Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-108654 | medium | 4.3 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the OssFileController queryById handler that allows low-privileged... | 2026-10-13 |
| CVE-2026-108649 | medium | 4.3 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryUserRolesById handler of SystemApiController that lets au... | 2026-10-13 |
| CVE-2026-108644 | medium | 5.4 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysCategoryController delete handler that allows any authentic... | 2026-10-13 |
| CVE-2026-108639 | medium | 5.4 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to permanently delete data diction... | 2026-10-13 |
| CVE-2026-108634 | medium | 5.4 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete department p... | 2026-10-13 |
| CVE-2026-108631 | medium | 5.4 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartPermissionController delete handler that allows low-p... | 2026-10-13 |
| CVE-2026-108629 | medium | 4.3 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDatarule handler of SysDepartPermissionController that all... | 2026-10-13 |
| CVE-2026-108624 | medium | 5.4 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController deleteBatch handler that allows low-privi... | 2026-10-13 |
| CVE-2026-108619 | medium | 5.4 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete message temp... | 2026-10-13 |
| CVE-2026-108614 | medium | 4.3 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController exportXls handler that allows any authe... | 2026-10-13 |
| CVE-2026-108886 | medium | 4.3 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController queryChildrenByUsername handler that allows... | 2026-10-13 |
| CVE-2026-108881 | medium | 4.3 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getTenantPackInfo handler that allows any authenticated user t... | 2026-10-13 |
| CVE-2026-108876 | medium | 4.3 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the putCancelQuit handler of SysUserController, allowing any authe... | 2026-10-13 |
| CVE-2026-108871 | medium | 5.4 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDatarule handler of SysDepartRoleController that lets low-... | 2026-10-13 |
| CVE-2026-108866 | medium | 4.3 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows authenticated users to read any account's permissions via... | 2026-10-13 |
| CVE-2026-108609 | medium | 4.3 | No | JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' AI v... | 2026-10-13 |
| CVE-2026-109397 | high | 7.2 | No | Thelia before 3.1.2 and 3.2.x before 3.2.1 contains an unrestricted file upload vulnerability that allows authenticated back-office users to... | 2026-10-13 |
| CVE-2026-109396 | medium | 4.2 | No | Thelia before 3.1.2 and 3.2.x before 3.2.1 contains a CSV formula injection vulnerability that allows unauthenticated visitors to inject spr... | 2026-10-13 |
| CVE-2026-109206 | medium | 5.3 | No | LogicalDOC Community Edition through 9.3 contains a username enumeration vulnerability that allows unauthenticated attackers to identify val... | 2026-10-13 |
| CVE-2026-109203 | medium | 6.5 | No | LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the ConvertPdf servlet that allows authenticated... | 2026-10-13 |