Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-108741 | low | 3.1 | No | Shepherd (shepherd-ai) through 0.3.1 contains a server-side request forgery guard bypass in the citation-checker extra because the public_ur... | 2026-10-16 |
| CVE-2026-108740 | high | 8.3 | No | GoatCounter through 2.7.0 contains a mass assignment privilege escalation vulnerability in the userPrefSave handler that allows logged-in us... | 2026-10-16 |
| CVE-2026-108739 | high | 7.5 | No | OpenAgents Workspace backend through launcher-v1.0.17 contains an information disclosure vulnerability that allows unauthenticated attackers... | 2026-10-16 |
| CVE-2026-108736 | low | 3.7 | No | Speedtest Tracker through 1.15.0 contains an IP allowlist bypass vulnerability that allows unauthenticated remote attackers to evade ALLOWED... | 2026-10-16 |
| CVE-2026-108735 | medium | 4.3 | No | Miniflux 2.3.0 through 2.3.3 contains a server-side request forgery vulnerability that allows authenticated users to reach internal addresse... | 2026-10-16 |
| CVE-2026-108734 | medium | 4.3 | No | Frappe CRM 1.49.0 through 1.87.0 contains a missing authorization vulnerability in crm.api.doc.get_linked_docs_of_document that allows authe... | 2026-10-16 |
| CVE-2026-108732 | medium | 4.3 | No | Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the... | 2026-10-16 |
| CVE-2026-108731 | medium | 5.4 | No | Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability that allows authenticated users to join invite-only Public workspac... | 2026-10-16 |
| CVE-2026-108730 | medium | 4.3 | No | Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability in legacy methods in raven/api/raven_message.py that skip the works... | 2026-10-16 |
| CVE-2026-108729 | medium | 5.9 | No | Corteza through 2024.9.10 contains an incorrect authorization vulnerability in compose attachment endpoints that allows unauthenticated atta... | 2026-10-16 |
| CVE-2026-108727 | medium | 4.3 | No | EdgeEver through 1.108.0 contains a missing authorization vulnerability in the Hono API memo-template routes that allows holders of scoped A... | 2026-10-16 |
| CVE-2026-108725 | medium | 5.4 | No | Cheshire Cat AI core through 2.0.23 contains a stored cross-site scripting vulnerability in the uploads plugin that allows authenticated use... | 2026-10-16 |
| CVE-2026-108724 | medium | 5.3 | No | Sylius through 2.3.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unmoderated and rejected p... | 2026-10-16 |
| CVE-2026-108722 | medium | 4.2 | No | open-computer-use through commit 610bac8 contains a stored cross-site scripting vulnerability in Logger.write_log_file in os_computer_use/lo... | 2026-10-16 |
| CVE-2026-108721 | medium | 5.3 | No | Open Computer Use through 1.0.0 on macOS contains an improper case sensitivity handling vulnerability that allows local MCP callers to bypas... | 2026-10-16 |
| CVE-2026-108719 | medium | 5.0 | No | LLMGateway through 1.20.0 contains a blind server-side request forgery vulnerability that allows API key holders to reach internal hosts via... | 2026-10-16 |
| CVE-2026-108717 | medium | 6.3 | No | Combodo iTop 3.1.0 through 3.3.0 contains a missing authorization vulnerability in LinkSetController.php that allows authenticated console u... | 2026-10-16 |
| CVE-2026-108716 | medium | 5.3 | No | mcp-remote 0.8.0 through 0.14.3 contains a cleartext transmission vulnerability in authorizeWithDeviceCode that sends client secrets and rec... | 2026-10-16 |
| CVE-2026-108714 | high | 7.5 | No | MCP Kotlin SDK through 0.15.0 contains an uncontrolled memory allocation vulnerability that allows remote clients to exhaust server memory b... | 2026-10-16 |
| CVE-2026-108712 | medium | 4.3 | No | SuiteCRM through 7.15.2 and 8.10.2 contains a missing authorization vulnerability in the DetailUserRole entry point that allows authenticate... | 2026-10-16 |