CVE-2026-108701

1Panel-dev CordysCRM before 1.9.2 Missing Authorization via POST /contract/sort

1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability in the ContractController sortModule handler for POST /contract/sort, which lacks any permission annotation. Authenticated users without contract update permission can supply a dragNodeId, stage and field values to modify any contract, including contracts in other organizations.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

1panel-dev Fit2cloud

Products

Cordyscrm Cordys Crm

CVE-2026-108699

hyper-mcp through 0.8.3 Improper Signature Verification of OCI WebAssembly Plugins

hyper-mcp through 0.8.3 contains an improper signature verification vulnerability that allows attackers to load malicious WebAssembly plugins because cosign_verify_args() accepts any signer identity and OIDC issuer by default. Attackers controlling a plugin image reference can sign a malicious image with a free Sigstore keyless certificate to execute plugins with configured host, filesystem, and environment capabilities.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Hyper-mcp-rs

Products

Hyper-mcp

CVE-2026-108681

zhayujie CowAgent Web Console web_channel.py denial of service

A security flaw has been discovered in zhayujie CowAgent up to 2.1.7. Impacted is an unknown function of the file channel/web/web_channel.py of the component Web Console. The manipulation of the argument session_id results in denial of service. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. Version 2.1.7 (commit dec28324) only partly mitigates via a 512MB body cap. The vendor was contacted early about this disclosure.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Zhayujie

Products

Cowagent

CVE-2026-108572

Casdoor Proxy Validation cas.go CasP3ProxyValidate server-side request forgery

A security vulnerability has been detected in Casdoor up to 3.164.0/4.10.0. Affected is the function CasP3ProxyValidate of the file controllers/cas.go of the component Proxy Validation. Such manipulation of the argument pgtUrl leads to server-side request forgery. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. Upgrading to version 4.11.0 is able to address this issue. The name of the patch is 03c6c9aaa2eda5b085ce128ce0d60b34094efbd9/ada08ecd10cbf158f593dee23a8bab63efecf995. It is advisable to upgrade the affected component.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Casdoor

Products

Casdoor

CVE-2026-108568

InstantSoft icms2 Billing paypal.php validatePaypalOrder data authenticity

A vulnerability was determined in InstantSoft icms2 up to 2.18.2. The affected element is the function validatePaypalOrder of the file system/controllers/billing/actions/paypal.php of the component Billing Module. Executing a manipulation of the argument bid/sig can lead to insufficient verification of data authenticity. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Instantsoft

Products

Icms2

CVE-2026-108543

ag2ai ag2 UserProxyAgent os.path.join path traversal

A vulnerability was determined in ag2ai ag2 up to 0.13.4. Affected by this issue is the function os.path.join of the component UserProxyAgent. This manipulation of the argument filename causes path traversal. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ag2ai

Products

Ag2

CVE-2026-108539

GPAC MP4Box filter_queue.c gf_fq_pop use after free

A vulnerability was detected in GPAC up to 26.07.0. This affects the function gf_fq_pop of the file filter_core/filter_queue.c of the component MP4Box. Performing a manipulation results in use after free. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Gpac

Products

Gpac

CVE-2026-108521

Studio-Saelix Sencho Add Remote Node API Endpoint validation.ts isValidRemoteUrl server-side request forgery

A vulnerability has been found in Studio-Saelix Sencho up to 0.97.1. Affected by this issue is the function isValidRemoteUrl of the file backend/src/utils/validation.ts of the component Add Remote Node API Endpoint. Such manipulation leads to server-side request forgery. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor confirms: "The node API URL could be configured by an authenticated user with node-management permission and used to initiate server-side requests. [T]he report demonstrates server-side request capability but not arbitrary internal response exfiltration."

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Studio-saelix

Products

Sencho

CVE-2026-106047

Path Traversal in Ivanti Xtraction Allows Arbitrary File Read

A Path Traversal vulnerability in the template export functionality of Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to read arbitrary files.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Ivanti

Products

Xtraction

CVE-2026-106043

Remote Unauthenticated Modification of Trusted Site Entries in Ivanti Xtraction

A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote unauthenticated attacker to create, modify, trusted site.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Ivanti

Products

Xtraction

CVE-2026-106035

Ivanti Xtraction Cloud Sync Log Files Expose Partial Database Passwords

An Information Exposure Through Log Files vulnerability in Ivanti Xtraction Cloud Sync before version 2026.4 allows a remote authenticated attacker to disclose partial SQL database passwords through application log.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Ivanti

