CVE-2026-108800 is a cross-site request forgery (CSRF) vulnerability in yangzongzhuan RuoYi version 4.8.3. The vulnerability involves an unspecified function that allows remote attackers to perform unauthorized actions via CSRF. The vendor has not responded to disclosure attempts, and no patch or remediation information is available.
CVE-2026-108799 is a SQL injection vulnerability in jackq XCMS affecting the Password Recovery Mail Endpoint. The flaw exists in the PublicController::sendFindPwdMail function, allowing remote attackers to manipulate the email argument and execute SQL injection attacks. The vulnerability has a CVSS score of 6.9 (medium severity) and has been publicly disclosed. No patch or remediation information is currently available.
CVE-2026-108798 is a vulnerability in ZKTeco BioTime 9.5.6 Build 20260130.3206 involving the use of a hard-coded cryptographic key. This flaw allows remote attackers to exploit the cryptographic weakness. The issue is addressed by upgrading to version 9.5.6 Build 3623.
CVE-2026-108797 is an authorization bypass vulnerability in ZKTeco BioTime version 9.5.6 Build 20260130.3206 affecting the Employee REST API endpoint /personnel/api/employees/. This flaw allows remote attackers with low privileges to bypass authorization controls. The issue is resolved by upgrading to version 9.5.6 Build 3623.
CVE-2026-108796 is an authorization bypass vulnerability in ZKTeco BioTime version 9.5.6 Build 20260130.3206 affecting the Biometric Data Endpoint component. The flaw involves manipulation of the emp_code argument in the /iclock/finger_data/ file, allowing remote attackers to bypass authorization controls. The issue is mitigated by upgrading to version 9.5.6 Build 3623.
CVE-2026-108795 is a medium severity vulnerability in ZKTeco BioTime 9.5.6 Build 20260130.3206 involving improper access controls in the System Settings API endpoint /base/api/systemSettings. The flaw allows remote attackers to manipulate the system due to insufficient access restrictions. Upgrading to version 9.5.6 Build 3623 resolves the issue.
CVE-2026-108985 is a high severity vulnerability in the sahlberg libnfs library affecting versions 0 through 6.0.2. It involves an out-of-bounds write in the ZDR decoding functionality where the maxsize parameter supplied by the caller is not properly enforced. This flaw exists in functions libnfs_zdr_bytes(), libnfs_zdr_string(), and libnfs_zdr_array() within lib/libnfs-zdr.c. The vulnerability can lead to a denial of service due to an out-of-bounds write but does not impact confidentiality.
CVE-2026-108794 is a medium severity SQL injection vulnerability in ZKTeco BioTime version 9.5.6 Build 20260130.3206. The flaw exists in an unspecified functionality of the /base/api/v1.0/systemSettings/db_migrate_setting/ endpoint related to database migration. This vulnerability allows remote attackers to perform SQL injection attacks. The issue is resolved by upgrading to version 9.5.6 Build 3623.
GV-E-Map Server version 18.2.0A contains a hard-coded plaintext database password embedded within an application component. This credential can be extracted through static analysis of the distributed binary and may also be exposed in process memory during runtime. The vulnerability is identified as CWE-798 (Use of Hard-coded Credentials) and has a CVSS 3.1 score of 6.2 (medium severity). There is no information about an available patch or official remediation from the vendor.
CVE-2026-108791 is a path traversal vulnerability in westboy CicadasCMS affecting the TemplateController.input function in the Template Management component. The vulnerability allows remote attackers to manipulate the filePath argument to traverse directories. The vendor has not responded to the disclosure, and no patch or remediation information is available. The vulnerability has a CVSS 4.0 score of 5.3 (medium severity).
VeraCrypt 1.26.29 (FUSE-T build) on macOS has an incomplete cleanup vulnerability where the FUSE-T auxiliary service and related helper processes are not terminated after volume dismount. This causes the decrypted volume image to remain accessible via a loopback SMB session, allowing local users or processes to remount and access decrypted data without the passphrase. The macFUSE build is not affected.
