{"vulnerability": "cve-2026-10861", "sightings": [{"uuid": "00544825-5571-441d-83f3-5557db5a6a4a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10861", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mnhuhzxasw2b", "content": "CVE-2026-10861 - MISP post-login open redirect via pre_login_requested_url\nCVE ID : CVE-2026-10861\n \n Published : June 4, 2026, 2:16 p.m. | 16\u00a0minutes ago\n \n Description : An open redirect vulnerability existed in MISP UsersController::routeafterlogin() because the value store...", "creation_timestamp": "2026-06-04T14:46:29.587323Z"}, {"uuid": "94a9de40-6346-4018-ac7c-a6266b207181", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108610", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117418864715671192", "content": "CVE-2026-108610 JeecgBoot through 3.9.5 Missing Authorization via /airag/word/edit Endpoint JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateController edit handler that allows any authenticated user to modify word templates. Low-privileged attackers can send PUT or POST requests to /airag/word/edit to overwrite shared templates that other users rely on to generate documents.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108610https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_airag_word_template_edit.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-boot-module/jeecg-boot-module-airag/src/main/java/org/jeecg/modules/airag/wordtpl/controller/AigcWordTemplateController.java#L96-L107https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-airag-word-edit-endpoint#jeecgboot #JeecgBoot#CVE_2026_108610#bot", "creation_timestamp": "2026-10-10T22:01:29.128498Z"}, {"uuid": "dcba03a0-a325-4572-b536-3d56723b6578", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108611", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117418867377608535", "content": "CVE-2026-108611 JeecgBoot through 3.9.5 Missing Authorization via /airag/word/delete Endpoint JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateController delete handler that allows any authenticated user to delete word templates. Low-privileged attackers can send DELETE requests to /airag/word/delete with an id parameter to permanently remove any template from the shared library.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108611https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_airag_word_template_delete.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-boot-module/jeecg-boot-module-airag/src/main/java/org/jeecg/modules/airag/wordtpl/controller/AigcWordTemplateController.java#L115-L122https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-airag-word-delete-endpoint#jeecgboot #JeecgBoot#CVE_2026_108611#bot", "creation_timestamp": "2026-10-10T22:02:09.711414Z"}, {"uuid": "6d7d3c1e-d1a5-4039-9cf9-993c0536c8f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108612", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117418870020858057", "content": "CVE-2026-108612 JeecgBoot through 3.9.5 Missing Authorization via /airag/word/deleteBatch JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateController deleteBatch handler that allows low-privileged authenticated users to delete word templates. Attackers can send a DELETE request to /airag/word/deleteBatch with comma-separated ids to permanently delete any templates in the shared library.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108612https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_airag_word_template_delete_batch.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-boot-module/jeecg-boot-module-airag/src/main/java/org/jeecg/modules/airag/wordtpl/controller/AigcWordTemplateController.java#L130-L137https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-airag-word-deletebatch#jeecgboot #JeecgBoot#CVE_2026_108612#bot", "creation_timestamp": "2026-10-10T22:02:50.111061Z"}, {"uuid": "5ade1b39-f1fe-41fc-b0ca-5fd64029c8e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108613", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117418872666781575", "content": "CVE-2026-108613 JeecgBoot through 3.9.5 Missing Authorization via /airag/app/release Endpoint JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragAppController release handler that allows any authenticated user to publish or unpublish other users' AI applications. Low-privileged attackers can send POST requests to /airag/app/release to obtain share tokens exposing applications to anonymous chat access, or invalidate existing share links.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108613https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_airag_app_release.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-boot-module/jeecg-boot-module-airag/src/main/java/org/jeecg/modules/airag/app/controller/AiragAppController.java#L135-L164https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-airag-app-release-endpoint#jeecgboot #JeecgBoot#CVE_2026_108613#bot", "creation_timestamp": "2026-10-10T22:03:30.451914Z"}, {"uuid": "511e840a-76f2-4921-a518-e11b896dcef4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108614", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117418875309964799", "content": "CVE-2026-108614 JeecgBoot through 3.9.5 Missing Authorization via /airag/extData/exportXls JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController exportXls handler that allows any authenticated user to export AI evaluator data. Low-privileged attackers can request /airag/extData/exportXls to download every user's airag_ext_data evaluator definitions and test-tracking records as an Excel workbook.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108614https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_airag_extdata_prompts_export.