-10-12","percentile":0.4453}},{"id":"CVE-2026-108706","title":"CVE-2026-108706 — eladmin through commit 55fbf70 contains a missing authorization vulnerability in the downloadS3Storage ha","summary":"eladmin through commit 55fbf70 contains a missing authorization vulnerability in the downloadS3Storage handler that allows any authenticated user to retrieve stored object URLs without storage permissions. Attackers can enumerate sequential ids against GET /api/s3Storage/download/{id} to collect URLs of all uploaded objects, exposing file contents on publicly readable buckets.","source":"NVD","date":"2026-10-11T02:16:39.330Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108706","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108706"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108706"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108706"}],"epss":{"score":0.00193,"date":"2026-10-12","percentile":0.0824}},{"id":"CVE-2026-108705","title":"CVE-2026-108705 — CordysCRM through 1.9.3 contains a missing authorization vulnerability in the POST /custom-form/data/impo","summary":"CordysCRM through 1.9.3 contains a missing authorization vulnerability in the POST /custom-form/data/import endpoint that allows authenticated users to import data into any custom form by customFormId. Low-privileged attackers can upload Excel files with importType ADD or UPDATE to create records in, or overwrite existing records of, custom forms they cannot manage.","source":"NVD","date":"2026-10-11T02:16:39.160Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108705","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108705"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108705"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108705"}],"epss":{"score":0.00196,"date":"2026-10-12","percentile":0.08552}},{"id":"CVE-2026-108704","title":"CVE-2026-108704 — CordysCRM through 1.9.3 contains an authorization bypass vulnerability that allows low-privileged authent","summary":"CordysCRM through 1.9.3 contains an authorization bypass vulnerability that allows low-privileged authenticated users to skip permission checks by setting the owner field to their own user id. Attackers can send requests to the follow/record/add endpoints to add follow-up records and overwrite follow_time and follower on any known customer, clue or opportunity.","source":"NVD","date":"2026-10-11T02:16:38.980Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108704","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108704"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108704"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108704"}],"epss":{"score":0.00222,"date":"2026-10-12","percentile":0.11731}},{"id":"CVE-2026-108703","title":"CVE-2026-108703 — CordysCRM through 1.9.3 contains a missing authorization vulnerability in POST /approval-resource/push th","summary":"CordysCRM through 1.9.3 contains a missing authorization vulnerability in POST /approval-resource/push that allows authenticated users to submit any resource for approval without ownership checks. Low-privileged attackers can supply arbitrary resourceId values for contracts, invoices, quotations or orders to alter their approval status and read approval details.","source":"NVD","date":"2026-10-11T02:16:38.803Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108703","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108703"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108703"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108703"}],"epss":{"score":0.00171,"date":"2026-10-12","percentile":0.0598}},{"id":"CVE-2026-108702","title":"CVE-2026-108702 — 1Panel-dev CordysCRM through 1.9.3 lacks a PROCESS_SETTING permission check on POST /approval-flow/webhoo","summary":"1Panel-dev CordysCRM through 1.9.3 lacks a PROCESS_SETTING permission check on POST /approval-flow/webhook/test, allowing any authenticated user to trigger server-side requests to attacker-supplied URLs. Attackers can redirect GET requests from a controlled host to bypass SSRFValidator and probe internal addresses through success or failure results.","source":"NVD","date":"2026-10-11T02:16:38.627Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108702","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108702"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108702"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108702"}],"epss":{"score":0.00228,"date":"2026-10-12","percentile":0.12477}},{"id":"CVE-2026-108701","title":"CVE-2026-108701 — 1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability in the ContractControlle","summary":"1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability in the ContractController sortModule handler for POST /contract/sort, which lacks any permission annotation. Authenticated users without contract update permission can supply a dragNodeId, stage and field values to modify any contract, including contracts in other organizations.","source":"NVD","date":"2026-10-11T02:16:38.437Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108701","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108701"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108701"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108701"}],"epss":{"score":0.00196,"date":"2026-10-12","percentile":0.08552}},{"id":"CVE-2026-108700","title":"CVE-2026-108700 — 1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability that allows authenticate","summary":"1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability that allows authenticated users to list business titles by calling POST /field/source/business-title without permission checks. Users lacking CONTRACT_BUSINESS_TITLE_READ can retrieve organization invoicing entities, exposing tax identification numbers, bank account numbers, opening banks, registration addresses, and phone numbers.","source":"NVD","date":"2026-10-11T02:16:38.277Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108700","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108700"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108700"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108700"}],"epss":{"score":0.00238,"date":"2026-10-12","percentile":0.13732}},{"id":"CVE-2026-108696","title":"CVE-2026-108696 — CoreShop through 1.5.5 contains an authorization bypass vulnerability in the OrderController that allows ","summary":"CoreShop through 1.5.5 contains an authorization bypass vulnerability in the OrderController that allows authenticated customers to act on other customers' orders by supplying user-controlled ids. Attackers can omit the data field in OrderConfirm or supply another reshipId to SendReship to confirm receipt of others' orders and overwrite return tracking details.","source":"NVD","date":"2026-10-11T02:16:38.123Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108696","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108696"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108696"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108696"}],"epss":{"score":0.00222,"date":"2026-10-12","percentile":0.11731}},{"id":"CVE-2026-108695","title":"CVE-2026-108695 — MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allow","summary":"MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accounts to modify marketplace-wide settings via the settings REST endpoint. Attackers with the store_owner role can send POST requests to /wp-json/multivendorx/v1/settings, gated only by edit_stores, to overwrite commission, payout, and onboarding