CVE-2026-108782 - erzhongxmu JEEWMS Autocomplete CommonServiceImpl.java CommonServiceImpl.getAutoList sql injection
CVE ID :CVE-2026-108782
Published : Oct. 12, 2026, 2:16 a.m. | 19 minutes ago
Description :A weakness has been identified in erzhongxmu JEEWMS up to 2026.09.27-W39. Affected by this issue is the function CommonServiceImpl.getAutoList of the file src/main/java/org/jeecgframework/core/common/service/impl/CommonServiceImpl.java of the component Autocomplete Handler. Executing a manipulation of the argument trem/searchField/entityName can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-108782
Published : Oct. 12, 2026, 2:16 a.m. | 19 minutes ago
Description :A weakness has been identified in erzhongxmu JEEWMS up to 2026.09.27-W39. Affected by this issue is the function CommonServiceImpl.getAutoList of the file src/main/java/org/jeecgframework/core/common/service/impl/CommonServiceImpl.java of the component Autocomplete Handler. Executing a manipulation of the argument trem/searchField/entityName can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-108783 - PRVTPRO Amnezia-Web-Panel Backup Download app.py default credentials
CVE ID :CVE-2026-108783
Published : Oct. 12, 2026, 2:16 a.m. | 19 minutes ago
Description :A security vulnerability has been detected in PRVTPRO Amnezia-Web-Panel up to 1.6.2/1.7.2. This affects an unknown part of the file app.py of the component Backup Download. The manipulation leads to use of default credentials. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-108783
Published : Oct. 12, 2026, 2:16 a.m. | 19 minutes ago
Description :A security vulnerability has been detected in PRVTPRO Amnezia-Web-Panel up to 1.6.2/1.7.2. This affects an unknown part of the file app.py of the component Backup Download. The manipulation leads to use of default credentials. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-108784 - macrozheng mall Payment Endpoint AlipayServiceImpl.java AlipayServiceImpl.pay logic error
CVE ID :CVE-2026-108784
Published : Oct. 12, 2026, 2:16 a.m. | 19 minutes ago
Description :A vulnerability was detected in macrozheng mall up to 1.0.3. This vulnerability affects the function AlipayServiceImpl.pay of the file com/macro/mall/portal/service/impl/AlipayServiceImpl.java of the component Payment Endpoint. The manipulation of the argument total_amount results in business logic errors. The attack can be launched remotely. The exploit is now public and may be used. The patch is identified as dcaa93b3150352e5044708d7211b5bed0af4509f. A patch should be applied to remediate this issue.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-108784
Published : Oct. 12, 2026, 2:16 a.m. | 19 minutes ago
Description :A vulnerability was detected in macrozheng mall up to 1.0.3. This vulnerability affects the function AlipayServiceImpl.pay of the file com/macro/mall/portal/service/impl/AlipayServiceImpl.java of the component Payment Endpoint. The manipulation of the argument total_amount results in business logic errors. The attack can be launched remotely. The exploit is now public and may be used. The patch is identified as dcaa93b3150352e5044708d7211b5bed0af4509f. A patch should be applied to remediate this issue.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-108785 - macrozheng mall JwtAuthenticationTokenFilter refreshToken JwtTokenUtil.refreshHeadToken session expiration
CVE ID :CVE-2026-108785
Published : Oct. 12, 2026, 2:16 a.m. | 19 minutes ago
Description :A flaw has been found in macrozheng mall up to 1.0.3. This issue affects the function JwtTokenUtil.refreshHeadToken of the file /admin/refreshToken of the component JwtAuthenticationTokenFilter. This manipulation of the argument token causes session expiration. The attack may be initiated remotely. The exploit has been published and may be used. Patch name: 9bfc2fd2c4aaa4ac519e9152e65d673a5380de1a. To fix this issue, it is recommended to deploy a patch.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-108785
Published : Oct. 12, 2026, 2:16 a.m. | 19 minutes ago
Description :A flaw has been found in macrozheng mall up to 1.0.3. This issue affects the function JwtTokenUtil.refreshHeadToken of the file /admin/refreshToken of the component JwtAuthenticationTokenFilter. This manipulation of the argument token causes session expiration. The attack may be initiated remotely. The exploit has been published and may be used. Patch name: 9bfc2fd2c4aaa4ac519e9152e65d673a5380de1a. To fix this issue, it is recommended to deploy a patch.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-108786 - houtini-ai seo-crawler-mcp Crawler CrawlOrchestrator.ts run_seo_audit server-side request forgery
