| CVE ID | Title | Vendor | Product | Severity | CVSS Score | Published At | AI Analysis |
|---|---|---|---|---|---|---|---|
| CVE-2026-102354 | BentoPDF: SSRF via DNS Rebinding (TOCTOU) in Cloudflare CORS Proxy Worker | alam00000 | bentopdf | Medium | 6.8 | 2026-10-14 19:00:14 | Deep Dive |
| CVE-2026-102899 | Sentry: Improper authentication on SAML SSO process allows user identity linking | getsentry | sentry | High | 7.6 | 2026-10-14 18:57:51 | Deep Dive |
| CVE-2026-102471 | CRLF header injection in vertx-mail-client allows manipulation of outgoing SMTP messages | Eclipse Foundation | Eclipse Vert.x | Medium | 6.9 | 2026-10-14 18:50:22 | Deep Dive |
| CVE-2026-82402 | Gogs: Open Redirect in /redirect endpoint via backslash bypass in `IsSameSite` | gogs | gogs | Medium | 5.3 | 2026-10-14 18:49:20 | Deep Dive |
| CVE-2026-110775 | Nexent through 2.7.0 Cross-Tenant Knowledge-Base File Read via check_file_access | ModelEngine-Group | nexent | Medium | 6.5 | 2026-10-14 18:48:05 | Deep Dive |
| CVE-2026-110774 | Blinko through 1.8.8 Private Attachment Read via /api/file Route | blinkospace | blinko | Medium | 5.3 | 2026-10-14 18:48:03 | Deep Dive |
| CVE-2026-110773 | GrowChief through 0.3.0 Missing Authorization via /users/all-users Endpoint | growchief | growchief | Medium | 4.3 | 2026-10-14 18:48:01 | Deep Dive |
| CVE-2026-110772 | Sure 0.7.0 through 0.7.6-alpha.6 Missing Authorization via Transaction Bulk Update | we-promise | sure | Medium | 4.3 | 2026-10-14 18:47:59 | Deep Dive |
| CVE-2026-110771 | Shopizer through 3.2.5 Authorization Bypass via Product Review customerId | Shopizer | Shopizer | Medium | 4.3 | 2026-10-14 18:47:57 | Deep Dive |
| CVE-2026-110770 | Databasus 3.7.0 through 3.61.0 Account Takeover via Password Reset Brute-Force | databasus | databasus | High | 8.1 | 2026-10-14 18:47:55 | Deep Dive |
| CVE-2026-110769 | holaOS through 2026.822.1 Missing Authorization in Channel-Gateway Connectors | holaboss-ai | holaOS | High | 8.6 | 2026-10-14 18:47:53 | Deep Dive |
| CVE-2026-110768 | holaOS through 2026.822.1 Authorization Bypass via Telegram Connector Username Allowlist | holaboss-ai | holaOS | Medium | 4.8 | 2026-10-14 18:47:51 | Deep Dive |
| CVE-2026-110767 | Gitingest through 0.3.1 Arbitrary File Read via Symlink in Blob Ingestion | coderamp-labs | gitingest | High | 7.5 | 2026-10-14 18:47:45 | Deep Dive |
| CVE-2026-110766 | Colanode Server through 0.4.7 Path Traversal via Avatar Download Route | colanode | colanode | Medium | 4.3 | 2026-10-14 18:47:43 | Deep Dive |
| CVE-2026-110765 | FlexPrice through 2.1.38 QuickBooks Webhook Signature Verification Bypass | flexprice | flexprice | Medium | 5.9 | 2026-10-14 18:47:42 | Deep Dive |
| CVE-2026-110764 | AstronRPA through 1.1.6 Cross-Tenant File Disclosure via /file/download | iflytek | astron-rpa | Medium | 5.3 | 2026-10-14 18:47:40 | Deep Dive |
| CVE-2026-110763 | lamp-boot 4.16.0-java17 through 4.21.2-java17 IDOR via /anyone/findDeptByCompany | zuihou | lamp-boot | Medium | 4.3 | 2026-10-14 18:47:39 | Deep Dive |
| CVE-2026-110762 | bbPress before 2.6.19 Information Disclosure via BuddyPress Activity Stream | bbPress | bbPress | Low | 3.7 | 2026-10-14 18:47:38 | Deep Dive |
| CVE-2026-110761 | ILIAS before 9.24, 10.12, and 11.5 PHP Object Injection via Test Results Import | ILIAS-eLearning e.V. | ILIAS | High | 8.8 | 2026-10-14 18:47:36 | Deep Dive |
| CVE-2026-102755 | DataEase Datasource/Dataset Folder Name Stored Cross-Site Scripting | dataease | dataease | Medium | 5.1 | 2026-10-14 18:45:25 | Deep Dive |