CVE-2026-108xxx records
Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.
641 records · Page 5 of 7
AstronRPA through 1.1.6 contains a missing tenant authorization check in robot-service that allows authenticated users to read other tenants' shared variables via the get-batch-shared-var endpoint. Attackers can enumerate sequential shared variable IDs and decrypt all-users variables re-encrypted with their own tenant key to recover other tenants' credentials in plaintext.
Updated- CVE-2026-108546: Spotweb through 1.5.8 OS Command Injection via Spot Title in Runcommand Integration 7.7 High
Spotweb through 1.5.8 contains an OS command injection vulnerability in the runcommand NZB handler that allows remote attackers to execute commands by publishing spots with malicious titles. Attackers can post self-signed spots over Usenet with shell metacharacters in the title, which are substituted unescaped for $SPOTTITLE and passed to exec() when a user downloads the spot, running commands as
Updated SillyTavern 1.12.13 through 1.19.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust resources because body-parser middleware runs before authentication and whitelist checks. Attackers can send large or compressed JSON or urlencoded bodies up to 500 MB, optionally in parallel, to exhaust memory and CPU and deny service.
UpdatedA vulnerability was identified in Lippu Docx Reader Office Viewer App up to 1.4.5 on Android. This affects the function word.office.docxviewer.document.docx.reader.ViewTxt. Such manipulation of the argument _display_name leads to path traversal. The attack may be performed from remote.
UpdatedA vulnerability was determined in ag2ai ag2 up to 0.13.4. Affected by this issue is the function os.path.join of the component UserProxyAgent. This manipulation of the argument filename causes path traversal. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any
UpdatedA vulnerability was found in 021is elvix-sdk up to 0.10.1. Affected by this vulnerability is an unknown functionality of the file src/mcp/index.ts of the component MCP Request Handler. The manipulation of the argument path results in server-side request forgery. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclo
UpdatedA vulnerability has been found in highwarden Super Store Finder up to 3.8. Affected is an unknown function of the file /products/superstorefinder/index.php. The manipulation of the argument lat/lng leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. Upgrading to version 3.9 is able to address this issue. The affected
UpdatedA flaw has been found in OpenSpug Spug up to 3.4.0/4.0.1. This impacts an unknown function of the file /exec/transfer of the component File Transfer. Executing a manipulation can lead to os command injection. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
UpdatedA vulnerability was detected in GPAC up to 26.07.0. This affects the function gf_fq_pop of the file filter_core/filter_queue.c of the component MP4Box. Performing a manipulation results in use after free. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
UpdatedA security vulnerability has been detected in GPAC up to 26.07.0. The impacted element is the function gf_mx_v of the file utils/os_thread.c of the component MP4Box. Such manipulation leads to use after free. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Updated- CVE-2026-108537: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Updated · Rejected record Inefficient Algorithmic Complexity vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server CPU via small SETTINGS or connection-level WINDOW_UPDATE frames. The attacker opens thousands of streams whose responses block on the connection send window, then sends cheap frames that each make the server walk the whole queue of blocked send
UpdatedAllocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the 65,535-byte initial window and withholds WINDOW_UPDATE, so the stream process blocks while sending and stops read
UpdatedA vulnerability was determined in Studio-Saelix Sencho up to 0.94.1. This vulnerability affects unknown code of the file outboundTarget.ts of the component git-sources Browse API Endpoint. Executing a manipulation of the argument repo_url can lead to server-side request forgery. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The presence of th
UpdatedA vulnerability was found in Studio-Saelix Sencho up to 0.94.1. This affects an unknown part of the file /api/auth/login of the component Login Endpoint. Performing a manipulation of the argument X-Forwarded-For results in improper authentication. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The patch is named 79b86ddcd4aefdd6941f098e35990a
UpdatedA vulnerability has been found in Studio-Saelix Sencho up to 0.97.1. Affected by this issue is the function isValidRemoteUrl of the file backend/src/utils/validation.ts of the component Add Remote Node API Endpoint. Such manipulation leads to server-side request forgery. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor confirms: "The nod
Updated- CVE-2026-108519: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Updated · Rejected record DBI versions before 1.656 for Perl crash via type confusion in dbi_profile when a database handle is destroyed under a Profile Path with an {attr} element. An {attr} element names a database handle attribute, which dbi_profile reads from the handle's inner hash. It expects the inner handle as a reference and dereferences it, but a handle that is being destroyed hands back the inner hash itself, s
Updated- CVE-2026-108515: Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-015 Unscored
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1 to 12.0.0-beta2.
