Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-109167 | medium | 4.3 | No | TDuck survey form through 6.0 contains an insecure direct object reference vulnerability in the saveFormTheme handler that allows authentica... | 2026-10-16 |
| CVE-2026-109165 | medium | 4.3 | No | TDuck survey form through 6.0 contains a broken access control vulnerability that allows authenticated users to add fields to other users' f... | 2026-10-16 |
| CVE-2026-108953 | high | 7.8 | No | mac-shell-mcp before 2.0.0 contains an OS command injection vulnerability that allows MCP clients to bypass the command whitelist by injecti... | 2026-10-16 |
| CVE-2026-108952 | medium | 4.6 | No | RT-Thread through 5.3.0 contains a memory corruption vulnerability in the legacy USB CDC virtual COM port driver that aliases rx_ringbuffer... | 2026-10-16 |
| CVE-2026-108951 | medium | 6.5 | No | LavaLite CMS through 10.1.2 contains an authorization bypass vulnerability that allows authenticated low-privileged users to modify other us... | 2026-10-16 |
| CVE-2026-108865 | high | 8.2 | No | AmoyLab Unla through 0.10.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid access tok... | 2026-10-16 |
| CVE-2026-108863 | high | 7.5 | No | Katanemo Plano through 0.4.37 contains a missing authentication vulnerability that allows unauthenticated network attackers to access the En... | 2026-10-16 |
| CVE-2026-108862 | medium | 5.3 | No | APIPark through 1.9.7-beta contains an insecure direct object reference vulnerability that allows authenticated users to read other applicat... | 2026-10-16 |
| CVE-2026-108861 | medium | 4.3 | No | Odoo MCP 1.0.0 through 1.3.2 contains an information disclosure vulnerability that allows MCP clients to bypass the field-level ACL by invok... | 2026-10-16 |
| CVE-2026-108860 | critical | 9.1 | No | BotSharp through 5.2.0 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge bearer tokens u... | 2026-10-16 |
| CVE-2026-108858 | medium | 5.5 | No | Predibase LoRAX through 0.12.1 contains a sensitive information exposure vulnerability that writes the caller-supplied api_token from POST /... | 2026-10-16 |
| CVE-2026-108856 | medium | 4.2 | No | UnicomAI Wanwu through 0.6.5 contains an authorization bypass vulnerability that allows authenticated users to mint AppKeys bound to other u... | 2026-10-16 |
| CVE-2026-108855 | medium | 5.4 | No | UnicomAI Wanwu through 0.6.5 contains a missing authorization vulnerability that allows any authenticated enabled user to revoke other users... | 2026-10-16 |
| CVE-2026-108853 | high | 8.1 | No | UnicomAI Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to del... | 2026-10-16 |
| CVE-2026-108852 | medium | 4.7 | No | Deep Chat through 2.5.1 contains a cross-site scripting vulnerability that allows attackers to inject javascript: links because RemarkableCo... | 2026-10-16 |
| CVE-2026-108850 | medium | 5.3 | No | Company Research Agent through 2.2.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger o... | 2026-10-16 |
| CVE-2026-108698 | medium | 6.5 | No | hyper-mcp through 0.8.3 contains a signature verification bypass vulnerability in load_wasm in src/wasm/oci.rs that verifies the Cosign sign... | 2026-10-16 |
| CVE-2026-108697 | medium | 4.3 | No | CoreShop through 2026.2.2 contains a missing authorization vulnerability that allows low-privileged backend users to list permission-restric... | 2026-10-16 |
| CVE-2026-108760 | high | 7.6 | No | LlamaFarm through 0.0.34 contains an insecure default configuration that binds its unauthenticated FastAPI server to 0.0.0.0 on port 14345,... | 2026-10-16 |
| CVE-2026-108757 | medium | 6.5 | No | Nexting pinclaw OpenClaw channel plugin through 0.3.0 contains a missing authentication vulnerability in src/core/http-router.ts that skips... | 2026-10-16 |