News · NVD CVE API 2.0

• NVD CVE API 2.0 13 Oct

  CVE-2024-34324 · CVSS 9.1

  An issue in ProPhoenix Law RMS v2022.2403.3.101 allows attackers to execute a session hijacking attack via injecting a crafted 24-character string into the ASP.NET_SessionId cookie.

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2024-34324
• NVD CVE API 2.0 13 Oct

  CVE-2024-34323 · CVSS 10.0

  ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Direct Object Reference (IDOR) via the usrLogin$hdnPFID parameter. This vulnerability allows attackers to access sensitive information via a crafted HTTP request.

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2024-34323
• NVD CVE API 2.0 13 Oct

  CVE-2024-34320 · CVSS 9.8

  ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an incorrect access control issue in sensitive API endpoints.

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2024-34320
• NVD CVE API 2.0 13 Oct

  CVE-2026-77099 · CVSS 9.3

  CVFS contained an input validation issue affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS.

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-77099
• NVD CVE API 2.0 13 Oct

  CVE-2026-53709 · CVSS 9.8

  MCP Context Forge is an MCP gateway and administrative platform. Prior to 1.0.2, mcpgateway/config.py and .env.example ship a known JWT_SECRET_KEY, while verify_jwt_token() accepts HS256 tokens signed with that key and get_current_user() creates a platform administrator when the token subject matches PLATFORM_ADMIN_EMAIL and REQUIRE_USER_IN_DB is false. A remote unauthenticated attacker can therefore mint accepted administrator tokens without a database account. While the vulnerable signing key remains configured and the platform-admin bootstrap remains enabled, forged access survives password

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-53709
• NVD CVE API 2.0 13 Oct

  CVE-2026-104192 · CVSS 9.6

  Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40, OpaqueObjLoader::CreateStream in src/server/rdb_load.cc can associate one streamNACK with a consumer group's global PEL and a consumer-local PEL, then free the shared object when a duplicate consumer entry is rejected. Cleanup subsequently frees the same object again. In the default configuration, where Dragonfly ships with authentication disabled, an unauthenticated client can trigger the double-free by sending a crafted serialized stream to RESTORE, causing allocator corruption, denial of service, and

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-104192
• NVD CVE API 2.0 13 Oct

  CVE-2026-74041 · CVSS 9.4

  Wazuh 4.14.3 before 4.14.8 contains a case-sensitivity mismatch between the ossec.conf validator and wazuh-logcollector that bypasses remote-command validation. Authenticated users with manager:update_config can inject an uppercase LOG_FORMAT command localfile that the collector runs as root on reload.

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-74041
• NVD CVE API 2.0 13 Oct

  CVE-2026-74040 · CVSS 9.4

  Wazuh versions from 3.9.0 before 4.14.8 contain an arbitrary file overwrite vulnerability in MasterHandler.process_files_from_worker allowing a cluster worker to overwrite protected master files. Attackers controlling a worker can use a trailing-slash basename bypass and missing extra_valid enforcement to overwrite ossec.conf and agent.conf, achieving root remote code execution across the manager and every agent.

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-74040
• NVD CVE API 2.0 13 Oct

  CVE-2026-109520 · CVSS 9.3

  A flaw has been found in Colorful iGameCenter 2.0.0.82. Affected by this vulnerability is the function MmMapIoSpace in the library AMDRyzenMasterDriver.sys of the component Dispatch Handler. This manipulation of the argument SystemBuffer causes privilege defined with unsafe actions. The attack needs to be launched locally. The vendor was contacted early about this disclosure but did not respond in any way.

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-109520
• NVD CVE API 2.0 13 Oct

  CVE-2026-65173 · CVSS 9.1

  NVIDIA AIStore for Linux contains a missing authentication vulnerability in the token-revocation endpoint where an unauthenticated remote attacker may submit crafted token-revocation lists. A successful exploit may lead to data tampering and denial of service.