settings.","source":"NVD","date":"2026-10-11T02:16:37.957Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108695","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108695"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108695"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108695"}],"epss":{"score":0.00269,"date":"2026-10-12","percentile":0.17559}},{"id":"CVE-2026-108694","title":"CVE-2026-108694 — ConvertX through 0.19.0 contains an arbitrary file read vulnerability that allows authenticated users to ","summary":"ConvertX through 0.19.0 contains an arbitrary file read vulnerability that allows authenticated users to read server files because src/converters/pandoc.ts invokes Pandoc without the --sandbox flag. Attackers can upload a reStructuredText document with an include directive naming an absolute path, convert it, and download output containing the referenced file's contents.","source":"NVD","date":"2026-10-11T02:16:37.777Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108694","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108694"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108694"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108694"}],"epss":{"score":0.0026,"date":"2026-10-12","percentile":0.16326}},{"id":"CVE-2026-108693","title":"CVE-2026-108693 — ImageMagick on Windows through 7.1.2-33 and 6.9.13-58 contains an uncontrolled search path vulnerability ","summary":"ImageMagick on Windows through 7.1.2-33 and 6.9.13-58 contains an uncontrolled search path vulnerability in NTGhostscriptEXE() that launches gswin64c.exe by bare name when Ghostscript is unregistered. Attackers can plant a malicious gswin64c.exe in the working directory to execute code with ImageMagick privileges when PDF, PostScript, or EPS files are converted.","source":"NVD","date":"2026-10-11T02:16:37.607Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108693","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108693"],"cvss":{"score":7.3,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108693"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108693"}],"epss":{"score":0.00127,"date":"2026-10-12","percentile":0.02088}},{"id":"CVE-2026-108692","title":"CVE-2026-108692 — 1Panel-dev CordysCRM from 1.9.0 before 1.9.2 contains a missing authorization vulnerability in eight Modu","summary":"1Panel-dev CordysCRM from 1.9.0 before 1.9.2 contains a missing authorization vulnerability in eight ModuleFieldController /field/source data-source endpoints lacking permission checks. Authenticated users denied module permission can page through organization-wide leads, contacts, quotations, contracts, payment plans, payment records, orders and invoices owned by other users.","source":"NVD","date":"2026-10-11T02:16:37.360Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108692","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108692"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108692"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108692"}],"epss":{"score":0.00238,"date":"2026-10-12","percentile":0.13731}},{"id":"CVE-2026-108691","title":"CVE-2026-108691 — mall4j through 4.0 contains an improper authorization vulnerability that allows authenticated storefront ","summary":"mall4j through 4.0 contains an improper authorization vulnerability that allows authenticated storefront customers to delete other shoppers' cart items through an operator precedence error in the cleanExpiryProdList SQL statement. Attackers can send one DELETE request to /p/shopCart/cleanExpiryProdList to remove every user's cart entries for off-shelf products, which do not return when products are restocked.","source":"NVD","date":"2026-10-11T02:16:37.210Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108691","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108691"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108691"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108691"}],"epss":{"score":0.00238,"date":"2026-10-12","percentile":0.13713}},{"id":"CVE-2026-108690","title":"CVE-2026-108690 — mall4j through 4.0 contains an information disclosure vulnerability that allows authenticated customers t","summary":"mall4j through 4.0 contains an information disclosure vulnerability that allows authenticated customers to read other shoppers' cart items due to an operator precedence error in the getShopCartExpiryItems SQL filter. Attackers with any storefront account can request GET /p/shopCart/expiryProdList to retrieve off-shelf product basket entries including product, SKU, quantity, shop, and promoter card numbers.","source":"NVD","date":"2026-10-11T02:16:37.057Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108690","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108690"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108690"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108690"}],"epss":{"score":0.00217,"date":"2026-10-12","percentile":0.11228}},{"id":"CVE-2026-108689","title":"CVE-2026-108689 — Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows authenticated us","summary":"Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows authenticated users to write into other users' AI chat sessions by supplying an arbitrary sessionId to POST /chat/send. Attackers can append messages to a victim's conversation and receive streamed assistant replies built from the victim's last 20 messages, disclosing conversation content.","source":"NVD","date":"2026-10-11T02:16:36.887Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108689","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108689"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108689"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108689"}],"epss":{"score":0.00171,"date":"2026-10-12","percentile":0.05978}},{"id":"CVE-2026-108688","title":"CVE-2026-108688 — Eladmin through 2.7 contains a missing authorization vulnerability in the LocalStorageController uploadPi","summary":"Eladmin through 2.7 contains a missing authorization vulnerability in the LocalStorageController uploadPicture handler that allows low-privileged authenticated users to bypass the storage:add permission. Attackers can send POST requests with image-named files to /api/localStorage/pictures to write files into server local storage and disclose absolute server paths.","source":"NVD","date":"2026-10-11T02:16:35.100Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108688","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108688"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108688"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108688"}],"epss":{"score":0.00208,"date":"2026-10-12","percentile":0.10105}},{"id":"CVE-2026-104841","title":"CVE-2026-104841 — Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.","summary":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.","source":"NVD","date":"2026-10-10T23:16:26.747Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104841","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-104841"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-104841"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104841"}],"epss":null},{"id":"CVE-2026-108680","title":"CVE-2026-108680 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to send template notifications by calling POST /sys/api/sendTemplateAnnouncement. Low-privileged attackers can supply forged sender, recipients, title, and template parameters to deliver messages appearing to come from admin or system accounts.","source":"NVD","date":"2026-10-10T22:16:45.233Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108680","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108680"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108680"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108680"}],"epss":{"score":0.0019,"date":"2026-10-12","percentile":0.07916}},{"id":"CVE-2026-108679","title":"CVE-2026-108679 