CVE ID :CVE-2026-108786
Published : Oct. 12, 2026, 2:16 a.m. | 19 minutes ago
Description :A vulnerability has been found in houtini-ai seo-crawler-mcp up to 2.1.5. Impacted is the function run_seo_audit of the file src/core/CrawlOrchestrator.ts of the component Crawler. Such manipulation leads to server-side request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-108786
Published : Oct. 12, 2026, 2:16 a.m. | 19 minutes ago
Description :A vulnerability has been found in houtini-ai seo-crawler-mcp up to 2.1.5. Impacted is the function run_seo_audit of the file src/core/CrawlOrchestrator.ts of the component Crawler. Such manipulation leads to server-side request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-108787 - houtini-ai voice-analyser-mcp collect_corpus crawler.ts fetch server-side request forgery
CVE ID :CVE-2026-108787
Published : Oct. 12, 2026, 2:16 a.m. | 19 minutes ago
Description :A vulnerability was found in houtini-ai voice-analyser-mcp up to 2.1.1. The affected element is the function fetch of the file src/utils/crawler.ts of the component collect_corpus. Performing a manipulation of the argument sitemap_url results in server-side request forgery. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-108787
Published : Oct. 12, 2026, 2:16 a.m. | 19 minutes ago
Description :A vulnerability was found in houtini-ai voice-analyser-mcp up to 2.1.1. The affected element is the function fetch of the file src/utils/crawler.ts of the component collect_corpus. Performing a manipulation of the argument sitemap_url results in server-side request forgery. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-108788 - deepseek-ai deepseek-harness Sandbox spawn sandbox
CVE ID :CVE-2026-108788
Published : Oct. 12, 2026, 2:16 a.m. | 19 minutes ago
Description :A vulnerability was determined in deepseek-ai deepseek-harness up to 0.1.1-rc.2. The impacted element is the function spawn of the component Sandbox. Executing a manipulation of the argument Profile can lead to sandbox issue. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-108788
Published : Oct. 12, 2026, 2:16 a.m. | 19 minutes ago
Description :A vulnerability was determined in deepseek-ai deepseek-harness up to 0.1.1-rc.2. The impacted element is the function spawn of the component Sandbox. Executing a manipulation of the argument Profile can lead to sandbox issue. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-108980 - Blinko Directory Traversal Remote Code Execution
CVE ID :CVE-2026-108980
Published : Oct. 12, 2026, 2:16 a.m. | 19 minutes ago
Description :Blinko through 1.8.8 allows directory traversal, overwriting startup files as root, via installPlugin. It builds the plugin install path from an unsanitized name in server/routerTrpc/plugin.ts, and the plugin.installPlugin tRPC procedure is open to any authenticated user. Thus, a name containing ../ sequences writes the downloaded plugin files outside the plugins directory. Because the official Docker image runs as root, an authenticated attacker overwrites a root-owned startup file and achieves remote code execution as root. Self-registration for an account may be possible.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-108980
Published : Oct. 12, 2026, 2:16 a.m. | 19 minutes ago
Description :Blinko through 1.8.8 allows directory traversal, overwriting startup files as root, via installPlugin. It builds the plugin install path from an unsanitized name in server/routerTrpc/plugin.ts, and the plugin.installPlugin tRPC procedure is open to any authenticated user. Thus, a name containing ../ sequences writes the downloaded plugin files outside the plugins directory. Because the official Docker image runs as root, an authenticated attacker overwrites a root-owned startup file and achieves remote code execution as root. Self-registration for an account may be possible.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-66085 - Information Disclosure in Modem
CVE ID :CVE-2026-66085
Published : Oct. 12, 2026, 2:16 a.m. | 19 minutes ago
Description :In modem, there is a possible information disclosure due to missing filtering of sensitive data in crash dumps. This could lead to local information disclosure with no additional execution privileges needed.
