Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-108722 | medium | 4.2 | No | open-computer-use through commit 610bac8 contains a stored cross-site scripting vulnerability in Logger.write_log_file in os_computer_use/lo... | 2026-10-16 |
| CVE-2026-108721 | medium | 5.3 | No | Open Computer Use through 1.0.0 on macOS contains an improper case sensitivity handling vulnerability that allows local MCP callers to bypas... | 2026-10-16 |
| CVE-2026-108719 | medium | 5.0 | No | LLMGateway through 1.20.0 contains a blind server-side request forgery vulnerability that allows API key holders to reach internal hosts via... | 2026-10-16 |
| CVE-2026-108717 | medium | 6.3 | No | Combodo iTop 3.1.0 through 3.3.0 contains a missing authorization vulnerability in LinkSetController.php that allows authenticated console u... | 2026-10-16 |
| CVE-2026-108716 | medium | 5.3 | No | mcp-remote 0.8.0 through 0.14.3 contains a cleartext transmission vulnerability in authorizeWithDeviceCode that sends client secrets and rec... | 2026-10-16 |
| CVE-2026-108714 | high | 7.5 | No | MCP Kotlin SDK through 0.15.0 contains an uncontrolled memory allocation vulnerability that allows remote clients to exhaust server memory b... | 2026-10-16 |
| CVE-2026-108712 | medium | 4.3 | No | SuiteCRM through 7.15.2 and 8.10.2 contains a missing authorization vulnerability in the DetailUserRole entry point that allows authenticate... | 2026-10-16 |
| CVE-2026-108711 | medium | 4.3 | No | Plastic Labs Honcho through 3.3.0 contains an incorrect authorization vulnerability that allows peer- or session-scoped API key holders to r... | 2026-10-16 |
| CVE-2026-108710 | medium | 6.5 | No | NornicDB through 1.4.1 contains a missing authorization vulnerability that allows authenticated users to bypass per-database read restrictio... | 2026-10-16 |
| CVE-2026-108708 | high | 8.8 | No | Wukong_HRM through commit 186115e contains a missing authorization vulnerability because EmployeeAspect assigns every caller the HR administ... | 2026-10-16 |
| CVE-2026-108706 | medium | 4.3 | No | eladmin through commit 55fbf70 contains a missing authorization vulnerability in the downloadS3Storage handler that allows any authenticated... | 2026-10-16 |
| CVE-2026-108696 | medium | 4.3 | No | CoreShop through 1.5.5 contains an authorization bypass vulnerability in the OrderController that allows authenticated customers to act on o... | 2026-10-16 |
| CVE-2026-108695 | high | 7.1 | No | MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accounts to modify marketp... | 2026-10-16 |
| CVE-2026-108691 | medium | 5.4 | No | mall4j through 4.0 contains an improper authorization vulnerability that allows authenticated storefront customers to delete other shoppers'... | 2026-10-16 |
| CVE-2026-108690 | medium | 4.3 | No | mall4j through 4.0 contains an information disclosure vulnerability that allows authenticated customers to read other shoppers' cart items d... | 2026-10-16 |
| CVE-2026-108604 | medium | 6.3 | No | Tabularis through 0.27.0 contains an incorrect authorization vulnerability in the MCP run_query safety gate that allows prompt-injected agen... | 2026-10-16 |
| CVE-2026-108603 | low | 3.3 | No | slide-maker through 5.8.0 contains a path traversal vulnerability in generate_images_openai.py that allows attackers to write image files ou... | 2026-10-16 |
| CVE-2026-108599 | medium | 4.7 | No | phi 0.1.1 through 0.28.4 contains an improper link resolution vulnerability that allows malicious repositories to bypass workspace_only_writ... | 2026-10-16 |
| CVE-2026-108598 | critical | 9.8 | No | Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute comma... | 2026-10-16 |
| CVE-2026-108592 | medium | 5.3 | No | mini-swe-agent 1.10.0 through 2.4.6 contains an information exposure vulnerability in BubblewrapEnvironment because bwrap omits --clearenv,... | 2026-10-16 |