CVE-2026-108754

GPT-Load through 1.4.11 Cleartext Proxy Key Logging via Access Logger

GPT-Load through 1.4.11 contains a cleartext logging vulnerability that exposes client proxy keys because the Gin Logger middleware records the raw query string before extractAuthKey strips the key parameter. Attackers with read access to console logs or ./data/logs/app.log can recover proxy keys from Gemini-style requests and use them against the corresponding group.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Tbphp

Products

Gpt-load

CVE-2026-108744

pbi-cli 3.10.1 through 3.12.0 OS Command Injection via Desktop Sync

pbi-cli 3.10.1 through 3.12.0 contains an OS command injection vulnerability in desktop_sync.py that passes unquoted .pbip paths to cmd /c start when reopening projects. Attackers can lure victims into opening a Power BI project from a space-free path containing & to run commands with victim privileges during report write or reload.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Minasaad1

Products

Pbi-cli

CVE-2026-108738

Traccar 5.7 through 6.16.0 Login CSRF via OpenID Connect Callback

Traccar 5.7 through 6.16.0 contains a cross-site request forgery vulnerability that allows attackers to log victims into attacker-controlled accounts because the OpenID Connect callback never validates the OAuth state parameter. Attackers can induce a victim's browser to load /api/session/openid/callback with their own authorization code, causing data the victim enters, such as registered devices, to land in the attacker's account.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Traccar

Products

Traccar

CVE-2026-108733

Frappe HR (hrms) before 16.11.0 Missing Authorization via expire_allocation

Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted expire_allocation method that allows authenticated users to expire any leave allocation. Attackers without HR roles can name another employee's Leave Allocation in a POST request to zero its allocated leaves and wipe that employee's remaining leave balance.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Frappe

Products

Frappe Hr

CVE-2026-108728

Flyte 2.0.1 through 2.0.51 Cleartext Secret Exposure via Admission Webhook

Flyte 2.0.1 through 2.0.51 contains a cleartext secret storage vulnerability that allows users with Pod read access to obtain secrets by reading init container environment variables. The embedded secret manager webhook writes base64-encoded FILE-mounted secret values into the SECRETS environment variable, letting principals without Secret store access decode them from the Pod spec.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Flyteorg

Products

Flyte

CVE-2026-108723

answer-me-with-html through 0.5.0 Symlink Following in Code Block src Embedding

answer-me-with-html through 0.5.0 contains a link following vulnerability in the am CLI code block src= embedding, where localPath() checks only path text without resolving symlinks. Attackers can ship a repository with a symlink pointing outside the checkout so am render embeds readable external files into generated HTML, disclosing them when shared.

CVSS 4.0 · 2 Low EPSS < 1% KEV · Not listed

Vendors

Qingyuna

Products

Answer-me-with-html

CVE-2026-108718

Rill 0.77.0 through 0.90.5 OAuth Missing Authorization via Dynamic Client Registration

Rill 0.77.0 through 0.90.5 contains a missing authorization vulnerability in the admin OAuth server that issues authorization codes to dynamically registered clients without user consent. Attackers can register a client with the long_lived_access_token scope and lure a user to an authorization link, obtaining a non-expiring API token with the user's full permissions.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Rill Data

Products

Rill

CVE-2026-108713

SuiteCRM through 7.15.2 and 8.10.2 Missing Authorization via setCampaignMarketingAndTemplate

SuiteCRM through 7.15.2 and 8.x through 8.10.2 contains a missing authorization vulnerability that allows authenticated users to create and modify EmailMarketing records via the setCampaignMarketingAndTemplate entry point. Low-privileged users denied Campaigns access can post marketingId, campaignId, and templateId to reattach marketing messages or swap the template EmailMan sends in campaign emails.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Suitecrm

Products

Suitecrm

CVE-2026-108707

Wukong_HRM through commit 186115e Authentication Bypass via ParamAspect

Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header. Attackers gain HR administrator access to read payslips, salary history and employee personal data, download attachments, and modify or delete company-wide HR records.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Wukongopensource

Products

Wukong Hrm

CVE-2026-108702

CordysCRM through 1.9.3 Missing Authorization and Blind SSRF via Webhook Test

1Panel-dev CordysCRM through 1.9.3 lacks a PROCESS_SETTING permission check on POST /approval-flow/webhook/test, allowing any authenticated user to trigger server-side requests to attacker-supplied URLs. Attackers can redirect GET requests from a controlled host to bypass SSRFValidator and probe internal addresses through success or failure results.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

