Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-108862 | medium | 5.3 | No | APIPark through 1.9.7-beta contains an insecure direct object reference vulnerability that allows authenticated users to read other applicat... | 2026-10-16 |
| CVE-2026-108861 | medium | 4.3 | No | Odoo MCP 1.0.0 through 1.3.2 contains an information disclosure vulnerability that allows MCP clients to bypass the field-level ACL by invok... | 2026-10-16 |
| CVE-2026-108860 | critical | 9.1 | No | BotSharp through 5.2.0 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge bearer tokens u... | 2026-10-16 |
| CVE-2026-108858 | medium | 5.5 | No | Predibase LoRAX through 0.12.1 contains a sensitive information exposure vulnerability that writes the caller-supplied api_token from POST /... | 2026-10-16 |
| CVE-2026-108856 | medium | 4.2 | No | UnicomAI Wanwu through 0.6.5 contains an authorization bypass vulnerability that allows authenticated users to mint AppKeys bound to other u... | 2026-10-16 |
| CVE-2026-108855 | medium | 5.4 | No | UnicomAI Wanwu through 0.6.5 contains a missing authorization vulnerability that allows any authenticated enabled user to revoke other users... | 2026-10-16 |
| CVE-2026-108853 | high | 8.1 | No | UnicomAI Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to del... | 2026-10-16 |
| CVE-2026-108852 | medium | 4.7 | No | Deep Chat through 2.5.1 contains a cross-site scripting vulnerability that allows attackers to inject javascript: links because RemarkableCo... | 2026-10-16 |
| CVE-2026-108850 | medium | 5.3 | No | Company Research Agent through 2.2.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger o... | 2026-10-16 |
| CVE-2026-108698 | medium | 6.5 | No | hyper-mcp through 0.8.3 contains a signature verification bypass vulnerability in load_wasm in src/wasm/oci.rs that verifies the Cosign sign... | 2026-10-16 |
| CVE-2026-108697 | medium | 4.3 | No | CoreShop through 2026.2.2 contains a missing authorization vulnerability that allows low-privileged backend users to list permission-restric... | 2026-10-16 |
| CVE-2026-108760 | high | 7.6 | No | LlamaFarm through 0.0.34 contains an insecure default configuration that binds its unauthenticated FastAPI server to 0.0.0.0 on port 14345,... | 2026-10-16 |
| CVE-2026-108757 | medium | 6.5 | No | Nexting pinclaw OpenClaw channel plugin through 0.3.0 contains a missing authentication vulnerability in src/core/http-router.ts that skips... | 2026-10-16 |
| CVE-2026-108756 | medium | 5.4 | No | Abilityai Trinity through 0.9.5 contains a missing authorization vulnerability in the Telegram router that allows agent-scoped MCP API keys... | 2026-10-16 |
| CVE-2026-108753 | critical | 9.4 | No | Agnaistic agnai through 1.0.555 contains a hard-coded credentials vulnerability in self-host.docker-compose.yml, which sets a fixed admin pa... | 2026-10-16 |
| CVE-2026-108751 | medium | 4.4 | No | MoAI-ADK through 3.1.2 contains an improper link resolution vulnerability in the moai init template deployer that allows malicious repositor... | 2026-10-16 |
| CVE-2026-108750 | medium | 4.3 | No | OpenDocMan 2.4.0 through 2.10.0 contains a decompression bomb vulnerability that allows authenticated users to exhaust PHP memory by uploadi... | 2026-10-16 |
| CVE-2026-108746 | high | 8.8 | No | Vearch 3.5.2 through 3.5.9 contains an incorrect authorization vulnerability in Role.HasPermissionForResources that ignores stored ReadOnly... | 2026-10-16 |
| CVE-2026-108745 | low | 3.1 | No | CloudBeaver through 25.3.5 contains a missing authorization vulnerability in WebSQLResultServlet that allows any web session holder to read... | 2026-10-16 |
| CVE-2026-108742 | medium | 4.3 | No | CloudBeaver through 25.3.5 contains a missing authorization vulnerability in the initConnection GraphQL mutation that lets view-only shared-... | 2026-10-16 |