{"vulnerability": "CVE-2026-10868", "sightings": [{"uuid": "90ce49a1-f7d0-4d40-911c-68679a3ff317", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-10868", "type": "seen", "source": "https://www.acn.gov.it/portale/w/rilevata-vulnerabilita-in-misp-project-1", "content": "", "creation_timestamp": "2026-06-05T06:28:56.000000Z"}, {"uuid": "d9981dac-7d38-4b16-8d6d-c3138d5bf16f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108680", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117419148234103045", "content": "CVE-2026-108680 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendTemplateAnnouncement JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to send template notifications by calling POST /sys/api/sendTemplateAnnouncement. Low-privileged attackers can supply forged sender, recipients, title, and template parameters to deliver messages appearing to come from admin or system accounts.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108680https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_sys_api_credential_family.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/api/controller/SystemApiController.java#L62-L65https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sys-api-sendtemplateannouncement#jeecgboot #JeecgBoot#CVE_2026_108680#bot", "creation_timestamp": "2026-10-10T23:13:35.430660Z"}, {"uuid": "fc8abe52-a276-4fdb-bd70-42516600ddb7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108688", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117419752349644679", "content": "CVE-2026-108688 Eladmin through 2.7 Missing Authorization via /api/localStorage/pictures Upload Eladmin through 2.7 contains a missing authorization vulnerability in the LocalStorageController uploadPicture handler that allows low-privileged authenticated users to bypass the storage:add permission. Attackers can send POST requests with image-named files to /api/localStorage/pictures to write files into server local storage and disclose absolute server paths.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108688https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/eladmin/poc_localStorage_pictures.pyhttps://github.com/elunez/eladmin/blob/39d480938d27a9630d632578c3ef60cf3647a79e/eladmin-tools/src/main/java/me/zhengjie/rest/LocalStorageController.java#L72-L82https://www.vulncheck.com/advisories/eladmin-through-2.7-missing-authorization-via-api-localstorage-pictures-upload#elunez #eladmin#CVE_2026_108688#bot", "creation_timestamp": "2026-10-11T01:47:13.556836Z"}, {"uuid": "1047602f-fd3e-4e2b-bd78-a9dbc83fa007", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108689", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117419754995494583", "content": "CVE-2026-108689 Wukong AICRM through 20260610 Authorization Bypass via User-Controlled Session ID in POST /chat/send Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows authenticated users to write into other users' AI chat sessions by supplying an arbitrary sessionId to POST /chat/send. Attackers can append messages to a victim's conversation and receive streamed assistant replies built from the victim's last 20 messages, disclosing conversation content.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108689https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/Wukong-AICRM/poc_chat_send.pyhttps://github.com/WuKongOpenSource/Wukong-AICRM/blob/cdd1fbc3187d2bcbf2cdf2be7d50c988959da356/backend/src/main/java/com/kakarote/ai_crm/service/impl/ChatServiceImpl.java#L270-L283https://www.vulncheck.com/advisories/wukong-aicrm-through-20260610-authorization-bypass-via-user-controlled-session-id-in-post-chat-send#WuKongOpenSource #WukongAICRM#CVE_2026_108689#bot", "creation_timestamp": "2026-10-11T01:47:53.865069Z"}, {"uuid": "02f7fc79-ab14-4422-8ebd-3d2e5f55d6eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108681", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117422488037049128", "content": "CVE-2026-108681 zhayujie CowAgent Web Console web_channel.py denial of service A security flaw has been discovered in zhayujie CowAgent up to 2.1.7. Impacted is an unknown function of the file channel/web/web_channel.py of the component Web Console. The manipulation of the argument session_id results in denial of service. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. Version 2.1.7 (commit dec28324) only partly mitigates via a 512MB body cap. The vendor was contacted early about this disclosure.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108681https://vuldb.com/vuln/416389https://vuldb.com/vuln/416389/ctihttps://vuldb.com/cve/CVE-2026-108681https://vuldb.com/submit/957910https://github.com/hackerguopeng/cve/tree/main/CowAgent_Web_Message_Queue_Thread_SSE_DoS_Report#zhayujie #CowAgent#CVE_2026_108681#bot", "creation_timestamp": "2026-10-11T13:22:56.632735Z"}, {"uuid": "d5b7c4f8-7b30-446b-ad14-a171207e67c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108682", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117422747920829234", "content": "CVE-2026-108682 zhayujie CowAgent Web Console upload read denial of service A weakness has been identified in zhayujie CowAgent up to 2.1.6. The affected element is the function read of the file /upload of the component Web Console. This manipulation causes denial of service. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108682https://vuldb.com/vuln/416390https://vuldb.com/vuln/416390/ctihttps://vuldb.com/cve/CVE-2026-108682https://vuldb.com/submit/958012https://github.com/hackerguopeng/cve/tree/main/CowAgent_Web_Upload_File_Directory_DoS_Report#zhayujie #CowAgent#CVE_2026_108682#bot", "creation_timestamp": "2026-10-11T14:29:02.161284Z"}, {"uuid": "b46b24ef-b180-44cf-879e-cce85ab13839", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108683", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117422791233567682", "content": "CVE-2026-108683 zhayujie CowAgent Media Download memory allocation A security vulnerability has been detected in zhayujie CowAgent up to 2.1.9. The impacted element is an unknown function of the component Media Download Handler. Such manipulation leads to uncontrolled memory allocation. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.2.0 is sufficient to resolve this issue. The name of the patch is b7967210268fc4c0afea1078223e74e7e96a8a54. You should upgrade the affected component.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108683https://vuldb.com/vuln/416391https://vuldb.com/vuln/416391/ctihttps://vuldb.com/cve/CVE-2026-108683https://vuldb.com/submit/958015https://github.com/lche511/cve/tree/main/CowAgent_Channel_Media_Download_DoS_Reporthttps://github.com/zhayujie/CowAgent/commit/b7967210268fc4c0afea1078223e74e7e96a8a54https://github.com/zhayujie/CowAgent/releases/tag/2.2.0https://github.com/zhayujie/CowAgent/#zhayujie #CowAgent#CVE_2026_108683#bot", "creation_timestamp": "2026-10-11T14:40:03.103668Z"}, {"uuid": "344e60a6-0105-4b1f-9b50-39bc57543960", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108684", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117422857415077430", "content": "CVE-2026-108684 erzhongxmu Jeewms Autocomplete Data JeecgFormDemoController.java getTreeData sql injection A vulnerability was detected in erzhongxmu Jeewms up to 3.7. This affects the function getTreeData of the file src/main/java/com/jeecg/demo/controller/JeecgFormDemoController.java of the component Autocomplete Data Handler. Performing a manipulation of the argument searchVal results in sql injection. The attack can be initiated remotely. The patch is named 6e29bd57972a499e9c8a81a2dbe94d0d5cf23af0. It is recommended to apply a patch to fix this issue.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108684https://vuldb.com/vuln/416392https://vuldb.com/vuln/416392/ctihttps://vuldb.com/cve/CVE-2026-108684https://vuldb.com/submit/959244https://github.com/Lib0gus/JeeWMS/security/advisories/GHSA-mc7c-w398-v7xphttps://github.com/erzhongxmu/JeeWMS/pull/4https://github.com/erzhongxmu/JeeWMS/commit/6e29bd57972a499e9c8a81a2dbe94d0d5cf23af0https://github.com/erzhongxmu/JeeWMS/#erzhongxmu #Jeewms#CVE_2026_108684#bot", "creation_timestamp": "2026-10-11T14:56:53.142520Z"}]}