Severity: 5.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-66085
Published : Oct. 12, 2026, 2:16 a.m. | 19 minutes ago
Description :In modem, there is a possible information disclosure due to missing filtering of sensitive data in crash dumps. This could lead to local information disclosure with no additional execution privileges needed.
Severity: 5.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-66086 - Stack-based Buffer Overflow in Modem
CVE ID :CVE-2026-66086
Published : Oct. 12, 2026, 2:16 a.m. | 19 minutes ago
Description :In the modem OTA stack, there is a possible stack-based buffer overflow due to improper validation of scheduling information in SIB1 messages. This could lead to remote code execution or denial of service with no additional execution privileges needed.
Severity: 9.8 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-66086
Published : Oct. 12, 2026, 2:16 a.m. | 19 minutes ago
Description :In the modem OTA stack, there is a possible stack-based buffer overflow due to improper validation of scheduling information in SIB1 messages. This could lead to remote code execution or denial of service with no additional execution privileges needed.
Severity: 9.8 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-87765 - Improper Input Validation in Kernel APsys DVFS
CVE ID :CVE-2026-87765
Published : Oct. 12, 2026, 2:16 a.m. | 19 minutes ago
Description :In the kernel apsys DVFS driver, there is a possible out-of-bounds read or hardware register corruption due to improper input validation of the frequency index. This could lead to system instability or denial of service with local privileges.
Severity: 5.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-87765
Published : Oct. 12, 2026, 2:16 a.m. | 19 minutes ago
Description :In the kernel apsys DVFS driver, there is a possible out-of-bounds read or hardware register corruption due to improper input validation of the frequency index. This could lead to system instability or denial of service with local privileges.
Severity: 5.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-21129 - Samsung Checkout Arbitrary Activity Launch Vulnerability
CVE ID :CVE-2026-21129
Published : Oct. 12, 2026, 5:17 a.m. | 1 hour, 19 minutes ago
Description :Improper input validation in GuestCreditCardRegisterActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch an arbitrary activity with Samsung Checkout privileges.
Severity: 5.1 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-21129
Published : Oct. 12, 2026, 5:17 a.m. | 1 hour, 19 minutes ago
Description :Improper input validation in GuestCreditCardRegisterActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch an arbitrary activity with Samsung Checkout privileges.
Severity: 5.1 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-21130 - Samsung Checkout Arbitrary Activity Launch Vulnerability
CVE ID :CVE-2026-21130
Published : Oct. 12, 2026, 5:17 a.m. | 1 hour, 19 minutes ago
Description :Improper input validation in CreditCardRetrieveActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch an arbitrary activity with Samsung Checkout privileges.
Severity: 5.1 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-21130
Published : Oct. 12, 2026, 5:17 a.m. | 1 hour, 19 minutes ago
Description :Improper input validation in CreditCardRetrieveActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch an arbitrary activity with Samsung Checkout privileges.
Severity: 5.1 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-21131 - Samsung Flow Arbitrary Activity Execution Vulnerability
CVE ID :CVE-2026-21131
Published : Oct. 12, 2026, 5:17 a.m. | 1 hour, 19 minutes ago
Description :Incorrect default permission in Samsung Flow prior to version 4.9.22.4 allows local attackers to launch an arbitrary activity with Samsung Flow privileges on the connected device.
Severity: 2.1 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-21131
Published : Oct. 12, 2026, 5:17 a.m. | 1 hour, 19 minutes ago
Description :Incorrect default permission in Samsung Flow prior to version 4.9.22.4 allows local attackers to launch an arbitrary activity with Samsung Flow privileges on the connected device.
Severity: 2.1 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-21132 - Samsung Internet Cross-Site Scripting Vulnerability
CVE ID :CVE-2026-21132
Published : Oct. 12, 2026, 5:17 a.m. | 1 hour, 19 minutes ago
Description :Improper input validation in Samsung Internet prior to version 30.0.5.24 allows remote attackers to inject arbitrary script. User interaction is required for triggering this vulnerability.