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-65173
• NVD CVE API 2.0 13 Oct

  CVE-2026-65162 · CVSS 10.0

  NVIDIA AIStore for Linux contains a vulnerability in the legacy ETL Kubernetes PodSpec initialization API where a remote attacker may supply Kubernetes host-namespace and container-security settings. A successful exploit may lead to code execution, privilege escalation, information disclosure, data tampering, and denial of service.

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-65162
• NVD CVE API 2.0 13 Oct

  CVE-2026-109707 · CVSS 9.6

  Sandbox escape due to use-after-free in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-109707
• NVD CVE API 2.0 13 Oct

  CVE-2026-109705 · CVSS 9.6

  Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-109705
• NVD CVE API 2.0 13 Oct

  CVE-2026-63354 · CVSS 9.4

  Affected devices do not properly validate and sanitize visual marker data contained in imported CSV trace files before rendering it on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-63354
• NVD CVE API 2.0 13 Oct

  CVE-2026-63353 · CVSS 9.4

  Affected devices do not properly sanitize comment fields contained in imported trace files before rendering them on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.

  Fix: vendor advisory: CISA ICS Advisories Fix panel

  detailsCVE-2026-63353
• NVD CVE API 2.0 13 Oct

  CVE-2026-63350 · CVSS 9.4

  Affected devices do not properly restrict executable content contained in imported trace files. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.

  Fix: vendor advisory: CISA ICS Advisories Fix panel

  detailsCVE-2026-63350
• NVD CVE API 2.0 13 Oct

  CVE-2026-89309 · CVSS 10.0

  The authorization middleware of the WMS MobileServer fails to require authentication in two distinct cases. First, it only requires an Authorization header for GET and HEAD requests; requests using any other HTTP method are processed without an authentication check. Second, for any HTTP method including GET and HEAD, a request carrying a malformed or non-bearer Authorization header is passed through without a valid token being required. The middleware does validate a token whenever a well-formed one is present, but in these two cases it does not require one. A remote attacker with network acce

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-89309
• NVD CVE API 2.0 13 Oct

  CVE-2026-109110 · CVSS 9.3

  A flaw has been found in Wavlink WL-WN592AX6 250422. This issue affects the function system of the component wmapd Daemon. Executing a manipulation can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-109110
• NVD CVE API 2.0 13 Oct

  CVE-2026-109109 · CVSS 9.3

  A vulnerability was detected in Wavlink WL-WN530BE1-A 251117. This vulnerability affects the function strcpy of the file /cgi-bin/ExportAllSettings.cgi of the component Settings Export CGI. Performing a manipulation of the argument HTTP_COOKIE/X-Cmd results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure.

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-109109
• NVD CVE API 2.0 13 Oct

  CVE-2026-109758 · CVSS 9.3

  Perforce Helix Authentication Service (HAS) deployments that retain the shipped default SCIM bearer token are vulnerable to unauthorized access when the SCIM endpoint is reachable by an attacker. In affected versions of HAS, the installation templates contain a default credential which the installer copies into the active configuration; the installer and configuration script do not automatically replace that value with a random token. An attacker who knows the default token can authenticate to the SCIM API and perform user and group operations allowed by the configured provisioning backend. Th

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-109758
• NVD CVE API 2.0 13 Oct

  CVE-2026-97229 · gitlab · CVSS 10.0

  GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.

  Fix: 7 public exploits (verified) · Microsoft: Release Notes (azl4 ruby 3.4.10-36.azl4 on Azure Linux 4.0); Release Notes (azl3 ruby 3.3.5-10 on Azure Linux 3.0) · CISA: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Securi… (due 2026-11-01) · 1 patch or advisory reference on NVD Fix panel

  detailsCVE-2026-97229
• NVD CVE API 2.0 13 Oct

  CVE-2026-89111 · CVSS 10.0

  The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated.

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-89111
• NVD CVE API 2.0 13 Oct

  CVE-2026-89110 · CVSS 9.9

  SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. An attacker with low privileges could invoke internal operations on a preconfigured remote system. Depending on the remote connection configuration, this could lead to a full compromise of the remote system. This results in a high impact on confidentiality, integrity and availability.

