Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-108672 | medium | 4.3 | No | JeecgBoot through 3.9.5 contains an authorization bypass vulnerability in the getVideoRecords handler of VideoGenerationController that allo... | 2026-10-18 |
| CVE-2026-108667 | medium | 4.3 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to restore deleted AI... | 2026-10-18 |
| CVE-2026-108662 | medium | 5.4 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove users from t... | 2026-10-18 |
| CVE-2026-108657 | high | 8.1 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController passApply handler that allows any authenti... | 2026-10-18 |
| CVE-2026-108652 | medium | 4.3 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SystemApiController updateAvatar handler that allows any authe... | 2026-10-18 |
| CVE-2026-108647 | medium | 4.3 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create validation r... | 2026-10-18 |
| CVE-2026-108642 | medium | 4.3 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysAnnouncementSendController that allows authenticated users to m... | 2026-10-18 |
| CVE-2026-108637 | medium | 4.3 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove user group m... | 2026-10-18 |
| CVE-2026-108632 | medium | 4.3 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartPermissionController queryById handler that allows an... | 2026-10-18 |
| CVE-2026-108627 | medium | 4.3 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the loadDatarule handler of SysRoleController that lets any authen... | 2026-10-18 |
| CVE-2026-108622 | medium | 5.4 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysLogController delete handler that allows any authenticated... | 2026-10-18 |
| CVE-2026-108617 | medium | 4.3 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create message temp... | 2026-10-18 |
| CVE-2026-108612 | medium | 5.4 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateController deleteBatch handler that allows low... | 2026-10-18 |
| CVE-2026-108607 | medium | 4.3 | No | JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' AI... | 2026-10-18 |
| CVE-2026-108602 | medium | 4.3 | No | Helicone through v2025.08.21-1 contains a server-side request forgery vulnerability in the Jawn webhook sender that allows authenticated org... | 2026-10-18 |
| CVE-2026-108596 | medium | 5.3 | No | OpenLIT 2.1.0 contains an authorization bypass vulnerability that allows authenticated users to read other projects' telemetry by supplying... | 2026-10-18 |
| CVE-2026-108591 | medium | 4.4 | No | InnoShop 0.9.2 contains a local file disclosure vulnerability that allows authenticated administrators with files_create permission to read... | 2026-10-18 |
| CVE-2026-108581 | medium | 6.5 | No | TencentCloud Octop through 1.0.2b6 contains a missing authorization vulnerability that allows authenticated low-privileged users to read sto... | 2026-10-18 |
| CVE-2026-108553 | high | 7.5 | No | OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execut... | 2026-10-18 |
| CVE-2026-108547 | medium | 6.5 | No | AstronRPA through 1.1.6 contains a missing tenant authorization check in robot-service that allows authenticated users to read other tenants... | 2026-10-18 |