Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
393,009 results · page 296 of 7861
Oct 10, 20261Panel-dev CordysCRM from 1.9.0 before 1.9.2 contains a missing authorization vulnerability in eight ModuleFieldController /field/source data-source endpoints lCVE-2026-108692 · Other software · 1Panel-dev · reported by VulnCheckHigh 7.1
1Panel-dev CordysCRM from 1.9.0 before 1.9.2 contains a missing authorization vulnerability in eight ModuleFieldController /field/source data-source endpoints lacking permission checks. Authenticated users denied module permission can page through organization-wide leads, contacts, quotations, contracts, payment plans, payment records, orders and invoices owned by other users.
- Product
- CordysCRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026mall4j through 4.0 contains an improper authorization vulnerability that allows authenticated storefront customers to delete other shoppers' cart items through CVE-2026-108691 · Other software · gz-yami · reported by VulnCheckMedium 5.3
mall4j through 4.0 contains an improper authorization vulnerability that allows authenticated storefront customers to delete other shoppers' cart items through an operator precedence error in the cleanExpiryProdList SQL statement. Attackers can send one DELETE request to /p/shopCart/cleanExpiryProdList to remove every user's cart entries for off-shelf products, which do not return when products are restocked.
- Product
- mall4j
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026mall4j through 4.0 contains an information disclosure vulnerability that allows authenticated customers to read other shoppers' cart items due to an operator prCVE-2026-108690 · Other software · gz-yami · reported by VulnCheckMedium 5.3
mall4j through 4.0 contains an information disclosure vulnerability that allows authenticated customers to read other shoppers' cart items due to an operator precedence error in the getShopCartExpiryItems SQL filter. Attackers with any storefront account can request GET /p/shopCart/expiryProdList to retrieve off-shelf product basket entries including product, SKU, quantity, shop, and promoter card numbers.
- Product
- mall4j
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows authenticated users to write into other users' AI chat sessions by suppCVE-2026-108689 · Other software · WuKongOpenSource · reported by VulnCheckMedium 5.3
Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows authenticated users to write into other users' AI chat sessions by supplying an arbitrary sessionId to POST /chat/send. Attackers can append messages to a victim's conversation and receive streamed assistant replies built from the victim's last 20 messages, disclosing conversation content.
- Product
- Wukong AICRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026Eladmin through 2.7 contains a missing authorization vulnerability in the LocalStorageController uploadPicture handler that allows low-privileged authenticated CVE-2026-108688 · Other software · elunez · reported by VulnCheckMedium 5.3
Eladmin through 2.7 contains a missing authorization vulnerability in the LocalStorageController uploadPicture handler that allows low-privileged authenticated users to bypass the storage:add permission. Attackers can send POST requests with image-named files to /api/localStorage/pictures to write files into server local storage and disclose absolute server paths.
- Product
- eladmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to send template notifications by calling POST /sys/apCVE-2026-108680 · Other software · jeecgboot · reported by VulnCheckMedium 5.3
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to send template notifications by calling POST /sys/api/sendTemplateAnnouncement. Low-privileged attackers can supply forged sender, recipients, title, and template parameters to deliver messages appearing to come from admin or system accounts.
- Product
- JeecgBoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the sendBusAnnouncement handler of SystemApiController that allows any authenticated uCVE-2026-108679 · Other software · jeecgboot · reported by VulnCheckMedium 5.3
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the sendBusAnnouncement handler of SystemApiController that allows any authenticated user to send announcements without the required permissions. Low-privileged attackers can POST crafted bodies to /sys/api/sendBusAnnouncement with forged sender, recipients, title and content to deliver spoofed admin or system messages for phishing.
- Product
- JeecgBoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryUserRoles handler of SystemApiController that lets authenticated users read aCVE-2026-108678 · Other software · jeecgboot · reported by VulnCheckMedium 5.3
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryUserRoles handler of SystemApiController that lets authenticated users read any user's role codes. Low-privileged attackers can send GET requests to /sys/api/queryUserRoles with an arbitrary username to enumerate role assignments and identify administrator accounts.
- Product
- JeecgBoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026JeecgBoot through 3.9.5 contains a missing authorization vulnerability in GET /sys/api/getUserByName that allows low-privileged authenticated users to retrieve CVE-2026-108677 · Other software · jeecgboot · reported by VulnCheckHigh 7.1
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in GET /sys/api/getUserByName that allows low-privileged authenticated users to retrieve any user's stored password value. Attackers can decrypt the AES-CBC protected response using the hard-coded key exposed by /sys/getEncryptedString to obtain administrators' password ciphertexts for offline guessing.
- Product
- JeecgBoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysAnnouncementController downLoadFiles handler that allows low-privileged authentCVE-2026-108676 · Other software · jeecgboot · reported by VulnCheckMedium 5.3
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysAnnouncementController downLoadFiles handler that allows low-privileged authenticated users to download announcement attachments. Attackers can supply a known announcement id to retrieve a ZIP of attachments from unreleased announcements or those addressed only to other users.