Updated - CVE-2026-108514: Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-016 Unscored
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 10.3.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1 to 12.0.0-beta2.
Updated ZTE Z80 Ultra's system interfaces do not have robust invocation authentication, with inadequate access control. Third-party apps may call the interfaces through reflection and retrieve relevant information.
UpdatedZTE Z80 Ultra has a local information disclosure vulnerability. Third-party applications can capture data returned by system interfaces to obtain device-related information.
Updated- CVE-2026-108504: Unauthorized information retrieval vulnerability in ZTE Z80 Ultra product 5.5 Medium
ZTE Z80 Ultra has an unauthorized information disclosure vulnerability. The access control for methods within the framework is insufficient. An attacker can exploit this method to read device-related information.
Updated - CVE-2026-108503: Unauthorized information acquisition vulnerability in ZTE Z80 Ultra product 3.3 Low
ZTE Z80 Ultra has an interface permission validation vulnerability. The callable functions provided by the system lack sufficient access control. An attacker can leverage these functions to read relevant information.
Updated ZTE Z80 Ultra contains an information disclosure vulnerability, through which third-party applications can read relevant information by hooking system APIs.
UpdatedZTE Z80 Ultra has a system interface permission verification defect. The interface lacks necessary access control, and relevant information can be read by reflectively invoking the interface.
Updated- CVE-2026-108499: WordPress Knowledge Base plugin <= 3.2.0 - Broken Access Control vulnerability 5.3 Medium
Missing Authorization vulnerability in WebberZone Knowledge Base knowledgebase allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Knowledge Base: from n/a through 3.2.0.
Updated Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bannersky BSK PDF Manager bsk-pdf-manager allows Stored XSS.This issue affects BSK PDF Manager: from n/a through 3.8.1.
UpdatedImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS Amelia ameliabooking allows SQL Injection.This issue affects Amelia: from n/a through 2.4.10.
Updated- CVE-2026-108496: WordPress WP User Manager plugin <= 2.9.24 - Broken Access Control vulnerability 5.3 Medium
Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Manager: from n/a through 2.9.24.
Updated - CVE-2026-108495: WordPress SureForms plugin <= 2.12.7 - Cross Site Scripting (XSS) vulnerability 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureForms sureforms allows Stored XSS.This issue affects SureForms: from n/a through 2.12.7.
Updated - CVE-2026-108494: WordPress Chained Quiz plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Chained Quiz <= 1.4.1 versions.
Updated Missing Authorization vulnerability in Karolína Vyskočilová Pay for Payment for WooCommerce woocommerce-pay-for-payment allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pay for Payment for WooCommerce: from n/a through 3.0.1.
UpdatedMissing Authorization vulnerability in Fullworks Plugins Quick Paypal Payments quick-paypal-payments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quick Paypal Payments: from n/a through 6.0.3.
Updated- CVE-2026-108491: WordPress Everest Forms plugin <= 3.6.1 - Cross Site Scripting (XSS) vulnerability 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Everest Forms Everest Forms everest-forms allows Stored XSS.This issue affects Everest Forms: from n/a through 3.6.1.
Updated Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows Stored XSS.This issue affects Premium Addons for Elementor: from n/a through 4.11.110.
UpdatedInsertion of Sensitive Information Into Sent Data vulnerability in PluginUs.Net Active Products Tables for WooCommerce profit-products-tables-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Active Products Tables for WooCommerce: from n/a through 2.1.3.
UpdatedImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor allows Stored XSS.This issue affects PowerPack Addons for Elementor: from n/a through 3.1.0.
Updated- CVE-2026-108487: WordPress Books Gallery plugin <= 4.8.4 - Cross Site Scripting (XSS) vulnerability 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hossni Mubarak Books Gallery wp-books-gallery allows Stored XSS.This issue affects Books Gallery: from n/a through 4.8.4.
Updated - CVE-2026-108486: WordPress Forminator plugin <= 1.58.0 - Broken Access Control vulnerability 5.3 Medium
Missing Authorization vulnerability in WPMU DEV Forminator forminator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Forminator: from n/a through 1.58.0.