CVE-2026-108790 is a path traversal vulnerability in westboy CicadasCMS affecting the TemplateController.save function in the Backend Template Editor component. The flaw allows remote attackers to manipulate file paths, potentially accessing unauthorized files. The vendor has not responded to the disclosure, and no patch or remediation guidance is currently available. The vulnerability has a medium severity with a CVSS 4.0 score of 5.1. Public exploit code has been released, increasing the risk of exploitation.
The ngx_cache_purge module before version 3.0.4 allows file deletion via a symbolic link (symlink) attack when nginx and the served application run under the same user account. This occurs because the module follows symlinks during cache purge operations, relying on nginx's ngx_walk_tree() which uses stat() and thus follows symlinks. Version 3.0.4 fixes the issue for symlinks created at arbitrary earlier times but does not address a time-of-check to time-of-use (TOCTOU) race condition.
CVE-2026-108789 is a medium-severity vulnerability in deepseek-ai deepseek-harness versions 0.1.1-rc.0, 0.1.1-rc.1, and 0.1.1-rc.2. It affects the agent function of the dsh-workflow-worker-thread component and allows remote enforcement of behavioral workflow manipulation. Public exploit code exists, but no known exploitation in the wild has been reported. The vendor has not responded to disclosure attempts, and no patch or remediation guidance is currently available.
CVE-2026-108788 is a medium severity vulnerability in deepseek-ai deepseek-harness versions 0.1.1-rc.0, 0.1.1-rc.1, and 0.1.1-rc.2. It involves a sandbox issue in the spawn function of the Sandbox component, triggered by manipulation of the Profile argument. The vulnerability can be exploited locally. The vendor has not responded to disclosure, and no patch is currently available. The exploit has been publicly disclosed but is not known to be used in the wild.
This entry is a daily update from the SANS Internet Storm Center (ISC) dated October 12, 2026. It provides a link to a podcast episode but contains no specific technical details, vulnerabilities, or threat information.
CVE-2026-108787 is a server-side request forgery (SSRF) vulnerability in houtini-ai voice-analyser-mcp versions 2.1.0 and 2.1.1. The flaw exists in the fetch function of src/utils/crawler.ts within the collect_corpus component, where manipulation of the sitemap_url argument allows SSRF. Remote exploitation is possible, and a public exploit is available. The vendor has not responded to disclosure attempts. The CVSS 4.0 score is 5.3, indicating medium severity.
CVE-2026-108786 is a server-side request forgery (SSRF) vulnerability in the houtini-ai seo-crawler-mcp product, specifically in the run_seo_audit function of src/core/CrawlOrchestrator.ts. It affects versions 2.1.0 through 2.1.5. The vulnerability allows remote attackers to manipulate server requests, potentially causing unauthorized requests to internal or external systems. The vendor has not responded to the disclosure, and no patch or fix is currently available. The CVSS 4.0 score rates this as a medium severity issue.
A sophisticated phishing campaign targets YouTube content creators by impersonating well-known brands such as Hollyland, Nike, and Spotify. Attackers send personalized sponsorship emails referencing specific videos from the creators' channels, directing them to fake platforms that mimic legitimate campaign dashboards. The scam culminates in a Google sign-in prompt that either steals credentials directly or requests excessive permissions. Compromised accounts are then locked by changing recovery options and used to propagate further scams to followers. This modular campaign operates globally, with confirmed targeting in Peru, Japan, and English-speaking regions, using multiple domains with consistent design and functionality.
CVE-2026-66086 is a high-severity stack-based buffer overflow vulnerability in the modem OTA stack of Unisoc (Shanghai) Technologies Co., Ltd. modems. It arises from improper validation of scheduling information in SIB1 messages. Exploitation could allow remote code execution or denial of service without requiring additional privileges.