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-89110
• NVD CVE API 2.0 13 Oct

  CVE-2026-89108 · CVSS 9.1

  SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative functionality. An attacker with MII administrator privileges could submit a specially crafted request to provision an account with elevated privileges on the underlying Java application server. Successful exploitation could allow the attacker to gain administrative control over the underlying system, extending the impact beyond the vulnerable application. This results in a high impact on confidentiality, integrity and availability.

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-89108
• NVD CVE API 2.0 13 Oct

  CVE-2026-89107 · CVSS 9.9

  SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validate input processed by rule definition functionality that utilizes a domain-specific scripting language. An authenticated attacker with specific business privileges could submit specially crafted input, which is interpreted as executable ABAP code by the rule processing logic. Successful exploitation could allow the attacker to execute ABAP arbitrary code into the system, resulting in full compromise of the affected system and high impact on confidentiality, integrity, and availability of the system.

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-89107
• NVD CVE API 2.0 13 Oct

  CVE-2026-87689 · CVSS 9.8

  The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store through Msf::WebServices::CredentialServlet. Every mutating and read route in this servlet calls warden.authenticate! before processing a request, except the update_credential (PUT) and delete_credentials (DELETE) handlers for /api/v1/credentials, which omit the authentication call entirely. Because these handlers call directly into lib/msf/core/db_manager/cred.rb, which performs no authorization check of its own, any client able to reach the web service on its default 0.0.0.0:8080 listener can read, modify, or

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-87689
• NVD CVE API 2.0 13 Oct

  CVE-2026-96119 · ibm, i · CVSS 9.9

  IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information or execute arbitrary code on the system due to improper data sanitization by the HTTP Server Administration web application.

  Fix: 1 patch or advisory reference on NVD Fix panel

  detailsCVE-2026-96119
• NVD CVE API 2.0 12 Oct

  CVE-2026-82110 · ibm, datastage_on_cloud_pak_for_data · CVSS 9.9

  IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of pathname during a path traversal.

  Fix: 1 patch or advisory reference on NVD Fix panel

  detailsCVE-2026-82110
• NVD CVE API 2.0 12 Oct

  CVE-2026-82101 · ibm, datastage_on_cloud_pak_for_data · CVSS 9.6

  IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service due to a path traversal vulnerability.

  Fix: 1 patch or advisory reference on NVD Fix panel

  detailsCVE-2026-82101
• NVD CVE API 2.0 12 Oct

  CVE-2026-109573 · CVSS 9.2

  phpMyFAQ before 4.1.9 contains an SQL injection vulnerability in PdoMysql::escape(), which escapes single quotes with backslashes that are treated literally when MySQL or MariaDB runs in NO_BACKSLASH_ESCAPES mode. Unauthenticated attackers can send a Unicode right single quotation mark in the search parameter of api/autocomplete, which is normalized to an ASCII quote, to read credentials and configuration secrets, modify records, or drop tables.

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-109573
• NVD CVE API 2.0 12 Oct

  CVE-2026-90920 · CVSS 9.8

  IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to execute arbitrary code due to improper control of code generation.

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-90920
• NVD CVE API 2.0 12 Oct

  CVE-2026-44828 · CVSS 9.3

  Qexo is an open source online editor for static blogs. From 4.0.0 until 4.2.0, Qexo exposes /api/init_step/ through init_step_api without authentication, authorization, or a setup-completion guard. An unauthenticated requester with a valid CSRF token obtained from a public page can submit the first initialization step and reset the INIT setting, causing the instance to re-enter the setup flow. The setup response and /init/ page can expose stored PROVIDER configuration, including service credentials, in frontend content. This issue is fixed in version 4.2.0.

