Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-109199 | high | 8.8 | No | LogicalDOC Community Edition through 9.3 contains a code injection vulnerability that allows authenticated users to execute OS commands by s... | 2026-10-18 |
| CVE-2026-108869 | medium | 4.3 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to send system announc... | 2026-10-18 |
| CVE-2026-108864 | medium | 4.2 | No | iFlytek Astron Agent through 1.1.2 contains an insecure direct object reference vulnerability that allows authenticated applications to resu... | 2026-10-18 |
| CVE-2026-108859 | high | 7.5 | No | mcp-go through 1.2.1 contains a denial of service vulnerability in StreamableHTTPServer.ServeHTTP that allows remote unauthenticated attacke... | 2026-10-18 |
| CVE-2026-108854 | medium | 5.4 | No | Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows any authenticated enabled user to delete other use... | 2026-10-18 |
| CVE-2026-108839 | medium | 4.2 | No | thClaws through 0.141.0 contains a link-following vulnerability in the post_inputs handler of the v1 API POST /v1/inputs endpoint that allow... | 2026-10-18 |
| CVE-2026-108759 | medium | 6.8 | No | mistral.rs 0.9.0 through 0.9.4 contains a link following vulnerability in mistralrs-code-exec that allows sandboxed shell code to read and o... | 2026-10-18 |
| CVE-2026-108754 | low | 3.3 | No | GPT-Load through 1.4.11 contains a cleartext logging vulnerability that exposes client proxy keys because the Gin Logger middleware records... | 2026-10-18 |
| CVE-2026-108744 | high | 7.0 | No | pbi-cli 3.10.1 through 3.12.0 contains an OS command injection vulnerability in desktop_sync.py that passes unquoted .pbip paths to cmd /c s... | 2026-10-18 |
| CVE-2026-108738 | medium | 4.2 | No | Traccar 5.7 through 6.16.0 contains a cross-site request forgery vulnerability that allows attackers to log victims into attacker-controlled... | 2026-10-18 |
| CVE-2026-108733 | medium | 4.3 | No | Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the... | 2026-10-18 |
| CVE-2026-108728 | medium | 6.5 | No | Flyte 2.0.1 through 2.0.51 contains a cleartext secret storage vulnerability that allows users with Pod read access to obtain secrets by rea... | 2026-10-18 |
| CVE-2026-108723 | low | 2.5 | No | answer-me-with-html through 0.5.0 contains a link following vulnerability in the am CLI code block src= embedding, where localPath() checks... | 2026-10-18 |
| CVE-2026-108718 | high | 8.1 | No | Rill 0.77.0 through 0.90.5 contains a missing authorization vulnerability in the admin OAuth server that issues authorization codes to dynam... | 2026-10-18 |
| CVE-2026-108713 | medium | 4.3 | No | SuiteCRM through 7.15.2 and 8.x through 8.10.2 contains a missing authorization vulnerability that allows authenticated users to create and... | 2026-10-18 |
| CVE-2026-108707 | critical | 9.8 | No | Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to ca... | 2026-10-18 |
| CVE-2026-108702 | medium | 4.3 | No | 1Panel-dev CordysCRM through 1.9.3 lacks a PROCESS_SETTING permission check on POST /approval-flow/webhook/test, allowing any authenticated... | 2026-10-18 |
| CVE-2026-108694 | medium | 6.5 | No | ConvertX through 0.19.0 contains an arbitrary file read vulnerability that allows authenticated users to read server files because src/conve... | 2026-10-18 |
| CVE-2026-108689 | medium | 5.4 | No | Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows authenticated users to write into other users' AI c... | 2026-10-18 |
| CVE-2026-108677 | medium | 6.5 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in GET /sys/api/getUserByName that allows low-privileged authenticate... | 2026-10-18 |