CyberStack

NIST

CVE intelligence

Cached from NVD. 2026-10-26 00:40 Perth time (AWST). Recent.

1756KEV listed
209Published, last 14 days
654Critical
981High
CVETitleVendorPublishedCVSSKEV listed
CVE-2026-108868JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to publish templated system announ—2026-10-11—
CVE-2026-108867JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SystemApiController getUserRoleSetById handler that allows any—2026-10-11—
CVE-2026-108866JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows authenticated users to read any account's permissions via—2026-10-11—
CVE-2026-108865AmoyLab Unla through 0.10.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid access tok—2026-10-11—
CVE-2026-108864iFlytek Astron Agent through 1.1.2 contains an insecure direct object reference vulnerability that allows authenticated applications to resu—2026-10-11—
CVE-2026-108863Katanemo Plano through 0.4.37 contains a missing authentication vulnerability that allows unauthenticated network attackers to access the En—2026-10-11—
CVE-2026-108862APIPark through 1.9.7-beta contains an insecure direct object reference vulnerability that allows authenticated users to read other applicat—2026-10-11—
CVE-2026-108861Odoo MCP 1.0.0 through 1.3.2 contains an information disclosure vulnerability that allows MCP clients to bypass the field-level ACL by invok—2026-10-11—
CVE-2026-108860BotSharp through 5.2.0 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge bearer tokens u—2026-10-11—
CVE-2026-108859mcp-go through 1.2.1 contains a denial of service vulnerability in StreamableHTTPServer.ServeHTTP that allows remote unauthenticated attacke—2026-10-11—
CVE-2026-108858Predibase LoRAX through 0.12.1 contains a sensitive information exposure vulnerability that writes the caller-supplied api_token from POST /—2026-10-11—
CVE-2026-108857Hugging Face Text Embeddings Inference through 1.9.4 contains a cleartext logging vulnerability that exposes the configured api_key because —2026-10-11—
CVE-2026-108856UnicomAI Wanwu through 0.6.5 contains an authorization bypass vulnerability that allows authenticated users to mint AppKeys bound to other u—2026-10-11—
CVE-2026-108855UnicomAI Wanwu through 0.6.5 contains a missing authorization vulnerability that allows any authenticated enabled user to revoke other users—2026-10-11—
CVE-2026-108854Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows any authenticated enabled user to delete other use—2026-10-11—
CVE-2026-108853UnicomAI Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to del—2026-10-11—
CVE-2026-108852Deep Chat through 2.5.1 contains a cross-site scripting vulnerability that allows attackers to inject javascript: links because RemarkableCo—2026-10-11—
CVE-2026-108851phpMyFAQ through 4.1.10 contains a missing authorization vulnerability in the MCP server faq_search tool that allows MCP clients to read res—2026-10-11—
CVE-2026-108850Company Research Agent through 2.2.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger o—2026-10-11—
CVE-2026-108839thClaws through 0.141.0 contains a link-following vulnerability in the post_inputs handler of the v1 API POST /v1/inputs endpoint that allow—2026-10-11—
CVE-2026-108760LlamaFarm through 0.0.34 contains an insecure default configuration that binds its unauthenticated FastAPI server to 0.0.0.0 on port 14345, —2026-10-11—
CVE-2026-108759mistral.rs 0.9.0 through 0.9.4 contains a link following vulnerability in mistralrs-code-exec that allows sandboxed shell code to read and o—2026-10-11—
CVE-2026-108758Easy!Appointments through 1.6.0 contains an authorization bypass vulnerability in Booking::register() that allows unauthenticated attackers —2026-10-11—
CVE-2026-108757Nexting pinclaw OpenClaw channel plugin through 0.3.0 contains a missing authentication vulnerability in src/core/http-router.ts that skips —2026-10-11—
CVE-2026-108756Abilityai Trinity through 0.9.5 contains a missing authorization vulnerability in the Telegram router that allows agent-scoped MCP API keys —2026-10-11—
CVE-2026-108755Hatchet through 0.110.5 contains an allocation of resources without limits vulnerability that allows unauthenticated attackers to exhaust me—2026-10-11—
CVE-2026-108754GPT-Load through 1.4.11 contains a cleartext logging vulnerability that exposes client proxy keys because the Gin Logger middleware records —2026-10-11—
CVE-2026-108753Agnaistic agnai through 1.0.555 contains a hard-coded credentials vulnerability in self-host.docker-compose.yml, which sets a fixed admin pa—2026-10-11—
CVE-2026-108752JupyterHub through 6.0.1 contains an identifier collision vulnerability that allows authenticated users to overwrite another user's named-se—2026-10-11—
CVE-2026-108751MoAI-ADK through 3.1.2 contains an improper link resolution vulnerability in the moai init template deployer that allows malicious repositor—2026-10-11—
CVE-2026-108750OpenDocMan 2.4.0 through 2.10.0 contains a decompression bomb vulnerability that allows authenticated users to exhaust PHP memory by uploadi—2026-10-11—
CVE-2026-108748Quarkus LangChain4j 1.9.0 through 1.14.1 contains a missing release of memory vulnerability in the chat-scopes WebSocket /_chat/routes endpo—2026-10-11—
CVE-2026-108747Lightdash through 2.556.0 contains an authorization bypass vulnerability that allows authenticated organization members to delete other user—2026-10-11—
CVE-2026-108746Vearch 3.5.2 through 3.5.9 contains an incorrect authorization vulnerability in Role.HasPermissionForResources that ignores stored ReadOnly —2026-10-11—
CVE-2026-108745CloudBeaver through 25.3.5 contains a missing authorization vulnerability in WebSQLResultServlet that allows any web session holder to read —2026-10-11—
CVE-2026-108744pbi-cli 3.10.1 through 3.12.0 contains an OS command injection vulnerability in desktop_sync.py that passes unquoted .pbip paths to cmd /c s—2026-10-11—
CVE-2026-108742CloudBeaver through 25.3.5 contains a missing authorization vulnerability in the initConnection GraphQL mutation that lets view-only shared-—2026-10-11—
CVE-2026-108741Shepherd (shepherd-ai) through 0.3.1 contains a server-side request forgery guard bypass in the citation-checker extra because the public_ur—2026-10-11—
CVE-2026-108740GoatCounter through 2.7.0 contains a mass assignment privilege escalation vulnerability in the userPrefSave handler that allows logged-in us—2026-10-11—
CVE-2026-108739OpenAgents Workspace backend through launcher-v1.0.17 contains an information disclosure vulnerability that allows unauthenticated attackers—2026-10-11—

Previous81–120 of 209Next