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-44828
• NVD CVE API 2.0 12 Oct

  CVE-2026-53997 · CVSS 9.1

  Netherman Portal del Hermano (portaldelhermano.es) before 2026-10-06 contains a broken authentication vulnerability in its password-recovery flow at the POST /password/create-access and POST /password/email endpoints, allowing unauthenticated attackers to take over any member account across all tenants by exploiting the lack of rate limiting and distinct error messages that act as oracles for each of the four identity-verification factors (DNI, date of birth, phone number, last four IBAN digits). Attackers can confirm the DNI via the oracle, brute-force the date of birth and IBAN digits, obtai

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-53997
• NVD CVE API 2.0 12 Oct

  CVE-2026-109569 · CVSS 9.3

  sandboxed.sh through 1.3.0 contains a container escape vulnerability that allows code in container workspaces to access the host filesystem because nsenter attaches without --root. Agent-run code in a container workspace can resolve absolute paths on the host to read and modify host files, bypassing documented isolation.

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-109569
• NVD CVE API 2.0 12 Oct

  CVE-2026-109566 · CVSS 9.3

  Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerability that allows remote unauthenticated attackers to gain super-admin access through an AuthSeeder-created admin@laravel account with password admin. The account is seeded by the setup installer and silently re-created on every rpd:make run, letting attackers log in as a global super admin bypassing per-record authorization and tenant scoping.

  Fix: 1 public exploit Fix panel

  detailsCVE-2026-109566
• NVD CVE API 2.0 12 Oct

  CVE-2026-108929 · CVSS 9.4

  A flaw has been found in Netcore NR268 1.7.121109. The affected element is the function execvp of the file /router/DDNSset.cgi of the component DDNS. Executing a manipulation of the argument Hostname can lead to argument injection. The attack can be launched remotely.

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-108929
• NVD CVE API 2.0 12 Oct

  CVE-2025-71429 · CVSS 9.3

  GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in tools/uvr5/vr.py that allows unauthenticated attackers to execute commands via output folder paths. Attackers can enter shell substitutions like $(...) in the UVR5 WebUI output folder textboxes with mp3 or m4a export to run commands as the server user.

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2025-71429
• NVD CVE API 2.0 12 Oct

  CVE-2020-37279 · CVSS 9.2

  easy-pdf-merge 0.1.0 through 0.2.6 contains an OS command injection vulnerability that allows attackers to execute commands by injecting shell metacharacters into source paths, destination path, or maxHeap option. Attackers can supply file names or options containing double quotes, semicolons, $() or backticks, which child_process.exec() runs through a shell with the Node.js process privileges.

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2020-37279
• NVD CVE API 2.0 12 Oct

  CVE-2026-96012 · CVSS 9.9

  IBM Db2 Mirror for i 7.4, 7.5, and 7.6 is vulnerable to privilege escalation. An authenticated attacker could craft a malicious request that bypasses additional authorization and input validation checks to execute malicious code. An attacker could exploit this vulnerability to obtain elevated privileges on the system.

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-96012
• NVD CVE API 2.0 12 Oct

  CVE-2026-109575 · CVSS 9.8

  In HAProxy Data Plane API 2.2.0 through 3.4.3 (and corresponding Enterprise Edition releases), Server.ConfigureAPI() has process-global authentication logic that improperly drops security controls across multiple transport types. When a TLS Certificate Authority (tls_ca) is configured and a numeric TLS port (tls_port) is specified, the application globally disables Basic authentication on its shared internal request handler. Because this handler is shared concurrently among HTTP, HTTPS, and UNIX domain socket listeners, and mutual TLS (mTLS) client certificate verification (tls.RequireAndVerif

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-109575
• NVD CVE API 2.0 12 Oct

  CVE-2026-109423 · CVSS 9.1

  NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a TLS certificate validation vulnerability that allows a network-adjacent attacker to intercept and decrypt HTTPS traffic by failing to validate the server certificate chain, verify the hostname, or consult any Windows certificate trust store. Attackers can perform a man-in-the-middle attack using a rogue certificate authority to decrypt traffic, capture the MUSIC_U session credential sent in authenticated API requests, and modify server responses in transit, enabling account takeover and transpo