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the sendBusAnnouncement handler","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the sendBusAnnouncement handler of SystemApiController that allows any authenticated user to send announcements without the required permissions. Low-privileged attackers can POST crafted bodies to /sys/api/sendBusAnnouncement with forged sender, recipients, title and content to deliver spoofed admin or system messages for phishing.","source":"NVD","date":"2026-10-10T22:16:45.090Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108679","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108679"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108679"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108679"}],"epss":{"score":0.0019,"date":"2026-10-12","percentile":0.07917}},{"id":"CVE-2026-108678","title":"CVE-2026-108678 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryUserRoles handler of S","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryUserRoles handler of SystemApiController that lets authenticated users read any user's role codes. Low-privileged attackers can send GET requests to /sys/api/queryUserRoles with an arbitrary username to enumerate role assignments and identify administrator accounts.","source":"NVD","date":"2026-10-10T22:16:44.947Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108678","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108678"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108678"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108678"}],"epss":{"score":0.00193,"date":"2026-10-12","percentile":0.08239}},{"id":"CVE-2026-108677","title":"CVE-2026-108677 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability in GET /sys/api/getUserByName that","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability in GET /sys/api/getUserByName that allows low-privileged authenticated users to retrieve any user's stored password value. Attackers can decrypt the AES-CBC protected response using the hard-coded key exposed by /sys/getEncryptedString to obtain administrators' password ciphertexts for offline guessing.","source":"NVD","date":"2026-10-10T22:16:44.800Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108677","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108677"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108677"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108677"}],"epss":{"score":0.00231,"date":"2026-10-12","percentile":0.12798}},{"id":"CVE-2026-108676","title":"CVE-2026-108676 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysAnnouncementController d","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysAnnouncementController downLoadFiles handler that allows low-privileged authenticated users to download announcement attachments. Attackers can supply a known announcement id to retrieve a ZIP of attachments from unreleased announcements or those addressed only to other users.","source":"NVD","date":"2026-10-10T22:16:44.637Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108676","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108676"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108676"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108676"}],"epss":{"score":0.00193,"date":"2026-10-12","percentile":0.08234}},{"id":"CVE-2026-108675","title":"CVE-2026-108675 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysAnnouncementController e","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysAnnouncementController editIzTop handler that allows low-privileged authenticated users to change announcement pin status. Attackers can send POST or PUT requests with any announcement id to pin or unpin system notices shown at the top for all users.","source":"NVD","date":"2026-10-10T22:16:44.493Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108675","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108675"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108675"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108675"}],"epss":{"score":0.0019,"date":"2026-10-12","percentile":0.07917}},{"id":"CVE-2026-108674","title":"CVE-2026-108674 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the OpenApiController queryById","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the OpenApiController queryById handler that allows low-privileged authenticated users to read OpenAPI definitions without openapi permissions. Attackers can request GET /openapi/queryById with an entry id to obtain internal origin URLs, virtual paths, IP whitelists, and header and parameter templates.","source":"NVD","date":"2026-10-10T22:16:44.350Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108674","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108674"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108674"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108674"}],"epss":{"score":0.00193,"date":"2026-10-12","percentile":0.08236}},{"id":"CVE-2026-108673","title":"CVE-2026-108673 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController expo","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController exportXls handler that allows any authenticated user to export all AI prompts. Low-privileged attackers can request /airag/prompts/exportXls to download every user's prompts, including prompt content, model ids, and parameters, as an Excel workbook.","source":"NVD","date":"2026-10-10T22:16:44.207Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108673","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108673"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108673"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108673"}],"epss":{"score":0.00193,"date":"2026-10-12","percentile":0.08237}},{"id":"CVE-2026-108672","title":"CVE-2026-108672 — JeecgBoot through 3.9.5 contains an authorization bypass vulnerability in the getVideoRecords handler of ","summary":"JeecgBoot through 3.9.5 contains an authorization bypass vulnerability in the getVideoRecords handler of VideoGenerationController that allows authenticated users to read other users' records via the userId parameter. Low-privileged attackers can supply another user id to retrieve their AI video generation history, including prompts, task ids, video URLs and cover URLs.","source":"NVD","date":"2026-10-10T22:16:44.063Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108672","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108672"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108672"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108672"}],"epss":{"score":0.00209,"date":"2026-10-12","percentile":0.10287}},{"id":"CVE-2026-108671","title":"CVE-2026-108671 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to read MCP server configurations because the queryById permission check is commented out. Attackers can obtain record ids from the unguarded /airag/app/queryById endpoint and retrieve MCP endpoint URLs, headers, and outbound authentication tokens.","source":"NVD","date":"2026-10-10T22:16:43.920Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108671","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108671"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108671"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108671"}],"epss":{"score":0.0028,"date":"2026-10-12","percentile":0.18893}},{"id":"CVE-2026-108670","title":"CVE-2026-108670 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the promptExperiment handler of","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the promptExperiment handler of AiragPromptsController that allows any authenticated