1panel-dev Fit2cloud

Products

Cordyscrm Cordys Crm

CVE-2026-108694

ConvertX through 0.19.0 Arbitrary File Read via Pandoc Converter

ConvertX through 0.19.0 contains an arbitrary file read vulnerability that allows authenticated users to read server files because src/converters/pandoc.ts invokes Pandoc without the --sandbox flag. Attackers can upload a reStructuredText document with an include directive naming an absolute path, convert it, and download output containing the referenced file's contents.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

C4illin

Products

Convertx

CVE-2026-108689

Wukong AICRM through 20260610 Authorization Bypass via User-Controlled Session ID in POST /chat/send

Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows authenticated users to write into other users' AI chat sessions by supplying an arbitrary sessionId to POST /chat/send. Attackers can append messages to a victim's conversation and receive streamed assistant replies built from the victim's last 20 messages, disclosing conversation content.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wukongopensource

Products

Wukong Aicrm

CVE-2026-108677

JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getUserByName

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in GET /sys/api/getUserByName that allows low-privileged authenticated users to retrieve any user's stored password value. Attackers can decrypt the AES-CBC protected response using the hard-coded key exposed by /sys/getEncryptedString to obtain administrators' password ciphertexts for offline guessing.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Jeecg

Products

Jeecg Boot Jeecgboot

CVE-2026-108672

JeecgBoot through 3.9.5 Authorization Bypass via /airag/video/listByUser

JeecgBoot through 3.9.5 contains an authorization bypass vulnerability in the getVideoRecords handler of VideoGenerationController that allows authenticated users to read other users' records via the userId parameter. Low-privileged attackers can supply another user id to retrieve their AI video generation history, including prompts, task ids, video URLs and cover URLs.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jeecg

Products

Jeecg Boot Jeecgboot

CVE-2026-108667

JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/revertRecycleBin

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to restore deleted AI prompt templates by calling the revertRecycleBin endpoint. Attackers can send PUT requests to /airag/prompts/revertRecycleBin with chosen template ids to clear deleted flags, undoing administrator removals.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jeecg

Products

Jeecg-boot Jeecg Boot

CVE-2026-108662

JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/deleteTenantPackUser

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove users from tenant product packs via PUT /sys/tenant/deleteTenantPackUser. Attackers can supply arbitrary userId and packId values in the request body to remove any user from any tenant's product pack, revoking permissions such as tenant administrator access.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jeecg

Products

Jeecg-boot Jeecg Boot

CVE-2026-108657

JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/passApply

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController passApply handler that allows any authenticated user to approve tenant administrator applications. Attackers can file a pending application via doApplyTenantPackUser and approve it through PUT /sys/tenant/passApply to gain tenant administrator pack permissions in any tenant.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Jeecg

Products

Jeecg-boot Jeecg Boot

CVE-2026-108652

JeecgBoot through 3.9.5 Missing Authorization via /sys/api/updateAvatar

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SystemApiController updateAvatar handler that allows any authenticated user to change other users' avatars. Low-privileged attackers can send PUT requests with a target user id and an arbitrary value, such as an attacker-controlled image URL, to replace administrators' avatars.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jeecg

Products

Jeecg Boot Jeecgboot

CVE-2026-108647

JeecgBoot through 3.9.5 Missing Authorization via /sys/checkRule/importExcel

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create validation rules through the SysCheckRuleController importExcel handler. Attackers can upload a crafted Excel workbook to bypass the system:checkRule:add permission and bulk-create system-wide encoding validation rules with arbitrary regular expression patterns.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jeecg Jeecgboot

Products

Jeecg-boot Jeecg Boot Jeecgboot

CVE-2026-108642

JeecgBoot through 3.9.5 IDOR via PUT /sys/sysAnnouncementSend/edit

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysAnnouncementSendController that allows authenticated users to modify other users' message delivery records. Attackers can obtain delivery ids from GET /sys/sysAnnouncementSend/list and submit edit requests that overwrite read flags, recipient ids, or linked announcements to hide messages from recipients.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jeecg

Products

Jeecg-boot Jeecg Boot