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-109423
• NVD CVE API 2.0 12 Oct

  CVE-2026-109422 · CVSS 9.2

  NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a remote code execution vulnerability in the renderer-process IPC bridge os.navigateExternal, which passes caller-supplied URLs to ShellExecuteW without validating the URL scheme. An attacker able to inject content into the renderer, such as by forging the /pc/upgrade/get API response using a publicly known AES key over an unvalidated TLS connection, can invoke os.navigateExternal with a file:// URL through an img onerror payload to execute arbitrary local binaries under the logged-in user's acco

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-109422
• NVD CVE API 2.0 12 Oct

  CVE-2026-108362 · CVSS 9.1

  Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior to 0.11.0, TEE attestation evidence in Privasys attested TLS is accepted without requiring an explicitly authorized platform identity. When a network attacker can forge evidence or extract attestation secrets from a compromised unrevoked platform, the verifier accepts valid measurements from a different unrevoked TEE platform as though they came from the intended Attester. The attacker can impersonate the attested TLS endpoint. This issue is fixed in version 0.11.0.

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-108362
• NVD CVE API 2.0 12 Oct

  CVE-2026-87744 · CVSS 9.1

  A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer customizes a specific operation using @MethodProperties without explicitly re-declaring security roles, the code generator silently drops class-level security requirements. This results in the affected endpoint defaulting to permissive, unauthenticated access, potentially leading to unauthorized information disclosure or data modification.

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-87744
• NVD CVE API 2.0 12 Oct

  CVE-2026-57118 · CVSS 9.8

  PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, AgentTeam.launch and the Agents alias register GET /{path}/list, POST /{path}, and `POST /{path}/{agent_id}' without access-control checks before listing agents or calling agent.chat. A remotely exposed server can therefore let unauthenticated clients enumerate agents, consume model resources, access connected private context, and trigger agent tools or workflow side effects. This vulnerability is fixed in praisonaiagents 1.6.59.

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-57118
• NVD CVE API 2.0 12 Oct

  CVE-2026-77366 · CVSS 9.9

  obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, tool dispatch does not compare the caller-controlled input.vault value with the vault bound to the caller, the JSON Web Token (JWT) has no vault claim, and the folder access-control list is shared globally. Any valid token can therefore select another configured vault and read, write, or delete its contents through affected tools. Version 1.3.1 fixes the vulnerability by binding tokens and request context to a vault and rejecting mismatched input.vault values before scope checks.

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-77366
• NVD CVE API 2.0 12 Oct

  CVE-2026-108918 · CVSS 9.3

  A vulnerability was identified in Edimax BR-6208AC 1.32. Impacted is an unknown function of the file /goform/formWlanMP. The manipulation of the argument readE2P leads to command injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-108918
• NVD CVE API 2.0 12 Oct

  CVE-2026-108917 · CVSS 9.3

  A vulnerability was determined in Edimax BR-6208AC 1.32. This issue affects some unknown processing of the file /goform/formAutoFWupgrade. Executing a manipulation of the argument tftpsIP can lead to command injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-108917
• NVD CVE API 2.0 12 Oct

  CVE-2026-109373 · CVSS 9.2

  ZITADEL 3.0.0 before 4.19.2 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to obtain other users' session tokens by forging unsigned session cookies. Attackers can guess time-ordered session IDs around a victim's sign-in and supply them with empty tokens to receive rotated tokens, taking over accounts including MFA-completed administrator sessions.

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-109373
• NVD CVE API 2.0 12 Oct

  CVE-2026-109372 · CVSS 9.3

  ZITADEL 4.x before 4.19.2 and 3.x through 3.4.15 contains an authentication bypass in the SAML identity-provider intent callback, which verifies the assertion signature using the provider named in the request URL but resolves the user from the login intent without checking they match. Attackers with organization-administrator permission can register a SAML provider with their own signing key to obtain authenticated sessions as any user linked to another SAML provider on the instance, including in other organizations.

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-109372

Older