user to run AI prompt experiments. Low-privileged attackers can supply other users' prompt template and dataset ids to trigger large language model evaluation runs, write result rows into airag_ext_data, and change dataset status.","source":"NVD","date":"2026-10-10T22:16:43.777Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108670","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108670"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108670"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108670"}],"epss":{"score":0.0019,"date":"2026-10-12","percentile":0.07915}},{"id":"CVE-2026-108669","title":"CVE-2026-108669 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the embeddingSearch handler of ","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the embeddingSearch handler of AiragKnowledgeController that lacks Shiro permission annotations. Low-privileged authenticated attackers can supply knowledge base ids to the GET /airag/knowledge/embedding/search endpoint to read document text chunks from unauthorized knowledge bases.","source":"NVD","date":"2026-10-10T22:16:43.637Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108669","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108669"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108669"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108669"}],"epss":{"score":0.00193,"date":"2026-10-12","percentile":0.08236}},{"id":"CVE-2026-108668","title":"CVE-2026-108668 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController dele","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController deleteRecycleBin handler that allows any authenticated user to purge AI prompt templates. Low-privileged attackers can send DELETE requests with prompt template ids to permanently remove recycle-bin templates belonging to administrators or other users.","source":"NVD","date":"2026-10-10T22:16:43.493Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108668","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108668"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108668"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108668"}],"epss":{"score":0.00211,"date":"2026-10-12","percentile":0.10546}},{"id":"CVE-2026-108667","title":"CVE-2026-108667 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authent","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to restore deleted AI prompt templates by calling the revertRecycleBin endpoint. Attackers can send PUT requests to /airag/prompts/revertRecycleBin with chosen template ids to clear deleted flags, undoing administrator removals.","source":"NVD","date":"2026-10-10T22:16:43.357Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108667","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108667"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108667"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108667"}],"epss":{"score":0.0019,"date":"2026-10-12","percentile":0.07916}},{"id":"CVE-2026-108666","title":"CVE-2026-108666 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the deleteBatch handler of Aira","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the deleteBatch handler of AiragPromptsController that allows any authenticated user to delete AI prompt templates. Low-privileged attackers can obtain prompt ids from the unguarded list endpoint and pass them to deleteBatch to remove templates created by administrators or other users.","source":"NVD","date":"2026-10-10T22:16:43.210Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108666","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108666"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108666"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108666"}],"epss":{"score":0.00211,"date":"2026-10-12","percentile":0.10547}},{"id":"CVE-2026-108665","title":"CVE-2026-108665 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController edit","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController edit handler that allows any authenticated user to modify AI prompt templates. Low-privileged attackers can send PUT or POST requests to /airag/prompts/edit with a template id to overwrite prompt text and model parameters created by administrators or other users.","source":"NVD","date":"2026-10-10T22:16:43.070Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108665","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108665"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108665"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108665"}],"epss":{"score":0.0019,"date":"2026-10-12","percentile":0.07915}},{"id":"CVE-2026-108664","title":"CVE-2026-108664 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController quer","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController queryById handler that allows low-privileged authenticated users to read any AI prompt template. Attackers can enumerate ids via the unguarded /airag/prompts/list endpoint and query each one to obtain prompt text, model parameters, and creator details belonging to administrators or other users.","source":"NVD","date":"2026-10-10T22:16:42.927Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108664","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108664"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108664"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108664"}],"epss":{"score":0.00193,"date":"2026-10-12","percentile":0.08239}},{"id":"CVE-2026-108663","title":"CVE-2026-108663 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController deleteA","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController deleteApply handler that allows any authenticated user to reject tenant administrator applications. Low-privileged attackers can send PUT requests with chosen tenantId, packId and userId values to delete pending applications in any tenant and notify applicants of rejection.","source":"NVD","date":"2026-10-10T22:16:42.780Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108663","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108663"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108663"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108663"}],"epss":{"score":0.0019,"date":"2026-10-12","percentile":0.07916}},{"id":"CVE-2026-108662","title":"CVE-2026-108662 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authent","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove users from tenant product packs via PUT /sys/tenant/deleteTenantPackUser. Attackers can supply arbitrary userId and packId values in the request body to remove any user from any tenant's product pack, revoking permissions such as tenant administrator access.","source":"NVD","date":"2026-10-10T22:16:42.637Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108662","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108662"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108662"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108662"}],"epss":{"score":0.00211,"date":"2026-10-12","percentile":0.10547}},{"id":"CVE-2026-108661","title":"CVE-2026-108661 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to transfer tenant ownership via POST /sys/tenant/changeOwenUserTenant. Low-privileged attackers can supply userId and tenantId parameters to reassign any tenant's owner to a member, including themselves, and strip the legitimate owner.","source":"NVD","date":"2026-10-10T22:16:42.493Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108661","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108661"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108661"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108661"}],"epss":{"score":0.00213,"date":"2026-10-12","percentile":0.10728}},{"id":"CVE-2026-108660","title":"CVE-2026-108660 