Lucene search
+L
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
Assessment
Vulnerability Intelligence
Exploits
Alerts
Datasets
MCP
White Label
Security Automation SDK
MCP for AI Agents
Plans & Pricing
API Reference
Settings
Sign in
🔥 Daily Hot!
💪🏽 CPE Enhanced Advisories
🕶 Shadow Exploits
🕵🏼 Vulners CPE
🔐 Security news
💻 Exploit updates
📑 Blogs review
🐧 Linux vulnerabilities
🐞 Bugbounty
🤖 AI High Score
📰 CVE Feed
show all

117905 matches found

CVE
CVE•added 2026/10/10 9:49 p.m.•14 views

CVE-2026-108606

Versions of JeecgBoot through 3.9.5 are vulnerable to a missing authorization flaw in the AiOcrController deleteById handler. This allows any authenticated user to delete OCR records. An attacker with low privileges can first retrieve record IDs from the unguarded GET /airag/ocr/list endpoint and...

5.4CVSS5.8AI score0.00269EPSS
SaveExploits0References3
Mend
Mend•added 2026/10/10 9:49 p.m.•9 views

CVE-2026-108606

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiOcrController deleteById handler that allows any authenticated user to delete OCR records. Low-privileged attackers can obtain record ids from the unguarded GET /airag/ocr/list endpoint and repeatedly delete every...

5.4CVSS5.8AI score0.00269EPSS
SaveExploits0References4
Cvelist
Cvelist•added 2026/10/10 9:49 p.m.•44 views

CVE-2026-108606 JeecgBoot through 3.9.5 Missing Authorization via /airag/ocr/deleteById

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiOcrController deleteById handler that allows any authenticated user to delete OCR records. Low-privileged attackers can obtain record ids from the unguarded GET /airag/ocr/list endpoint and repeatedly delete every...

5.4CVSS0.00269EPSS
SaveExploits0References3
CVE
CVE•added 2026/10/10 9:49 p.m.•18 views

CVE-2026-108605

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization vulnerability in the AiOcrController updateById handler. This flaw allows any authenticated user to send PUT requests to the /airag/ocr/edit endpoint. An attacker can exploit this to overwrite LLM prompts in the shared air...

5.3CVSS5.7AI score0.00238EPSS
SaveExploits0References3
osv_cve
osv_cve•added 2026/10/10 9:49 p.m.•17 views

CVE-2026-108605 JeecgBoot through 3.9.5 Missing Authorization via /airag/ocr/edit Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiOcrController updateById handler that allows any authenticated user to modify global OCR templates. Low-privileged attackers can send PUT requests to /airag/ocr/edit to overwrite LLM prompts in the shared airag:ocr...

5.3CVSS5.8AI score
SaveExploits0References6
Vulnrichment
Vulnrichment•added 2026/10/10 9:49 p.m.•8 views

CVE-2026-108605 JeecgBoot through 3.9.5 Missing Authorization via /airag/ocr/edit Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiOcrController updateById handler that allows any authenticated user to modify global OCR templates. Low-privileged attackers can send PUT requests to /airag/ocr/edit to overwrite LLM prompts in the shared airag:ocr...

5.3CVSS5.7AI score0.00238EPSS
SaveExploits0References3
Cvelist
Cvelist•added 2026/10/10 9:49 p.m.•48 views

CVE-2026-108605 JeecgBoot through 3.9.5 Missing Authorization via /airag/ocr/edit Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiOcrController updateById handler that allows any authenticated user to modify global OCR templates. Low-privileged attackers can send PUT requests to /airag/ocr/edit to overwrite LLM prompts in the shared airag:ocr...

5.3CVSS0.00238EPSS
SaveExploits0References3
NVD
NVD•added 2026/10/10 8:16 p.m.•15 views

CVE-2026-103685

Missing Authorization vulnerability in VillaTheme ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce woo-alidropship allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce: from n/...

4.3CVSS0.00185EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment•added 2026/10/10 7:55 p.m.•9 views

CVE-2026-103685 WordPress ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce plugin <= 2.2.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in VillaTheme ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce woo-alidropship allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce: from n/...

4.3CVSS5.9AI score0.00185EPSS
SaveExploits0References1
EUVD
EUVD•added 2026/10/10 7:55 p.m.•13 views

EUVD-2026-96431

Missing Authorization vulnerability in VillaTheme ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce woo-alidropship allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce: from n/...

