| CVE ID | Title | Vendor | Product | Severity | CVSS Score | Published At | AI Analysis |
|---|---|---|---|---|---|---|---|
| CVE-2026-55681 | WeGIA: SQL Injection in html/matPat/restaurar_produto_desocultar.php via id_produto parameter | LabRedesCefetRJ | WeGIA | High | 8.8 | 2026-10-14 19:44:57 | Deep Dive |
| CVE-2026-55679 | WeGIA: Pre-auth Installer Injection Chain Enables Command Execution and Arbitrary PHP Code Injection | LabRedesCefetRJ | WeGIA | Medium | 6.5 | 2026-10-14 19:44:02 | Deep Dive |
| CVE-2026-55680 | WeGIA: Unauthenticated SQL Injection in cadastro_cobranca.php via "codigo" parameter | LabRedesCefetRJ | WeGIA | Critical | 9.8 | 2026-10-14 19:42:22 | Deep Dive |
| CVE-2026-55683 | WeGIA: SQL Injection in html/socio/sistema/cadastro_cobranca.php | LabRedesCefetRJ | WeGIA | Critical | 9.8 | 2026-10-14 19:41:34 | Deep Dive |
| CVE-2026-110310 | RSA PKCS#1 v1.5 padding oracle via legacy envelope key format downgrade in Amazon S3 Encryption Client for .NET | Amazon | Amazon.Extensions.S3.Encryption | Medium | 5.3 | 2026-10-14 19:37:48 | Deep Dive |
| CVE-2026-102980 | Plane: Cross-Project Page Content Disclosure via PageVersionEndpoint Missing Project Scope | makeplane | plane | Medium | 6.5 | 2026-10-14 19:33:08 | Deep Dive |
| CVE-2026-102985 | Plane: Any project member can modify (deactivate) other members' records | makeplane | plane | Medium | 6.5 | 2026-10-14 19:31:13 | Deep Dive |
| CVE-2026-110668 | cemtan sar2html sar2html.py index sql injection | cemtan | sar2html | High | 7.3 | 2026-10-14 19:30:14 | Deep Dive |
| CVE-2026-102986 | Plane: Any Authenticated User Can Upload and Delete Assets in Any Published Project via /api/public/assets/v2/anchor/{anchor}/ | makeplane | plane | High | 8.1 | 2026-10-14 19:29:04 | Deep Dive |
| CVE-2026-55382 | InvoiceShelf: Cross-company read/modify/delete of notes via missing company scope in NotePolicy (BOLA/IDOR) | InvoiceShelf | InvoiceShelf | High | 7.6 | 2026-10-14 19:27:00 | Deep Dive |
| CVE-2026-55385 | InvoiceShelf: SSRF via unvalidated Gotenberg PDF renderer host in PDF configuration | InvoiceShelf | InvoiceShelf | Medium | 6.8 | 2026-10-14 19:25:32 | Deep Dive |
| CVE-2026-55381 | InvoiceShelf: IDOR in InvoiceShelf estimate-to-invoice conversion allows any company user to read and tamper with other companies' estimates | InvoiceShelf | InvoiceShelf | High | 7.1 | 2026-10-14 19:24:20 | Deep Dive |
| CVE-2026-55383 | InvoiceShelf: Public EmailLog token type confusion allows cross-company invoice disclosure | InvoiceShelf | InvoiceShelf | High | 8.2 | 2026-10-14 19:23:34 | Deep Dive |
| CVE-2026-55387 | InvoiceShelf bulk deletion lacks company scoping | InvoiceShelf | InvoiceShelf | High | 7.2 | 2026-10-14 19:21:50 | Deep Dive |
| CVE-2026-55386 | InvoiceShelf ORDER BY SQL injection through orderByField | InvoiceShelf | InvoiceShelf | High | 7.1 | 2026-10-14 19:18:57 | Deep Dive |
| CVE-2026-55384 | InvoiceShelf trusts client-supplied document totals | InvoiceShelf | InvoiceShelf | Medium | 5.3 | 2026-10-14 19:17:25 | Deep Dive |
| CVE-2026-54702 | Markdown Preview Enhanced: Blind Command Dispatch via Unvalidated Webview Message Handler | shd101wyy | vscode-markdown-preview-enhanced | High | 7.3 | 2026-10-14 19:13:59 | Deep Dive |
| CVE-2026-54701 | Markdown Preview Enhanced: Stored XSS via Unsanitized `.crossnote/head.html` Injection in Webview | shd101wyy | vscode-markdown-preview-enhanced | Medium | 6.9 | 2026-10-14 19:11:52 | Deep Dive |
| CVE-2026-54703 | Markdown Preview Enhanced: Arbitrary File Write via updateMarkdown Command Without Path Validation | shd101wyy | vscode-markdown-preview-enhanced | Medium | 5.8 | 2026-10-14 19:09:50 | Deep Dive |
| CVE-2026-54566 | Markdown Preview Enhanced: Remote Code Execution via VM Sandbox Escape in `.crossnote/config.js` and `.crossnote/parser.js` | shd101wyy | vscode-markdown-preview-enhanced | High | 8.5 | 2026-10-14 19:08:44 | Deep Dive |