Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-109704 | high | 8.8 | No | Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, a... | 2026-10-14 |
| CVE-2026-109605 | high | 7.3 | No | A security vulnerability has been detected in SourceCodester Simple Cafe Billing System 1.0. This affects the function Action::save_user of... | 2026-10-14 |
| CVE-2026-108705 | medium | 4.3 | No | CordysCRM through 1.9.3 contains a missing authorization vulnerability in the POST /custom-form/data/import endpoint that allows authenticat... | 2026-10-14 |
| CVE-2026-108700 | medium | 6.5 | No | 1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability that allows authenticated users to list business titles by... | 2026-10-14 |
| CVE-2026-108692 | medium | 6.5 | No | 1Panel-dev CordysCRM from 1.9.0 before 1.9.2 contains a missing authorization vulnerability in eight ModuleFieldController /field/source dat... | 2026-10-14 |
| CVE-2026-108680 | medium | 4.3 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to send template notifications by... | 2026-10-14 |
| CVE-2026-108675 | medium | 4.3 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysAnnouncementController editIzTop handler that allows low-pr... | 2026-10-14 |
| CVE-2026-108670 | medium | 4.3 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the promptExperiment handler of AiragPromptsController that allows... | 2026-10-14 |
| CVE-2026-108665 | medium | 4.3 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController edit handler that allows any authentica... | 2026-10-14 |
| CVE-2026-108660 | medium | 4.3 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to modify tenant settings by calli... | 2026-10-14 |
| CVE-2026-108655 | medium | 4.3 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the QuartzJobController queryById handler that allows low-privileg... | 2026-10-14 |
| CVE-2026-108650 | medium | 4.3 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getUserPermissionSet handler of SystemApiController that allow... | 2026-10-14 |
| CVE-2026-108645 | medium | 4.3 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysCategoryController that allows any authenticated user to edit c... | 2026-10-14 |
| CVE-2026-108640 | medium | 4.3 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartRoleController queryById handler that lacks Shiro per... | 2026-10-14 |
| CVE-2026-108635 | medium | 4.3 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the GET /sys/sysDepart/getDepartmentHead endpoint of SysDepartCont... | 2026-10-14 |
| CVE-2026-108630 | medium | 4.3 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysDepartPermissionController that allows any authenticated user t... | 2026-10-14 |
| CVE-2026-108625 | medium | 4.3 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify message push... | 2026-10-14 |
| CVE-2026-108620 | medium | 5.4 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController deleteBatch handler that allows any auth... | 2026-10-14 |
| CVE-2026-108615 | medium | 5.4 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController delete handler that allows low-privileg... | 2026-10-14 |
| CVE-2026-108610 | medium | 4.3 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateController edit handler that allows any authen... | 2026-10-14 |