Threat database

CVE-2026-108821 is a medium severity SQL injection vulnerability in Tencent WeKnora versions 0.8.0 and 0.8.1. It affects the validateSubquery function in the internal/utils/inject.go file of the SQL Validator component. The vulnerability allows remote attackers to perform SQL injection attacks. A public exploit disclosure exists. Upgrading to version 0.8.2 addresses this issue.

CVE-2026-108820 is a medium severity vulnerability in agno-agi agno versions 3.0.0 through 3.1.1. It involves execution with unnecessary privileges in the member_agent.run function within the Delegation Feature component. The vulnerability can be exploited remotely without user interaction. A public exploit exists, but a fix is pending acceptance of a pull request.

CVE-2026-108819 is a medium severity vulnerability in agno-agi agno versions 3.0.0 through 3.1.1. It affects the exec function of the Agent Orchestration Layer component, where manipulation of the argument code leads to dynamically-managed code resources. The vulnerability can be exploited remotely without authentication. Although an exploit is publicly available, a fix is pending acceptance of a pull request.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Funa Ad Inserter ad-inserter allows Stored XSS.This issue affects Ad Inserter: from n/a through 2.8.18.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetMenu jet-menu allows Stored XSS.This issue affects JetMenu: from n/a through 3.0.5.

CVE-2026-108818 is a medium severity vulnerability in agno-agi agno versions 2.7.0 through 2.7.3 and 3.0.0 through 3.0.6. It involves missing authentication due to improper handling of the security_key argument in the get_authentication_dependency function within auth.py. The vulnerability can be exploited remotely without privileges or user interaction. Public exploit code exists, but no vendor response or patch is currently available.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.3.

CVE-2026-108817 is an OS command injection vulnerability in the agno-agi agno software up to version 3.0.9. The flaw exists in the function agno.CodingTools.run_shell within the CodingTools component, allowing remote attackers to manipulate the command argument and execute arbitrary OS commands. The vulnerability has been publicly disclosed and can be exploited remotely. Upgrading to version 3.0.10 resolves the issue.

CVE-2026-1907 is a SQL Injection vulnerability in Kong Enterprise Gateway's clustering communication logic when operating in Hybrid Mode. It can be exploited by sending specially crafted RPC requests to the Control Plane, requiring network access to the Control Plane’s clustering port and valid client credentials. This vulnerability affects multiple versions of Kong Enterprise Gateway prior to specific patched releases. The CVSS 4.0 score is 7.5, indicating a high severity issue.

CVE-2026-108816 is a medium severity code injection vulnerability in the agno-agi agno software up to version 3.0.6. The flaw exists in the run_python_code function of the python.py file within the PythonTools component. An attacker can remotely manipulate the code argument to inject and execute arbitrary code. Exploit code has been publicly disclosed, but there is no vendor response or patch available yet.

Missing Authorization vulnerability in WP Desk Flexible Subscriptions flexible-subscriptions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flexible Subscriptions: from n/a through 1.8.4.

CVE-2026-107863 is a missing authorization vulnerability in the Codection Products Restricted Users for WooCommerce plugin. It allows unauthorized users to exploit incorrectly configured access control security levels. The vulnerability affects versions from the initial release up to, but not including, version 0.8. The CVSS score is 5.3, indicating a medium severity impact primarily on integrity without confidentiality or availability impact.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DLX Plugins Custom Query Blocks post-type-archive-mapping allows Stored XSS.This issue affects Custom Query Blocks: from n/a through 5.6.0.

CVE-2026-108815 is a cross-site scripting (XSS) vulnerability found in idcCMS version 1.70. It affects an unspecified function within the file admin/member_deal.php. The vulnerability can be exploited remotely and requires low privileges with partial user interaction. The CVSS score is 5.1, indicating a medium severity level. There is no information about an available patch or vendor advisory. Exploit details have been publicly disclosed but no active exploitation in the wild is confirmed.

Red Hat Ansible Automation Platform 2.2 includes updated Ansible plug-ins for the Red Hat Developer Hub that enhance user experience and automation capabilities. A security advisory has been issued covering multiple CVEs including CVE-2026-47686. The advisory marks the severity as critical but does not provide detailed vulnerability descriptions, affected versions, or patches. No fixes or patches are currently available according to the vendor advisory.

CVE-2026-108814 is a medium severity SQL injection vulnerability in SEMCMS version 5.0. The flaw exists in an unspecified function within the SEMCMS_Banner.php file and can be exploited remotely without user interaction. The vendor has not responded to the disclosure, and no patch or remediation information is available. Exploit code has been published, but there are no confirmed reports of active exploitation in the wild.

Let’s Encrypt will reduce the default validity period of newly issued certificates to 64 days starting February 10, 2027, as a preparatory step towards a further reduction to 45 days planned for 2028. This change aligns with the CA/Browser Forum Baseline Requirements and aims to improve web security by making certificate revocation more efficient and limiting the impact of compromised certificates. The authorization reuse period will also be reduced progressively to comply with upcoming validation requirements. Let’s Encrypt recommends testing client compatibility with these changes and adjusting renewal timing accordingly.

Missing Authorization vulnerability in NOUS Ouvert Utile et Simple Event post event-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event post: from n/a through 6.1.1.

Missing Authorization vulnerability in VillaTheme TMDS tmds-dropshipping-for-temu-and-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TMDS: from n/a through 1.0.15.

Missing Authorization vulnerability in VideoWhisper.com VideoWhisper Site Manager for ChatGPT, Claude, Codex videowhisper-site-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VideoWhisper Site Manager for ChatGPT, Claude, Codex: from n/a through 1.2.10.