4.3CVSS5.9AI score0.00185EPSS
SaveExploits0References1
NVD
NVD•added 2026/10/10 5:16 p.m.•23 views

CVE-2026-103357

Missing Authorization vulnerability in VillaTheme GIFT4U gift4u-gift-cards-all-in-one-for-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GIFT4U: from n/a through 1.1.3...

6.9CVSS0.00262EPSS
SaveExploits0References1
EUVD
EUVD•added 2026/10/10 5:00 p.m.•17 views

EUVD-2026-96378

Missing Authorization vulnerability in VillaTheme GIFT4U gift4u-gift-cards-all-in-one-for-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GIFT4U: from n/a through 1.1.3...

6.9CVSS5.9AI score0.00262EPSS
SaveExploits0References1
EUVD
EUVD•added 2026/10/10 5:00 p.m.•12 views

EUVD-2026-96376

Missing Authorization vulnerability in Web Impian Bayarcash WooCommerce bayarcash-wc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bayarcash WooCommerce: from n/a through 4.4.2...

7.5CVSS5.9AI score0.00219EPSS
SaveExploits0References1
NVD
NVD•added 2026/10/10 4:16 p.m.•52 views

CVE-2026-108581

TencentCloud Octop through 1.0.2b6 contains a missing authorization vulnerability that allows authenticated low-privileged users to read stored provider API keys via GET /api/providers and GET /api/voice/providers. Attackers can query these endpoints, which only validate the JWT, to obtain...

7.1CVSS0.00238EPSS
SaveExploits0References5
CVE
CVE•added 2026/10/10 3:57 p.m.•68 views

CVE-2026-108581

TencentCloud Octop versions through 1.0.2b6 are vulnerable to a missing authorization flaw (CWE-862). Authenticated users with low privileges can access the GET /api/providers and GET /api/voice/providers endpoints, which only validate the JWT without sufficient permission checks. This allows att...

7.1CVSS5.9AI score0.00238EPSS
SaveExploits0References5
EUVD
EUVD•added 2026/10/10 3:57 p.m.•47 views

EUVD-2026-96364

TencentCloud Octop through 1.0.2b6 contains a missing authorization vulnerability that allows authenticated low-privileged users to read stored provider API keys via GET /api/providers and GET /api/voice/providers. Attackers can query these endpoints, which only validate the JWT, to obtain...

7.1CVSS5.9AI score0.00238EPSS
SaveExploits0References5
Mend
Mend•added 2026/10/10 3:57 p.m.•17 views

CVE-2026-108581

TencentCloud Octop through 1.0.2b6 contains a missing authorization vulnerability that allows authenticated low-privileged users to read stored provider API keys via GET /api/providers and GET /api/voice/providers. Attackers can query these endpoints, which only validate the JWT, to obtain...

7.1CVSS5.9AI score0.00238EPSS
SaveExploits0References8
Vulnrichment
Vulnrichment•added 2026/10/10 3:57 p.m.•18 views

CVE-2026-108581 Octop through 1.0.2b6 Missing Authorization Exposes Provider API Keys via /api/providers

TencentCloud Octop through 1.0.2b6 contains a missing authorization vulnerability that allows authenticated low-privileged users to read stored provider API keys via GET /api/providers and GET /api/voice/providers. Attackers can query these endpoints, which only validate the JWT, to obtain...

7.1CVSS5.9AI score0.00238EPSS
SaveExploits0References5
Cvelist
Cvelist•added 2026/10/10 3:57 p.m.•65 views

CVE-2026-108581 Octop through 1.0.2b6 Missing Authorization Exposes Provider API Keys via /api/providers

TencentCloud Octop through 1.0.2b6 contains a missing authorization vulnerability that allows authenticated low-privileged users to read stored provider API keys via GET /api/providers and GET /api/voice/providers. Attackers can query these endpoints, which only validate the JWT, to obtain...

7.1CVSS0.00238EPSS
SaveExploits0References5
osv_cve
osv_cve•added 2026/10/10 3:57 p.m.•55 views

CVE-2026-108581 Octop through 1.0.2b6 Missing Authorization Exposes Provider API Keys via /api/providers

TencentCloud Octop through 1.0.2b6 contains a missing authorization vulnerability that allows authenticated low-privileged users to read stored provider API keys via GET /api/providers and GET /api/voice/providers. Attackers can query these endpoints, which only validate the JWT, to obtain...

7.1CVSS5.9AI score0.00238EPSS
SaveExploits0References8
Rows per page
Query Builder