- Product
- JeecgBoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysAnnouncementController editIzTop handler that allows low-privileged authenticatCVE-2026-108675 · Other software · jeecgboot · reported by VulnCheckMedium 5.3
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysAnnouncementController editIzTop handler that allows low-privileged authenticated users to change announcement pin status. Attackers can send POST or PUT requests with any announcement id to pin or unpin system notices shown at the top for all users.
- Product
- JeecgBoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the OpenApiController queryById handler that allows low-privileged authenticated usersCVE-2026-108674 · Other software · jeecgboot · reported by VulnCheckMedium 5.3
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the OpenApiController queryById handler that allows low-privileged authenticated users to read OpenAPI definitions without openapi permissions. Attackers can request GET /openapi/queryById with an entry id to obtain internal origin URLs, virtual paths, IP whitelists, and header and parameter templates.
- Product
- JeecgBoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController exportXls handler that allows any authenticated user to expCVE-2026-108673 · Other software · jeecgboot · reported by VulnCheckMedium 5.3
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController exportXls handler that allows any authenticated user to export all AI prompts. Low-privileged attackers can request /airag/prompts/exportXls to download every user's prompts, including prompt content, model ids, and parameters, as an Excel workbook.
- Product
- JeecgBoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026JeecgBoot through 3.9.5 contains an authorization bypass vulnerability in the getVideoRecords handler of VideoGenerationController that allows authenticated useCVE-2026-108672 · Other software · jeecgboot · reported by VulnCheckMedium 5.3
JeecgBoot through 3.9.5 contains an authorization bypass vulnerability in the getVideoRecords handler of VideoGenerationController that allows authenticated users to read other users' records via the userId parameter. Low-privileged attackers can supply another user id to retrieve their AI video generation history, including prompts, task ids, video URLs and cover URLs.
- Product
- JeecgBoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to read MCP server configurations because the queryByICVE-2026-108671 · Other software · jeecgboot · reported by VulnCheckHigh 7.1
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to read MCP server configurations because the queryById permission check is commented out. Attackers can obtain record ids from the unguarded /airag/app/queryById endpoint and retrieve MCP endpoint URLs, headers, and outbound authentication tokens.
- Product
- JeecgBoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the promptExperiment handler of AiragPromptsController that allows any authenticated uCVE-2026-108670 · Other software · jeecgboot · reported by VulnCheckMedium 5.3
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the promptExperiment handler of AiragPromptsController that allows any authenticated user to run AI prompt experiments. Low-privileged attackers can supply other users' prompt template and dataset ids to trigger large language model evaluation runs, write result rows into airag_ext_data, and change dataset status.
- Product
- JeecgBoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the embeddingSearch handler of AiragKnowledgeController that lacks Shiro permission anCVE-2026-108669 · Other software · jeecgboot · reported by VulnCheckMedium 5.3
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the embeddingSearch handler of AiragKnowledgeController that lacks Shiro permission annotations. Low-privileged authenticated attackers can supply knowledge base ids to the GET /airag/knowledge/embedding/search endpoint to read document text chunks from unauthorized knowledge bases.
- Product
- JeecgBoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController deleteRecycleBin handler that allows any authenticated userCVE-2026-108668 · Other software · jeecgboot · reported by VulnCheckMedium 5.3
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController deleteRecycleBin handler that allows any authenticated user to purge AI prompt templates. Low-privileged attackers can send DELETE requests with prompt template ids to permanently remove recycle-bin templates belonging to administrators or other users.
- Product
- JeecgBoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to restore deleted AI prompt templates by CVE-2026-108667 · Other software · jeecgboot · reported by VulnCheckMedium 5.3
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to restore deleted AI prompt templates by calling the revertRecycleBin endpoint. Attackers can send PUT requests to /airag/prompts/revertRecycleBin with chosen template ids to clear deleted flags, undoing administrator removals.
- Product
- JeecgBoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the deleteBatch handler of AiragPromptsController that allows any authenticated user tCVE-2026-108666 · Other software · jeecgboot · reported by VulnCheckMedium 5.3
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the deleteBatch handler of AiragPromptsController that allows any authenticated user to delete AI prompt templates. Low-privileged attackers can obtain prompt ids from the unguarded list endpoint and pass them to deleteBatch to remove templates created by administrators or other users.
- Product
- JeecgBoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController edit handler that allows any authenticated user to modify ACVE-2026-108665 · Other software · jeecgboot · reported by VulnCheckMedium 5.3
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController edit handler that allows any authenticated user to modify AI prompt templates. Low-privileged attackers can send PUT or POST requests to /airag/prompts/edit with a template id to overwrite prompt text and model parameters created by administrators or other users.