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to modify tenant settings by calling PUT /sys/tenant/updateApplyStatus. Low-privileged attackers can supply any tenant id to overwrite its applyStatus field, enabling or disabling tenant administrator applications across tenants.","source":"NVD","date":"2026-10-10T22:16:42.350Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108660","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108660"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108660"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108660"}],"epss":{"score":0.0019,"date":"2026-10-12","percentile":0.07918}},{"id":"CVE-2026-108659","title":"CVE-2026-108659 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController listPac","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController listPackByTenantUserId handler that allows any authenticated user to query tenant product packs. Low-privileged attackers can supply arbitrary tenantId and userId parameters to enumerate any tenant's product pack configuration and reveal which users are tenant administrators.","source":"NVD","date":"2026-10-10T22:16:42.207Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108659","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108659"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108659"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108659"}],"epss":{"score":0.00193,"date":"2026-10-12","percentile":0.08234}},{"id":"CVE-2026-108658","title":"CVE-2026-108658 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController queryTe","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController queryTenantAuthInfo handler that allows any authenticated user to read other tenants' records. Low-privileged attackers can iterate small integer tenant ids to retrieve full sys_tenant records, including house numbers used as tenant join codes and company profile fields.","source":"NVD","date":"2026-10-10T22:16:42.067Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108658","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108658"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108658"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108658"}],"epss":{"score":0.00193,"date":"2026-10-12","percentile":0.08237}},{"id":"CVE-2026-108657","title":"CVE-2026-108657 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController passApp","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController passApply handler that allows any authenticated user to approve tenant administrator applications. Attackers can file a pending application via doApplyTenantPackUser and approve it through PUT /sys/tenant/passApply to gain tenant administrator pack permissions in any tenant.","source":"NVD","date":"2026-10-10T22:16:41.923Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108657","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108657"],"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108657"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108657"}],"epss":{"score":0.00231,"date":"2026-10-12","percentile":0.12799}},{"id":"CVE-2026-108656","title":"CVE-2026-108656 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController GET /sy","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController GET /sys/tenant/getTenantPackApplyUsers endpoint that allows any authenticated user to read tenant administrator applications. Low-privileged attackers can iterate the tenantId parameter to retrieve pending applicants' usernames, real names, phone numbers and departments for any tenant.","source":"NVD","date":"2026-10-10T22:16:41.783Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108656","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108656"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108656"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108656"}],"epss":{"score":0.00193,"date":"2026-10-12","percentile":0.08239}},{"id":"CVE-2026-108655","title":"CVE-2026-108655 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the QuartzJobController queryBy","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the QuartzJobController queryById handler that allows low-privileged authenticated users to read scheduled job records. Attackers can request GET /sys/quartzJob/queryById with a job id to retrieve job class names, cron expressions, job parameters and status reserved for administrators.","source":"NVD","date":"2026-10-10T22:16:41.637Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108655","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108655"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108655"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108655"}],"epss":{"score":0.00243,"date":"2026-10-12","percentile":0.1425}},{"id":"CVE-2026-108654","title":"CVE-2026-108654 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the OssFileController queryById","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the OssFileController queryById handler that allows low-privileged authenticated users to read object storage file records. Attackers who know a record id can request GET /sys/oss/file/queryById to obtain original file names and direct storage URLs of files uploaded by other users.","source":"NVD","date":"2026-10-10T22:16:41.497Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108654","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108654"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108654"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108654"}],"epss":{"score":0.00243,"date":"2026-10-12","percentile":0.14252}},{"id":"CVE-2026-108653","title":"CVE-2026-108653 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryPageList handler of Op","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryPageList handler of OpenApiController that allows any authenticated user to list OpenAPI registry definitions. Low-privileged attackers can query GET /openapi/list to read virtual paths, internal origin URLs, IP whitelists, and header and parameter templates intended for administrators.","source":"NVD","date":"2026-10-10T22:16:41.347Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108653","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108653"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108653"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108653"}],"epss":{"score":0.00243,"date":"2026-10-12","percentile":0.14251}},{"id":"CVE-2026-108652","title":"CVE-2026-108652 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SystemApiController updateA","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SystemApiController updateAvatar handler that allows any authenticated user to change other users' avatars. Low-privileged attackers can send PUT requests with a target user id and an arbitrary value, such as an attacker-controlled image URL, to replace administrators' avatars.","source":"NVD","date":"2026-10-10T22:16:41.203Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108652","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108652"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108652"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108652"}],"epss":{"score":0.00238,"date":"2026-10-12","percentile":0.13718}},{"id":"CVE-2026-108651","title":"CVE-2026-108651 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getRolesByUserId handler of","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getRolesByUserId handler of SystemApiController that allows authenticated users to retrieve any user's role codes. Low-privileged attackers can supply arbitrary userId values to GET /sys/api/getRolesByUserId