Updated - CVE-2026-108485: WordPress eStore theme <= 1.6.13 - Cross Site Scripting (XSS) vulnerability 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill eStore estore allows Reflected XSS.This issue affects eStore: from n/a through 1.6.13.
Updated Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPManageNinja Best Payments Plugin for WP wp-payment-form allows Stored XSS.This issue affects Best Payments Plugin for WP: from n/a through 4.6.27.
UpdatedImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hippooo Hippoo Mobile App for WooCommerce hippoo allows Reflected XSS.This issue affects Hippoo Mobile App for WooCommerce: from n/a through 1.12.0.
UpdatedImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows Stored XSS.This issue affects Premium Addons for Elementor: from n/a through 4.11.110.
UpdatedCross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress patreon-connect allows Cross Site Request Forgery.This issue affects Patreon WordPress: from n/a through 1.10.0.
UpdatedMissing Authorization vulnerability in Skydropx Skydropx skydropx allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Skydropx: from n/a through 2.1.4.
UpdatedCross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress patreon-connect allows Cross Site Request Forgery.This issue affects Patreon WordPress: from n/a through 1.9.17.
UpdatedImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 8.8.8.
Updated- CVE-2026-108477: WordPress Booktics plugin <= 1.0.28 - Broken Access Control vulnerability 5.3 Medium
Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.28.
Updated Missing Authorization vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.13.
UpdatedMissing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broadcast Live Video: from n/a through 7.3.6.
UpdatedIn JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functions
Updated- CVE-2026-108473: Improper Authentication and Credential Exposure in Multiple TP-Link Kasa Devices 8.7 High
Multiple Kasa devices contain an improper authentication vulnerability in the local device-management protocol. An unauthenticated adjacent attacker may send management instructions to an affected device without adequate authentication or authorization, allowing modification of the device state or management settings. Under certain usage conditions involving interaction between the user, mobile ap
Updated Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.
UpdatedUse after free in Windows Installer allows an authorized attacker to elevate privileges locally.
UpdatedHeap-based buffer overflow in Microsoft PostScript Printer Driver allows an authorized attacker to execute code over a network.
UpdatedOut-of-bounds read in Windows Kernel allows an unauthorized attacker to deny service over a network.
UpdatedUse after free in Windows Update Delivery Optimization allows an authorized attacker to elevate privileges locally.
UpdatedUse after free in Software Protection Platform (SPP) allows an authorized attacker to elevate privileges locally.
UpdatedImproper resolution of path equivalence in Windows SmartScreen allows an unauthorized attacker to bypass a security feature over a network.
UpdatedExposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an authorized attacker to disclose information locally.
UpdatedUse after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.
UpdatedUse after free in Windows Message Queuing allows an unauthorized attacker to execute code over a network.
UpdatedUse after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
UpdatedOut-of-bounds write in Microsoft Windows PDF allows an unauthorized attacker to execute code over a network.
UpdatedServer-side request forgery (ssrf) in Azure AI Foundry allows an authorized attacker to elevate privileges over a network.
UpdatedOut-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
UpdatedBuffer over-read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
UpdatedOut-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
UpdatedImproper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
UpdatedNumeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
UpdatedHeap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
UpdatedHeap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
UpdatedHeap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
UpdatedHeap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
UpdatedUse after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
UpdatedStack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
UpdatedHeap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.
UpdatedOff-by-one error in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
UpdatedUse after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
UpdatedHeap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
UpdatedStack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
UpdatedHeap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
UpdatedUse after free in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
UpdatedHeap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
UpdatedOut-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
UpdatedUntrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
UpdatedOut-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
UpdatedReliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally.
UpdatedHeap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
UpdatedStack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
UpdatedHeap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
UpdatedHeap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
UpdatedHeap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
UpdatedHeap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
UpdatedHeap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
UpdatedInteger overflow or wraparound in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code over a network.
UpdatedHeap-based buffer overflow in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
UpdatedUntrusted search path in .NET Framework allows an authorized attacker to bypass a security feature locally.
Updated- CVE-2026-108396: Windows Modern Device Management (MDM) Elevation of Privilege Vulnerability 7.0 High
Time-of-check time-of-use (toctou) race condition in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.
Updated