- Product
- JeecgBoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController queryById handler that allows low-privileged authenticated CVE-2026-108664 · Other software · jeecgboot · reported by VulnCheckMedium 5.3
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController queryById handler that allows low-privileged authenticated users to read any AI prompt template. Attackers can enumerate ids via the unguarded /airag/prompts/list endpoint and query each one to obtain prompt text, model parameters, and creator details belonging to administrators or other users.
- Product
- JeecgBoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController deleteApply handler that allows any authenticated user to rejeCVE-2026-108663 · Other software · jeecgboot · reported by VulnCheckMedium 5.3
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController deleteApply handler that allows any authenticated user to reject tenant administrator applications. Low-privileged attackers can send PUT requests with chosen tenantId, packId and userId values to delete pending applications in any tenant and notify applicants of rejection.
- Product
- JeecgBoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove users from tenant product packs CVE-2026-108662 · Other software · jeecgboot · reported by VulnCheckMedium 5.3
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove users from tenant product packs via PUT /sys/tenant/deleteTenantPackUser. Attackers can supply arbitrary userId and packId values in the request body to remove any user from any tenant's product pack, revoking permissions such as tenant administrator access.
- Product
- JeecgBoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to transfer tenant ownership via POST /sys/tenant/chanCVE-2026-108661 · Other software · jeecgboot · reported by VulnCheckHigh 7.1
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to transfer tenant ownership via POST /sys/tenant/changeOwenUserTenant. Low-privileged attackers can supply userId and tenantId parameters to reassign any tenant's owner to a member, including themselves, and strip the legitimate owner.
- Product
- JeecgBoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to modify tenant settings by calling PUT /sys/tenant/uCVE-2026-108660 · Other software · jeecgboot · reported by VulnCheckMedium 5.3
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to modify tenant settings by calling PUT /sys/tenant/updateApplyStatus. Low-privileged attackers can supply any tenant id to overwrite its applyStatus field, enabling or disabling tenant administrator applications across tenants.
- Product
- JeecgBoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController listPackByTenantUserId handler that allows any authenticated uCVE-2026-108659 · Other software · jeecgboot · reported by VulnCheckMedium 5.3
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController listPackByTenantUserId handler that allows any authenticated user to query tenant product packs. Low-privileged attackers can supply arbitrary tenantId and userId parameters to enumerate any tenant's product pack configuration and reveal which users are tenant administrators.
- Product
- JeecgBoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController queryTenantAuthInfo handler that allows any authenticated userCVE-2026-108658 · Other software · jeecgboot · reported by VulnCheckMedium 5.3
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController queryTenantAuthInfo handler that allows any authenticated user to read other tenants' records. Low-privileged attackers can iterate small integer tenant ids to retrieve full sys_tenant records, including house numbers used as tenant join codes and company profile fields.
- Product
- JeecgBoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController passApply handler that allows any authenticated user to approvCVE-2026-108657 · Other software · jeecgboot · reported by VulnCheckHigh 8.6
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController passApply handler that allows any authenticated user to approve tenant administrator applications. Attackers can file a pending application via doApplyTenantPackUser and approve it through PUT /sys/tenant/passApply to gain tenant administrator pack permissions in any tenant.
- Product
- JeecgBoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController GET /sys/tenant/getTenantPackApplyUsers endpoint that allows aCVE-2026-108656 · Other software · jeecgboot · reported by VulnCheckMedium 5.3
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController GET /sys/tenant/getTenantPackApplyUsers endpoint that allows any authenticated user to read tenant administrator applications. Low-privileged attackers can iterate the tenantId parameter to retrieve pending applicants' usernames, real names, phone numbers and departments for any tenant.
- Product
- JeecgBoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the QuartzJobController queryById handler that allows low-privileged authenticated useCVE-2026-108655 · Other software · jeecgboot · reported by VulnCheckMedium 5.3
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the QuartzJobController queryById handler that allows low-privileged authenticated users to read scheduled job records. Attackers can request GET /sys/quartzJob/queryById with a job id to retrieve job class names, cron expressions, job parameters and status reserved for administrators.
- Product
- JeecgBoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the OssFileController queryById handler that allows low-privileged authenticated usersCVE-2026-108654 · Other software · jeecgboot · reported by VulnCheckMedium 5.3
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the OssFileController queryById handler that allows low-privileged authenticated users to read object storage file records. Attackers who know a record id can request GET /sys/oss/file/queryById to obtain original file names and direct storage URLs of files uploaded by other users.
- Product
- JeecgBoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryPageList handler of OpenApiController that allows any authenticated user to lCVE-2026-108653 · Other software · jeecgboot · reported by VulnCheckMedium 5.3
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryPageList handler of OpenApiController that allows any authenticated user to list OpenAPI registry definitions. Low-privileged attackers can query GET /openapi/list to read virtual paths, internal origin URLs, IP whitelists, and header and parameter templates intended for administrators.