to enumerate role assignments and identify administrator accounts.","source":"NVD","date":"2026-10-10T22:16:41.043Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108651","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108651"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108651"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108651"}],"epss":{"score":0.00243,"date":"2026-10-12","percentile":0.14253}},{"id":"CVE-2026-108650","title":"CVE-2026-108650 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getUserPermissionSet handle","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getUserPermissionSet handler of SystemApiController that allows any authenticated user to read other users' permission codes. Low-privileged attackers can supply an arbitrary userId to GET /sys/api/getUserPermissionSet to retrieve the full permission set of any account, including administrators.","source":"NVD","date":"2026-10-10T22:16:40.893Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108650","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108650"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108650"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108650"}],"epss":{"score":0.00243,"date":"2026-10-12","percentile":0.14253}},{"id":"CVE-2026-108649","title":"CVE-2026-108649 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryUserRolesById handler ","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryUserRolesById handler of SystemApiController that lets authenticated users read any user's role codes. Low-privileged attackers can send a userId to GET /sys/api/queryUserRolesById to enumerate role assignments and identify administrator accounts.","source":"NVD","date":"2026-10-10T22:16:40.743Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108649","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108649"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108649"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108649"}],"epss":{"score":0.00243,"date":"2026-10-12","percentile":0.14252}},{"id":"CVE-2026-108648","title":"CVE-2026-108648 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the GET /sys/api/getDynamicDbSo","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the GET /sys/api/getDynamicDbSourceByCode endpoint of SystemApiController, which lacks Shiro permission or role annotations. Any authenticated low-privileged user can supply datasource codes in the dbSourceCode parameter to retrieve JDBC URLs, usernames and decrypted cleartext database passwords.","source":"NVD","date":"2026-10-10T22:16:40.600Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108648","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108648"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108648"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108648"}],"epss":{"score":0.00294,"date":"2026-10-12","percentile":0.2034}},{"id":"CVE-2026-108647","title":"CVE-2026-108647 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authent","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create validation rules through the SysCheckRuleController importExcel handler. Attackers can upload a crafted Excel workbook to bypass the system:checkRule:add permission and bulk-create system-wide encoding validation rules with arbitrary regular expression patterns.","source":"NVD","date":"2026-10-10T22:16:40.453Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108647","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108647"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108647"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108647"}],"epss":{"score":0.00262,"date":"2026-10-12","percentile":0.16633}},{"id":"CVE-2026-108646","title":"CVE-2026-108646 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysCategoryController impor","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysCategoryController importExcel handler that allows any authenticated user to import category dictionary entries. Low-privileged attackers can upload crafted Excel workbooks to bulk insert arbitrary nodes into the system-wide sys_category dictionary, including under existing parent nodes.","source":"NVD","date":"2026-10-10T22:16:40.307Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108646","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108646"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108646"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108646"}],"epss":{"score":0.00238,"date":"2026-10-12","percentile":0.13717}},{"id":"CVE-2026-108645","title":"CVE-2026-108645 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysCategoryController that allo","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysCategoryController that allows any authenticated user to edit category dictionary nodes via /sys/category/edit. Low-privileged attackers can send POST or PUT requests supplying a node id to rename, recode, or move system-wide sys_category nodes, altering classification values used across forms.","source":"NVD","date":"2026-10-10T22:16:40.163Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108645","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108645"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108645"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108645"}],"epss":{"score":0.00238,"date":"2026-10-12","percentile":0.13716}},{"id":"CVE-2026-108644","title":"CVE-2026-108644 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysCategoryController delet","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysCategoryController delete handler that allows any authenticated user to delete category dictionary nodes. Low-privileged attackers can obtain node ids from the unguarded rootList and childList endpoints and delete entire sys_category subtrees, breaking dependent forms and dictionary fields.","source":"NVD","date":"2026-10-10T22:16:40.013Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108644","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108644"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108644"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108644"}],"epss":{"score":0.00269,"date":"2026-10-12","percentile":0.17618}},{"id":"CVE-2026-108643","title":"CVE-2026-108643 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authent","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete category dictionary entries via DELETE /sys/category/deleteBatch. Attackers can obtain node ids from the unguarded rootList and childList endpoints and submit them to recursively delete entire sys_category subtrees, breaking dependent forms and dictionary fields.","source":"NVD","date":"2026-10-10T22:16:39.863Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108643","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108643"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108643"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108643"}],"epss":{"score":0.00269,"date":"2026-10-12","percentile":0.17617}},{"id":"CVE-2026-108642","title":"CVE-2026-108642 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysAnnouncementSendController t","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysAnnouncementSendController that allows authenticated users to modify other users' message delivery records. Attackers can obtain delivery ids from GET /sys/sysAnnouncementSend/list and submit edit requests that overwrite read flags, recipient ids, or linked announcements to hide messages from recipients.","source":"NVD","date":"2026-10-10T22:16:39.700Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108642","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108642"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108642"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108642"}],"epss":{"score":0.00238,"date":"2026-10-12","percentile":0.1372}},{"id":"CVE-2026-108641","title":"CVE-2026-108641 — JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authentica","summary":"JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' in-application messages via the getOne handler of SysAnnouncementSendController. Attackers can obtain delivery record ids from the unguarded /sys/sysAnnouncementSend/list endpoint and supply them as the sendId parameter to retrieve message titles, bodies, senders and recipients.","source":"NVD","date":"2026-10-10T22:16:39.467Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108641","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108641"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108641"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108641"}],"epss":{"score":0.00243,"date":"2026-10-12","percentile":0.14252}},{"id":"CVE-2026-108640","title":"CVE-2026-108640 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartRoleController que","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartRoleController queryById handler that lacks Shiro permission annotations. Low-privileged authenticated attackers can request GET /sys/sysDepartRole/queryById with any id to read department role names, codes, descriptions and audit fields.","source":"NVD","date":"2026-10-10T22:16:39.310Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108640","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108640"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108640"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108640"}],"epss":{"score":0.00243,"date":"2026-10-12","percentile":0.1425}},{"id":"CVE-2026-108639","title":"CVE-2026-108639 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to permanently delete data dictionaries via the deletePhysic handler of SysDictController. Low-privileged attackers can send DELETE requests to /sys/dict/deletePhysic/{id} to irreversibly remove active dictionaries and all their items, bypassing the recycle bin.","source":"NVD","date":"2026-10-10T22:16:39.160Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108639","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108639"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108639"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108639"}],"epss":{"score":0.0029,"date":"2026-10-12","percentile":0.1987}},{"id":"CVE-2026-108638","title":"CVE-2026-108638 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authent","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove group memberships via the deleteGroupUser handler in SysUserController. Attackers can send DELETE requests with arbitrary groupId and userId values to remove any user from any administrator-maintained user group without ownership or tenant checks.","source":"NVD","date":"2026-10-10T22:16:39.013Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108638","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108638"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108638"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108638"}],"epss":{"score":0.00238,"date":"2026-10-12","percentile":0.13719}},{"id":"CVE-2026-108637","title":"CVE-2026-108637 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authent","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove user group members by calling DELETE /sys/user/deleteUserGroupBatch. Attackers can supply any groupId and comma-separated userIds to delete sys_ugroup_user rows without permission or tenant checks, tampering with administrator-maintained groups.","source":"NVD","date":"2026-10-10T22:16:38.870Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108637","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108637"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108637"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108637"}],"epss":{"score":0.00238,"date":"2026-10-12","percentile":0.13718}},{"id":"CVE-2026-108636","title":"CVE-2026-108636 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartController appImpo","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartController appImportExcel handler that allows any authenticated user to import departments. Low-privileged attackers can upload a crafted Excel workbook to POST /sys/sysDepart/appImportExcel to create arbitrary sys_depart records in the administrator-maintained department tree.","source":"NVD","date":"2026-10-10T22:16:38.727Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108636","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108636"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108636"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108636"}],"epss":{"score":0.00238,"date":"2026-10-12","percentile":0.13717}},{"id":"CVE-2026-108635","title":"CVE-2026-108635 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the GET /sys/sysDepart/getDepar","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the GET /sys/sysDepart/getDepartmentHead endpoint of SysDepartController that allows any authenticated user to list department staff. Low-privileged attackers can enumerate departId values to retrieve staff names, avatars, posts, and mobile and telephone numbers, including contacts marked hidden.","source":"NVD","date":"2026-10-10T22:16:38.587Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108635","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108635"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108635"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108635"}],"epss":{"score":0.00243,"date":"2026-10-12","percentile":0.14251}},{"id":"CVE-2026-108634","title":"CVE-2026-108634 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authent","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete department permission bindings via the DELETE /sys/sysDepartPermission/deleteBatch endpoint. Attackers can obtain row ids from the unguarded list endpoint and submit them in the ids parameter to remove menus and buttons departments can grant to their roles.","source":"NVD","date":"2026-10-10T22:16:38.447Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108634","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108634"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108634"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108634"}],"epss":{"score":0.00269,"date":"2026-10-12","percentile":0.17617}},{"id":"CVE-2026-108633","title":"CVE-2026-108633 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authent","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create department permission bindings via POST /sys/sysDepartPermission/add. Attackers can submit arbitrary departId, permissionId and dataRuleIds fields to attach menu, button and data rule grants to any department for delegation to its roles.","source":"NVD","date":"2026-10-10T22:16:38.307Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108633","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108633"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108633"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108633"}],"epss":{"score":0.00238,"date":"2026-10-12","percentile":0.13719}},{"id":"CVE-2026-108632","title":"CVE-2026-108632 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartPermissionControll","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartPermissionController queryById handler that allows any authenticated user to read department permission records. Low-privileged attackers can request GET /sys/sysDepartPermission/queryById with arbitrary ids to retrieve depart_id, permission_id and data_rule_ids for any