| CVE ID | Title | Vendor | Product | Severity | CVSS Score | Published At | AI Analysis |
|---|---|---|---|---|---|---|---|
| CVE-2026-84314 | Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint | 0xJacky | nginx-ui | High | 8.7 | 2026-10-12 20:47:52 | Deep Dive |
| CVE-2026-108930 | Netcore NR268 DDNS ddns_wan_list_show.cgi ddns_wan_list_show information disclosure | Netcore | NR268 | Low | 2.7 | 2026-10-12 20:45:13 | Deep Dive |
| CVE-2026-84320 | Nginx UI: Auto backup name allows path traversal outside validated storage path | 0xJacky | nginx-ui | Medium | 6.3 | 2026-10-12 20:44:39 | Deep Dive |
| CVE-2026-109427 | Telegram-Stremio 5.1.0 Broken Object Authorization via Stream IDs | weebzone | Telegram-Stremio | Medium | 6.5 | 2026-10-12 20:35:50 | Deep Dive |
| CVE-2026-109426 | Telegram-Stremio 5.1.0 Insecure Session Storage via encode_string | weebzone | Telegram-Stremio | High | 7.5 | 2026-10-12 20:34:19 | Deep Dive |
| CVE-2026-108929 | Netcore NR268 DDNS DDNSset.cgi execvp argument injection | Netcore | NR268 | Critical | 9.9 | 2026-10-12 20:30:18 | Deep Dive |
| CVE-2026-84318 | Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCE | 0xJacky | nginx-ui | High | 8.8 | 2026-10-12 20:20:19 | Deep Dive |
| CVE-2026-108928 | itsourcecode Online Admission System sum.php sql injection | itsourcecode | Online Admission System | Medium | 6.3 | 2026-10-12 20:15:14 | Deep Dive |
| CVE-2026-97691 | Convex: Unauthorized data access | get-convex | convex-backend | Medium | 4.3 | 2026-10-12 20:15:03 | Deep Dive |
| CVE-2026-106495 | Backstage: Improper access control in backend action invocation | backstage | backstage | Medium | 4.3 | 2026-10-12 20:11:08 | Deep Dive |
| CVE-2026-92120 | Apache Allura: Oauth1 Replay Attack | Apache Software Foundation | Apache Allura | - | - | 2026-10-12 20:08:15 | Deep Dive |
| CVE-2026-92119 | Apache Allura: REST API Mass Assignment | Apache Software Foundation | Apache Allura | - | - | 2026-10-12 20:06:53 | Deep Dive |
| CVE-2026-84315 | Nginx UI OTP secure-session step-up is missing on sensitive mutation routes | 0xJacky | nginx-ui | High | 8.3 | 2026-10-12 20:06:50 | Deep Dive |
| CVE-2026-92116 | Apache Allura: OAuth1 missing callback validation | Apache Software Foundation | Apache Allura | - | - | 2026-10-12 20:04:29 | Deep Dive |
| CVE-2026-41508 | OWASP Coraza WAF: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling | corazawaf | coraza | Medium | 5.8 | 2026-10-12 20:01:09 | Deep Dive |
| CVE-2026-108927 | itsourcecode Baptism Information Management System pbaptism.php sql injection | itsourcecode | Baptism Information Management System | Medium | 6.3 | 2026-10-12 20:00:17 | Deep Dive |
| CVE-2026-41504 | OWASP Coraza WAF: Native audit-log format allows CRLF injection and log forgery via request body and header fields | corazawaf | coraza | Medium | 5.8 | 2026-10-12 19:59:46 | Deep Dive |
| CVE-2026-104774 | OWASP Coraza WAF: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass | corazawaf | coraza | Medium | 5.8 | 2026-10-12 19:58:39 | Deep Dive |
| CVE-2026-41510 | OWASP Coraza WAF: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding | corazawaf | coraza | High | 7.2 | 2026-10-12 19:57:40 | Deep Dive |
| CVE-2026-109425 | Tink-go 2.8.0 Keyset Validation Bypass via NewHandleWithNoSecrets | tink-crypto | tink-go | Medium | 5.3 | 2026-10-12 19:55:37 | Deep Dive |