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-boot-module/jeecg-boot-module-airag/src/main/java/org/jeecg/modules/airag/prompts/controller/AiragExtDataController.java#L190-L199https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-airag-extdata-exportxls#jeecgboot #JeecgBoot#CVE_2026_108614#bot", "creation_timestamp": "2026-10-10T22:04:10.959657Z"}, {"uuid": "780ca975-624f-4f7c-aece-b86226851222", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108615", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117418877954925459", "content": "CVE-2026-108615 JeecgBoot through 3.9.5 Missing Authorization via /airag/extData/delete JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController delete handler that allows low-privileged authenticated users to delete AI evaluator records. Attackers can send DELETE requests to /airag/extData/delete with any id parameter to remove other users' AI evaluator or test-tracking records without owner or tenant checks.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108615https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_airag_extdata_delete.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-boot-module/jeecg-boot-module-airag/src/main/java/org/jeecg/modules/airag/prompts/controller/AiragExtDataController.java#L124-L130https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-airag-extdata-delete#jeecgboot #JeecgBoot#CVE_2026_108615#bot", "creation_timestamp": "2026-10-10T22:04:51.246625Z"}, {"uuid": "0f5c4815-7321-45f6-9d77-d9c8fe166562", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108616", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117418880597709663", "content": "CVE-2026-108616 JeecgBoot through 3.9.5 Missing Authorization via /airag/extData/deleteBatch JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController deleteBatch handler that allows any authenticated user to delete AI evaluator records. Low-privileged attackers can send comma-separated ids to DELETE /airag/extData/deleteBatch, which lacks owner or tenant checks, deleting other users' evaluator and test-tracking records.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108616https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_airag_extdata_delete_batch.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-boot-module/jeecg-boot-module-airag/src/main/java/org/jeecg/modules/airag/prompts/controller/AiragExtDataController.java#L138-L144https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-airag-extdata-deletebatch#jeecgboot #JeecgBoot#CVE_2026_108616#bot", "creation_timestamp": "2026-10-10T22:05:31.478313Z"}, {"uuid": "090f9c60-600a-4d75-bc02-346100b20517", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108617", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117418883246154474", "content": "CVE-2026-108617 JeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate/add Endpoint JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create message templates by calling POST /sys/message/sysMessageTemplate/add. Attackers holding only minimal roles can insert arbitrary notification templates with chosen codes and content into the shared sys_sms_template library used for system, e-mail, SMS and IM notifications.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108617https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_c089_messagetemplate_add.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/message/controller/SysMessageTemplateController.java#L82-L86https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sysmessagetemplate-add-endpoint#jeecgboot #JeecgBoot#CVE_2026_108617#bot", "creation_timestamp": "2026-10-10T22:06:11.900878Z"}, {"uuid": "30fd0bfb-483d-4c15-87ff-282fa86e37f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108618", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117418885893981452", "content": "CVE-2026-108618 JeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate Edit Endpoint JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify message templates via PUT /sys/message/sysMessageTemplate/edit. Attackers can obtain template ids from the unguarded list endpoint and overwrite system notification titles and content, delivering attacker-supplied text or links to other users.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108618https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_c093_messagetemplate_edit.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/message/controller/SysMessageTemplateController.java#L94-L98https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sysmessagetemplate-edit-endpoint#jeecgboot #JeecgBoot#CVE_2026_108618#bot", "creation_timestamp": "2026-10-10T22:06:52.226256Z"}, {"uuid": "af703c53-a8e7-459b-8c38-125e0c8a12bb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108619", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117418888538794062", "content": "CVE-2026-108619 JeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate deleteBatch Endpoint JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete message templates via the DELETE /sys/message/sysMessageTemplate/deleteBatch endpoint. Attackers can supply comma-separated template ids from the unguarded list endpoint to delete all sys_sms_template rows, breaking template-based notifications such as workflow reminders.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108619https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_console_delete_routes.pyhttps://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/message/controller/SysMessageTemplateController.java#L118-L122https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sysmessagetemplate-deletebatch-endpoint#jeecgboot #JeecgBoot#CVE_2026_108619#bot", "creation_timestamp": "2026-10-10T22:07:32.576408Z"}]}