Products

Xtraction

CVE-2026-106034

Path Traversal Allows Remote Authenticated Creation and Modification of Arbitrary Directories in Ivanti Xtraction

A Path Traversal vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to create, modify, arbitrary directories the host file system.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed

Vendors

Ivanti

Products

Xtraction

CVE-2026-109828

libsndfile WAV Parsing wavlike.c wavlike_subchunk_parse uninitialized variable

A vulnerability was found in libsndfile up to 1.2.2. This issue affects the function wavlike_subchunk_parse of the file src/wavlike.c of the component WAV Parsing. Performing a manipulation results in use of uninitialized variable. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Libsndfile

Products

Libsndfile

CVE-2026-74030

Wazuh 3.9.0 before 4.14.8 Memory Exhaustion via SCA YAML Alias Expansion

Wazuh from 3.9.0 before 4.14.8 contains an uncontrolled YAML alias expansion vulnerability in yaml2json_node that allows a manager-controlled policy to exhaust agent memory. Attackers controlling the manager can push a small SCA policy with nested aliases via merged.mg to OOM-kill wazuh-modulesd on every agent in a group.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Wazuh

Products

Wazuh Wazuh-agent Wazuh-manager

CVE-2026-106436

Application denial of service and data truncation via unchecked BSON append failures in MongoDB PHP Driver

The BSON encoder in the MongoDB PHP Driver does not check some return values after a document exceeds libbson's size limit. This can leave the encoder in an invalid state. An unauthenticated actor who can cause an affected application to encode an unusually large data structure can terminate the PHP worker or cause the resulting document to omit fields. No MongoDB server connection or database authentication is required.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

Php Driver

CVE-2026-106432

Heap buffer overflow via 32-bit string-length truncation in MongoDB PHP Driver

The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. When an affected application encodes a string near 4 GiB, the allocation size can wrap while the copy operation uses the original length. The resulting heap buffer overflow can corrupt process memory or terminate the PHP process. Reaching this issue requires a non-default runtime configuration that permits multi-gigabyte values. No MongoDB server interaction is required.

CVSS 4.0 · 2 Low EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

Php Driver

CVE-2026-92702

Cocos AI: Intra-handshake attested TLS implementation can accept Evidence with nil, empty, or omitted reportData in the AMD SEV-SNP path

Cocos AI is a confidential computing system for AI. In Cocos AI 0.8.2 and earlier, VerifyAttestationReportTLS in the AMD SEV-SNP verifier sets Policy.ReportData only when its caller supplies non-empty expected reportData. A relying-party integration that passes nil or empty expected reportData while relying on that value for current-session freshness can therefore accept SEV-SNP evidence unrelated to the current connection and make a trust, authorization, or application-data release decision for an unintended attestation context. This issue was fixed in Cocos AI 0.9.0 by removing the affected verifier path as part of the migration to post-handshake attestation.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Ultravioletrs

Products

Cocos

CVE-2026-92701

Cocos AI: Intra-handshake attested TLS implementation is vulnerable to session-misbinding attacks for Intel TDX verifier path

Cocos AI is a confidential computing system for AI. In Cocos AI 0.8.2 and earlier, VerifTeeAttestation in the Intel TDX aTLS verifier receives an expected current-session value but does not apply it to TdQuoteBodyPolicy.ReportData before validating TDX QuoteV4 evidence. The verifier can consequently accept structurally valid evidence containing mismatched or reused REPORT_DATA for the current TLS session, causing the relying party to release application data or make a trust or authorization decision for an unrelated attestation context. This issue was fixed in Cocos AI 0.9.0 by removing the affected verifier path as part of the migration to post-handshake attestation.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Ultravioletrs

Products

Cocos

CVE-2026-84290

Security vulnerability affects the Windows S-TAP component as part of IBM Guardium Data Protection

IBM Guardium Data Protection 12.0, 12.1, 12.2 is affected by an improper validation of user-supplied pointers in the WfpMonitor kernel driver. Certain METHOD_NEITHER IOCTL handlers dereference user-controlled pointers without adequate probing and exception handling, potentially allowing a privileged local attacker to cause a system crash or perform limited kernel-memory reads.

CVSS 3.1 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm Microsoft

Products

Guardium Data Protection Windows

CVE-2026-88834

Busybox: busybox: httpd user existence oracle in non-default shadow-disabled builds

A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limited to username enumeration and requires non-default compile options or uncommon password file states; default BusyBox builds with shadow password support are not affected.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Busybox Redhat

Products

Busybox Hummingbird