Severity: 6.0 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-21132
Published : Oct. 12, 2026, 5:17 a.m. | 1 hour, 19 minutes ago
Description :Improper input validation in Samsung Internet prior to version 30.0.5.24 allows remote attackers to inject arbitrary script. User interaction is required for triggering this vulnerability.
Severity: 6.0 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-21133 - Samsung Flow Path Traversal Vulnerability
CVE ID :CVE-2026-21133
Published : Oct. 12, 2026, 5:17 a.m. | 1 hour, 19 minutes ago
Description :Path traversal in Samsung Flow prior to version 4.9.22.1 allows local attackers to access clipboard data.
Severity: 5.1 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-21133
Published : Oct. 12, 2026, 5:17 a.m. | 1 hour, 19 minutes ago
Description :Path traversal in Samsung Flow prior to version 4.9.22.1 allows local attackers to access clipboard data.
Severity: 5.1 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-21134 - Samsung Flow Improper Authentication Vulnerability
CVE ID :CVE-2026-21134
Published : Oct. 12, 2026, 5:17 a.m. | 1 hour, 19 minutes ago
Description :Improper authentication in Samsung Flow prior to version 4.9.22.4 allows adjacent attackers to access sensitive information.
Severity: 6.1 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-21134
Published : Oct. 12, 2026, 5:17 a.m. | 1 hour, 19 minutes ago
Description :Improper authentication in Samsung Flow prior to version 4.9.22.4 allows adjacent attackers to access sensitive information.
Severity: 6.1 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-21135 - Samsung Internet Improper Access Control Vulnerability
CVE ID :CVE-2026-21135
Published : Oct. 12, 2026, 5:17 a.m. | 1 hour, 19 minutes ago
Description :Improper access control in Samsung Internet prior to version 30.0.5.6 allows local attackers to access sensitive information.
Severity: 5.9 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-21135
Published : Oct. 12, 2026, 5:17 a.m. | 1 hour, 19 minutes ago
Description :Improper access control in Samsung Internet prior to version 30.0.5.6 allows local attackers to access sensitive information.
Severity: 5.9 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-21136 - Samsung Smart Switch Improper Authorization Vulnerability
CVE ID :CVE-2026-21136
Published : Oct. 12, 2026, 5:17 a.m. | 1 hour, 19 minutes ago
Description :Improper authorization in Smart Switch prior to version 3.7.73 allows physical attackers to invoke application restore process.
Severity: 6.8 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-21136
Published : Oct. 12, 2026, 5:17 a.m. | 1 hour, 19 minutes ago
Description :Improper authorization in Smart Switch prior to version 3.7.73 allows physical attackers to invoke application restore process.
Severity: 6.8 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-21137 - Samsung Smart Switch Path Traversal Vulnerability
CVE ID :CVE-2026-21137
Published : Oct. 12, 2026, 5:17 a.m. | 1 hour, 19 minutes ago
Description :Path traversal in Smart Switch prior to version 3.7.73 allows physical attackers to access files with Smart Switch privilege.
Severity: 5.1 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-21137
Published : Oct. 12, 2026, 5:17 a.m. | 1 hour, 19 minutes ago
Description :Path traversal in Smart Switch prior to version 3.7.73 allows physical attackers to access files with Smart Switch privilege.
Severity: 5.1 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-21138 - Samsung Smart Switch Improper Data Authenticity Verification Vulnerability
CVE ID :CVE-2026-21138
Published : Oct. 12, 2026, 5:17 a.m. | 1 hour, 19 minutes ago
Description :Insufficient verification of data authenticity in Smart Switch prior to version 3.7.73 allows physical attackers to install arbitrary applications.
Severity: 6.9 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-21138
Published : Oct. 12, 2026, 5:17 a.m. | 1 hour, 19 minutes ago
Description :Insufficient verification of data authenticity in Smart Switch prior to version 3.7.73 allows physical attackers to install arbitrary applications.
Severity: 6.9 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...