CVE-2026-108697

CoreShop versions through 2026.2.2 contain a missing authorization vulnerability (CWE-862) within the ResourceController listAction . The root cause is that the action skips the isGrantedOr403() check, allowing authenticated Pimcore users with low privileges to bypass permission restrictions. Exp...

CVE-2026-108698

The hyper-mcp software (versions through 0.8.3 ) contains a TOCTOU (Time-of-Check Time-of-Use) Race Condition vulnerability within the load_wasm function in src/wasm/oci.rs. The root cause is that the system verifies the Cosign signature of a separately resolved tag instead of the actual loaded m...

CVE-2026-108681

A security flaw in the zhayujie CowAgent Web Console (up to version 2.1.7 ) allows for a remote denial of service (DoS). The vulnerability exists within an unknown function in the file channel/web/web_channel.py where manipulation of the session_id argument triggers the DoS. Public exploit code i...

CVE-2026-108584

A security flaw in FunnyWolf Viper (up to version 3.1.11 ) allows for the disclosure of hard-coded credentials . The vulnerability stems from an unknown function within the file /root/viper/.git/config, where specific manipulation can trigger the leak. Remote exploitation is possible, and an expl...

CVE-2026-108578

A vulnerability exists in the Embedded Web Server component of Neterbit NW-431F 20250715 . Specifically, an unknown function within the /sms.json file allows for information disclosure . This vulnerability can be triggered via a remote attack . No remediation details or specific exploit informati...

CVE-2026-108577

A vulnerability exists in Konstanty Bialkowski libmodplug versions up to 0.8.9.1 . The flaw is located within the abc_add_gchord function in the src/load_abc.cpp file of the ABC Music Format Parser component. This issue leads to resource consumption and can be initiated remotely. No specific reme...

CVE-2026-108760

LlamaFarm versions through 0.0.34 are vulnerable to an unauthenticated API exposure due to an insecure default configuration. The software binds its FastAPI server to 0.0.0.0 on port 14345 , while the lf CLI silently ignores HOST overrides . This allows network-adjacent attackers to access the pr...

CVE-2026-108759

Versions 0.9.0 through 0.9.4 of mistral.rs are vulnerable to a sandbox escape via a link following vulnerability in the mistralrs-code-exec component. The root cause is improper link resolution (CWE-59), which allows sandboxed shell code to read and overwrite files outside the designated sandbox ...

CVE-2026-108757

The Nexting pinclaw OpenClaw channel plugin, in versions through 0.3.0 , contains a missing authentication vulnerability in src/core/http-router.ts. The flaw occurs because the software fails to perform an authToken check on the POST /pinclaw/send endpoint. Because the service binds to all interf...

CVE-2026-108758

Easy!Appointments versions through 1.6.0 are vulnerable to an authorization bypass within the Booking::register() function. This flaw allows unauthenticated attackers to modify any appointment by providing an appointment ID without the required hash. By enumerating sequential IDs and self-asserti...

CVE-2026-108756

The Abilityai Trinity software (versions through 0.9.5 ) contains a missing authorization vulnerability within the Telegram router . This flaw allows agent-scoped MCP API keys to execute operations restricted to human users, specifically binding operations . An attacker who gains control of an ag...

CVE-2026-108754

Versions of GPT-Load through 1.4.11 are vulnerable to a cleartext logging flaw where the Gin Logger middleware records raw query strings. This occurs because the logging happens before the extractAuthKey function can strip the sensitive key parameter. An attacker with read access to console logs ...

CVE-2026-108755

Hatchet versions through 0.110.5 are vulnerable to an unauthenticated memory exhaustion vulnerability (CWE-770) within the SNS ingestion endpoint . The root cause is an allocation of resources without limits because the SnsUpdate handler buffers request bodies for the POST /api/v1/sns/{tenant}/{e...

CVE-2026-108753

Versions of Agnaistic agnai through 1.0.555 are affected by a hard-coded credentials vulnerability located in the self-host.docker-compose.yml file. The flaw involves a fixed admin password and a public JWT secret. Unauthenticated attackers can leverage these credentials to log in as an administr...

CVE-2026-108751

The MoAI-ADK software, versions through 3.1.2 , is susceptible to an improper link resolution (CWE-59) vulnerability within the moai init template deployer . The root cause is the application's failure to properly resolve links during the staging process, allowing malicious repositories to utiliz...

CVE-2026-108752

JupyterHub versions through 6.0.1 are vulnerable to an identifier collision vulnerability caused by the use of unescaped hyphens in usernames. This flaw allows authenticated users to overwrite another user's named-server OAuth client by registering a hyphenated username (e.g., a user with the nam...

CVE-2026-108750

The OpenDocMan application versions 2.4.0 through 2.10.0 is vulnerable to a decompression bomb (CWE-409) during the upload text extraction process. This flaw allows authenticated users to exhaust PHP memory by uploading small, specially crafted ODT, DOCX, or XLSX files. When processed, the XML en...

CVE-2026-108748

Quarkus LangChain4j versions 1.9.0 through 1.14.1 are vulnerable to a memory exhaustion issue within the chat-scopes WebSocket /_chat/routes endpoint. The root cause is a missing release of memory where unauthenticated remote clients can send repeated CONNECT frames while reusing a single chatId ...

CVE-2026-108749

A missing authentication vulnerability in docling-serve versions 1.14.0 through 1.36.0 allows unauthenticated remote attackers to access the /v1/memory/stats and /v1/memory/counts endpoints. The root cause is the omission of the require_auth dependency, enabling attackers to bypass the DOCLING_SE...

CVE-2026-108747

Lightdash versions through 2.556.0 are vulnerable to an authorization bypass (CWE-639) that allows authenticated organization members to delete other users' personal access tokens . By sending a DELETE request to the personal-access-tokens route with a victim's token UUID, an attacker can revoke ...