yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject contracts by calling POST /admin-api/crm/contract/check. Because CrmContractController lacks @PreAuthorize and approver checks are commented out, attackers can approve contracts to alter customer deal and purchase data or reject them to return products to stock.
lamp-cloud versions up to 5.10.1 have an insecure direct object reference vulnerability that allows authenticated users to access file attachments of other business objects by manipulating the bizId parameter. This exposure reveals file names, storage paths, MD5 hashes, and stored URLs. In default LOCAL storage configurations, these files can be accessed without authentication via the /anyTenant/file path.
CVE-2026-109167 is an insecure direct object reference vulnerability in TDuckCloud's tduck-survey-form version 6.0 and earlier. It allows authenticated users to overwrite other users' form themes by submitting another form's sequential theme ID with their own form key. This results in unauthorized modification of colors and image URLs of the victim's form theme.
lamp-cloud versions up to 5.10.1 contain an authorization bypass vulnerability where authenticated users can access storage URLs of other users' files by providing arbitrary file IDs. The vulnerability exists because the findUrlById handler in FileAnyoneController does not verify file ownership before returning access URLs, allowing unauthorized file access.
TDuckCloud tduck-survey-form versions up to 6.0 have a broken access control vulnerability allowing authenticated users to add fields to other users' survey forms via a specific POST request. This enables attackers to inject arbitrary fields onto a victim's public survey fill page by manipulating the formKey parameter in the request.
TDuckCloud tduck-survey-form versions up to 6.0 contain an insecure direct object reference vulnerability. Authenticated users can exploit this flaw by supplying arbitrary submission IDs and a user-controlled formKey to delete other users' form submissions. This vulnerability allows attackers to iterate through submission IDs and permanently delete submissions across the platform without proper authorization.
CVE-2026-108889 is a medium-severity vulnerability in Yungengxin Cloud Billing version 2024.11.28.11. It involves an exposed IOCTL interface with insufficient access control in the LWBilling64.sys library's IOCTL Process Termination function. The flaw allows a local attacker to manipulate the Pid argument, potentially leading to unauthorized actions. Exploit code has been published, but no vendor response or patch is currently available.
CVE-2026-93695 is a vulnerability in Progress ShareFile Storage Zones Controller version 5.12.6 and earlier. The FileCopyService component improperly constructs local temporary file paths using remote file identifiers without proper containment enforcement. This flaw allows an attacker to write arbitrary content to filesystem locations writable by the service account, potentially leading to remote code execution if the writable location is served by IIS and executable.
In Progress ShareFile Storage Zones Controller v5.12.6 and below, processing of queue items can send acknowledgements to an unvalidated callback URL, this behavior together with a race condition allows the attacker to cause FileCopyService to consume attacker-controlled metadata and content. Exploitation requires control over copy queue work and a race condition.
In Progress ShareFile Storage Zones Controller v5.12.6 and below, improper validation of outbound request destinations and parameters, unsafe JSONP response formatting, and insufficient validation on queue service can be chained by a remote unauthenticated attacker to issue server-side requests to unintended local handlers and perform unauthorized queue operations.
CVE-2026-108836 is a server-side request forgery (SSRF) vulnerability in Ollama versions 0.34.0 and 0.34.1. The flaw exists in the IsValid function within the Pull API component, allowing remote attackers to manipulate requests. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity). A public exploit disclosure exists. Upgrading to version 0.34.2 addresses the issue.
CVE-2026-108835 is a medium severity vulnerability in Yungengxin Yun Jia Security Guard up to version 2.7.1.9. It involves improper privilege management in the function sub_14000885C within the kgameprotect.sys library. The flaw can be triggered by manipulating the argument Pid, requiring local access to the system. The vendor has not responded to the disclosure, and no patch or remediation guidance is currently available.
CVE-2026-108834 is a cross-site scripting (XSS) vulnerability in Cairo-dock Glx-Dock affecting versions 3.0 through 3.4.0. The issue arises from improper handling of the 'p' parameter in the ww_page.php file's Query Parameter Handler component. This vulnerability can be exploited remotely and requires user interaction. Public exploit code is available, but no vendor response or patch has been provided.
mac-shell-mcp versions before 2.0.0 have an OS command injection vulnerability that allows MCP clients to bypass command whitelisting by injecting shell metacharacters into execute_command arguments. This enables execution of arbitrary commands as the server user without approval.
LavaLite CMS versions up to 10.1.2 have an authorization bypass vulnerability allowing authenticated low-privileged users to modify other users' accounts, including administrators, by exploiting a flaw in the AbstractRequest isWorkflow() check. This enables attackers to send PATCH requests to update user details such as name, email, password, status, or mobile number without proper authorization.
CVE-2026-108831 is a medium severity vulnerability in meetecho janus-gateway versions 1.4.0, 1.4.1, and 1.4.2. It involves hard-coded credentials in the Admin API component, specifically in the html/demos/admin.js file. This flaw allows remote attackers to exploit these credentials. The vulnerability has a CVSS 4.0 base score of 5.3, indicating a moderate risk. Public exploit details have been disclosed, but no known active exploitation in the wild has been reported. No official patch or remediation information is provided.
Canonical's primary websites, including ubuntu.com, canonical.com, the Ubuntu blog, and developer portal, were disrupted by a distributed denial-of-service (DDoS) attack in October 2026. This incident follows a previous, more disruptive DDoS attack in April 2026 that also affected additional services such as Launchpad and the Snap Store. The October attack caused downtime of approximately four hours, with most affected services restored shortly after. No detailed information on the attack's size or origin has been publicly disclosed, and no group has claimed responsibility for the recent incident. Developer-facing services like Launchpad and the Snap Store were not impacted in the October attack. The April attack was attributed to a hacktivist group, but it is unclear if the two incidents are related.
Microsoft has announced that Windows 11 23H2 Enterprise, Education, and IoT Enterprise editions will reach end of support in 30 days, after which these systems will no longer receive security updates.
CVE-2026-108830 is a race condition vulnerability in meetecho janus-gateway versions 1.4.0, 1.4.1, and 1.4.2 affecting the VideoRoom component. The flaw allows remote exploitation but requires high attack complexity and limited privileges. The vendor has released a patch to fix this issue.