Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-108711 | medium | 4.3 | No | Plastic Labs Honcho through 3.3.0 contains an incorrect authorization vulnerability that allows peer- or session-scoped API key holders to r... | 2026-10-16 |
| CVE-2026-108710 | medium | 6.5 | No | NornicDB through 1.4.1 contains a missing authorization vulnerability that allows authenticated users to bypass per-database read restrictio... | 2026-10-16 |
| CVE-2026-108708 | high | 8.8 | No | Wukong_HRM through commit 186115e contains a missing authorization vulnerability because EmployeeAspect assigns every caller the HR administ... | 2026-10-16 |
| CVE-2026-108706 | medium | 4.3 | No | eladmin through commit 55fbf70 contains a missing authorization vulnerability in the downloadS3Storage handler that allows any authenticated... | 2026-10-16 |
| CVE-2026-108696 | medium | 4.3 | No | CoreShop through 1.5.5 contains an authorization bypass vulnerability in the OrderController that allows authenticated customers to act on o... | 2026-10-16 |
| CVE-2026-108695 | high | 7.1 | No | MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accounts to modify marketp... | 2026-10-16 |
| CVE-2026-108691 | medium | 5.4 | No | mall4j through 4.0 contains an improper authorization vulnerability that allows authenticated storefront customers to delete other shoppers'... | 2026-10-16 |
| CVE-2026-108690 | medium | 4.3 | No | mall4j through 4.0 contains an information disclosure vulnerability that allows authenticated customers to read other shoppers' cart items d... | 2026-10-16 |
| CVE-2026-108604 | medium | 6.3 | No | Tabularis through 0.27.0 contains an incorrect authorization vulnerability in the MCP run_query safety gate that allows prompt-injected agen... | 2026-10-16 |
| CVE-2026-108603 | low | 3.3 | No | slide-maker through 5.8.0 contains a path traversal vulnerability in generate_images_openai.py that allows attackers to write image files ou... | 2026-10-16 |
| CVE-2026-108599 | medium | 4.7 | No | phi 0.1.1 through 0.28.4 contains an improper link resolution vulnerability that allows malicious repositories to bypass workspace_only_writ... | 2026-10-16 |
| CVE-2026-108598 | critical | 9.8 | No | Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute comma... | 2026-10-16 |
| CVE-2026-108592 | medium | 5.3 | No | mini-swe-agent 1.10.0 through 2.4.6 contains an information exposure vulnerability in BubblewrapEnvironment because bwrap omits --clearenv,... | 2026-10-16 |
| CVE-2026-108583 | medium | 4.2 | No | zotero-mcp 0.10.0 through 0.14.1 contains a server-side request forgery vulnerability that allows attackers to reach internal services becau... | 2026-10-16 |
| CVE-2026-108582 | medium | 5.5 | No | GenOffice through 0.11.505 contains an incorrect permissions vulnerability in its HTTP MCP server file store that allows local unprivileged... | 2026-10-16 |
| CVE-2026-108555 | medium | 4.2 | No | PairDrop through 1.11.2 contains an IP spoofing vulnerability in Peer._setIP that allows remote attackers to join other networks' discovery... | 2026-10-16 |
| CVE-2026-108554 | medium | 5.3 | No | PDFMathTranslate (pdf2zh) through 1.9.11 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make... | 2026-10-16 |
| CVE-2026-108550 | high | 8.8 | No | SkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and AccountMergeController that allows authe... | 2026-10-16 |
| CVE-2026-108548 | high | 7.3 | No | AstronRPA through 1.1.6 contains an authentication bypass vulnerability in the OpenResty gateway's auth_handler.lua that accepts any Bearer... | 2026-10-16 |
| CVE-2026-108115 | medium | 4.9 | No | Kortix Suna 0.10.7 before 0.13.52 contains a server-side request forgery vulnerability that allows project managers to bypass the isPrivateI... | 2026-10-16 |