Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-108756 | medium | 5.4 | No | Abilityai Trinity through 0.9.5 contains a missing authorization vulnerability in the Telegram router that allows agent-scoped MCP API keys... | 2026-10-16 |
| CVE-2026-108753 | critical | 9.4 | No | Agnaistic agnai through 1.0.555 contains a hard-coded credentials vulnerability in self-host.docker-compose.yml, which sets a fixed admin pa... | 2026-10-16 |
| CVE-2026-108751 | medium | 4.4 | No | MoAI-ADK through 3.1.2 contains an improper link resolution vulnerability in the moai init template deployer that allows malicious repositor... | 2026-10-16 |
| CVE-2026-108750 | medium | 4.3 | No | OpenDocMan 2.4.0 through 2.10.0 contains a decompression bomb vulnerability that allows authenticated users to exhaust PHP memory by uploadi... | 2026-10-16 |
| CVE-2026-108746 | high | 8.8 | No | Vearch 3.5.2 through 3.5.9 contains an incorrect authorization vulnerability in Role.HasPermissionForResources that ignores stored ReadOnly... | 2026-10-16 |
| CVE-2026-108745 | low | 3.1 | No | CloudBeaver through 25.3.5 contains a missing authorization vulnerability in WebSQLResultServlet that allows any web session holder to read... | 2026-10-16 |
| CVE-2026-108742 | medium | 4.3 | No | CloudBeaver through 25.3.5 contains a missing authorization vulnerability in the initConnection GraphQL mutation that lets view-only shared-... | 2026-10-16 |
| CVE-2026-108741 | low | 3.1 | No | Shepherd (shepherd-ai) through 0.3.1 contains a server-side request forgery guard bypass in the citation-checker extra because the public_ur... | 2026-10-16 |
| CVE-2026-108740 | high | 8.3 | No | GoatCounter through 2.7.0 contains a mass assignment privilege escalation vulnerability in the userPrefSave handler that allows logged-in us... | 2026-10-16 |
| CVE-2026-108739 | high | 7.5 | No | OpenAgents Workspace backend through launcher-v1.0.17 contains an information disclosure vulnerability that allows unauthenticated attackers... | 2026-10-16 |
| CVE-2026-108736 | low | 3.7 | No | Speedtest Tracker through 1.15.0 contains an IP allowlist bypass vulnerability that allows unauthenticated remote attackers to evade ALLOWED... | 2026-10-16 |
| CVE-2026-108735 | medium | 4.3 | No | Miniflux 2.3.0 through 2.3.3 contains a server-side request forgery vulnerability that allows authenticated users to reach internal addresse... | 2026-10-16 |
| CVE-2026-108734 | medium | 4.3 | No | Frappe CRM 1.49.0 through 1.87.0 contains a missing authorization vulnerability in crm.api.doc.get_linked_docs_of_document that allows authe... | 2026-10-16 |
| CVE-2026-108732 | medium | 4.3 | No | Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the... | 2026-10-16 |
| CVE-2026-108731 | medium | 5.4 | No | Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability that allows authenticated users to join invite-only Public workspac... | 2026-10-16 |
| CVE-2026-108730 | medium | 4.3 | No | Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability in legacy methods in raven/api/raven_message.py that skip the works... | 2026-10-16 |
| CVE-2026-108729 | medium | 5.9 | No | Corteza through 2024.9.10 contains an incorrect authorization vulnerability in compose attachment endpoints that allows unauthenticated atta... | 2026-10-16 |
| CVE-2026-108727 | medium | 4.3 | No | EdgeEver through 1.108.0 contains a missing authorization vulnerability in the Hono API memo-template routes that allows holders of scoped A... | 2026-10-16 |
| CVE-2026-108725 | medium | 5.4 | No | Cheshire Cat AI core through 2.0.23 contains a stored cross-site scripting vulnerability in the uploads plugin that allows authenticated use... | 2026-10-16 |
| CVE-2026-108724 | medium | 5.3 | No | Sylius through 2.3.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unmoderated and rejected p... | 2026-10-16 |