department.","source":"NVD","date":"2026-10-10T22:16:38.167Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108632","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108632"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108632"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108632"}],"epss":{"score":0.00243,"date":"2026-10-12","percentile":0.1425}},{"id":"CVE-2026-108631","title":"CVE-2026-108631 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartPermissionControll","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartPermissionController delete handler that allows low-privileged authenticated users to delete department permission bindings. Attackers can obtain row ids from the unguarded list endpoint and send DELETE requests with the id parameter to remove menus or buttons departments can grant their roles.","source":"NVD","date":"2026-10-10T22:16:38.023Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108631","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108631"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108631"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108631"}],"epss":{"score":0.00269,"date":"2026-10-12","percentile":0.17616}},{"id":"CVE-2026-108630","title":"CVE-2026-108630 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysDepartPermissionController t","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysDepartPermissionController that allows any authenticated user to modify department permission records by calling the edit endpoint. Low-privileged attackers can obtain row ids from the unguarded list endpoint and overwrite depart_id, permission_id and data_rule_ids to alter which menus and data rules departments may delegate.","source":"NVD","date":"2026-10-10T22:16:37.873Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108630","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108630"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108630"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108630"}],"epss":{"score":0.00238,"date":"2026-10-12","percentile":0.1372}},{"id":"CVE-2026-108629","title":"CVE-2026-108629 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDatarule handler of Sys","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDatarule handler of SysDepartPermissionController that allows any authenticated user to modify department data rules. Low-privileged attackers can send departId, permissionId and dataRuleIds to POST /sys/sysDepartPermission/datarule to change, add or clear data rules on any department-menu permission binding.","source":"NVD","date":"2026-10-10T22:16:37.730Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108629","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108629"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108629"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108629"}],"epss":{"score":0.00238,"date":"2026-10-12","percentile":0.13719}},{"id":"CVE-2026-108628","title":"CVE-2026-108628 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDeptRolePermission endp","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDeptRolePermission endpoint of SysDepartPermissionController that allows any authenticated user to modify department role permissions. Low-privileged attackers can submit roleId and permissionIds values to grant arbitrary menu or button permissions, escalating privileges or revoking other users' permissions.","source":"NVD","date":"2026-10-10T22:16:37.590Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108628","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108628"],"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108628"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108628"}],"epss":{"score":0.00231,"date":"2026-10-12","percentile":0.12798}},{"id":"CVE-2026-108627","title":"CVE-2026-108627 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the loadDatarule handler of Sys","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the loadDatarule handler of SysRoleController that lets any authenticated user query role data rules. Low-privileged attackers can request GET /sys/role/datarule/{permissionId}/{roleId} to read rule names, columns, conditions, values and bound rule ids for any role.","source":"NVD","date":"2026-10-10T22:16:37.450Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108627","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108627"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108627"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108627"}],"epss":{"score":0.00243,"date":"2026-10-12","percentile":0.14253}},{"id":"CVE-2026-108626","title":"CVE-2026-108626 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController queryB","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController queryById handler that allows low-privileged authenticated users to read any message push record. Attackers can supply arbitrary record ids to GET /sys/message/sysMessage/queryById to disclose message content and receiver addresses of other users.","source":"NVD","date":"2026-10-10T22:16:37.307Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108626","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108626"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108626"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108626"}],"epss":{"score":0.00243,"date":"2026-10-12","percentile":0.14251}},{"id":"CVE-2026-108625","title":"CVE-2026-108625 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authent","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify message push records by calling PUT /sys/message/sysMessage/edit. Attackers can submit a request body naming any sys_sms record id to overwrite its title, content, receiver address and send status without ownership checks.","source":"NVD","date":"2026-10-10T22:16:37.167Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108625","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108625"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108625"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108625"}],"epss":{"score":0.00238,"date":"2026-10-12","percentile":0.13719}},{"id":"CVE-2026-108624","title":"CVE-2026-108624 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController delete","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController deleteBatch handler that allows low-privileged authenticated users to delete message records. Attackers can obtain record ids from the unguarded list endpoint and submit them to deleteBatch to remove any message push records, including pending queued messages.","source":"NVD","date":"2026-10-10T22:16:37.020Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108624","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108624"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108624"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108624"}],"epss":{"score":0.00269,"date":"2026-10-12","percentile":0.17616}},{"id":"CVE-2026-108623","title":"CVE-2026-108623 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysLogController deleteBatc","summary":"JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysLogController deleteBatch handler that allows any authenticated user to delete system audit log entries. Low-privileged attackers can send a DELETE request with ids set to allclear to wipe the entire sys_log table, erasing all users' audit trails.","source":"NVD","date":"2026-10-10T22:16:36.870Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108623","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108623"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108623"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108623"}],"epss":{"score":0.00303,"date":"2026-10-12","percentile":0.21279}}]}