- Product
- JeecgBoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SystemApiController updateAvatar handler that allows any authenticated user to chaCVE-2026-108652 · Other software · jeecgboot · reported by VulnCheckMedium 5.3
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SystemApiController updateAvatar handler that allows any authenticated user to change other users' avatars. Low-privileged attackers can send PUT requests with a target user id and an arbitrary value, such as an attacker-controlled image URL, to replace administrators' avatars.
- Product
- JeecgBoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getRolesByUserId handler of SystemApiController that allows authenticated users toCVE-2026-108651 · Other software · jeecgboot · reported by VulnCheckMedium 5.3
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getRolesByUserId handler of SystemApiController that allows authenticated users to retrieve any user's role codes. Low-privileged attackers can supply arbitrary userId values to GET /sys/api/getRolesByUserId to enumerate role assignments and identify administrator accounts.
- Product
- JeecgBoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getUserPermissionSet handler of SystemApiController that allows any authenticated CVE-2026-108650 · Other software · jeecgboot · reported by VulnCheckMedium 5.3
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getUserPermissionSet handler of SystemApiController that allows any authenticated user to read other users' permission codes. Low-privileged attackers can supply an arbitrary userId to GET /sys/api/getUserPermissionSet to retrieve the full permission set of any account, including administrators.
- Product
- JeecgBoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryUserRolesById handler of SystemApiController that lets authenticated users reCVE-2026-108649 · Other software · jeecgboot · reported by VulnCheckMedium 5.3
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryUserRolesById handler of SystemApiController that lets authenticated users read any user's role codes. Low-privileged attackers can send a userId to GET /sys/api/queryUserRolesById to enumerate role assignments and identify administrator accounts.
- Product
- JeecgBoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the GET /sys/api/getDynamicDbSourceByCode endpoint of SystemApiController, which lacksCVE-2026-108648 · Other software · jeecgboot · reported by VulnCheckHigh 7.1
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the GET /sys/api/getDynamicDbSourceByCode endpoint of SystemApiController, which lacks Shiro permission or role annotations. Any authenticated low-privileged user can supply datasource codes in the dbSourceCode parameter to retrieve JDBC URLs, usernames and decrypted cleartext database passwords.
- Product
- JeecgBoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create validation rules through the SysCVE-2026-108647 · Other software · jeecgboot · reported by VulnCheckMedium 5.3
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create validation rules through the SysCheckRuleController importExcel handler. Attackers can upload a crafted Excel workbook to bypass the system:checkRule:add permission and bulk-create system-wide encoding validation rules with arbitrary regular expression patterns.
- Product
- JeecgBoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysCategoryController importExcel handler that allows any authenticated user to imCVE-2026-108646 · Other software · jeecgboot · reported by VulnCheckMedium 5.3
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysCategoryController importExcel handler that allows any authenticated user to import category dictionary entries. Low-privileged attackers can upload crafted Excel workbooks to bulk insert arbitrary nodes into the system-wide sys_category dictionary, including under existing parent nodes.
- Product
- JeecgBoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysCategoryController that allows any authenticated user to edit category dictionary nCVE-2026-108645 · Other software · jeecgboot · reported by VulnCheckMedium 5.3
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysCategoryController that allows any authenticated user to edit category dictionary nodes via /sys/category/edit. Low-privileged attackers can send POST or PUT requests supplying a node id to rename, recode, or move system-wide sys_category nodes, altering classification values used across forms.
- Product
- JeecgBoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysCategoryController delete handler that allows any authenticated user to delete CVE-2026-108644 · Other software · jeecgboot · reported by VulnCheckMedium 5.3
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysCategoryController delete handler that allows any authenticated user to delete category dictionary nodes. Low-privileged attackers can obtain node ids from the unguarded rootList and childList endpoints and delete entire sys_category subtrees, breaking dependent forms and dictionary fields.
- Product
- JeecgBoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete category dictionary entries via CVE-2026-108643 · Other software · jeecgboot · reported by VulnCheckMedium 5.3
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete category dictionary entries via DELETE /sys/category/deleteBatch. Attackers can obtain node ids from the unguarded rootList and childList endpoints and submit them to recursively delete entire sys_category subtrees, breaking dependent forms and dictionary fields.
- Product
- JeecgBoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysAnnouncementSendController that allows authenticated users to modify other users' mCVE-2026-108642 · Other software · jeecgboot · reported by VulnCheckMedium 5.3
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysAnnouncementSendController that allows authenticated users to modify other users' message delivery records. Attackers can obtain delivery ids from GET /sys/sysAnnouncementSend/list and submit edit requests that overwrite read flags, recipient ids, or linked announcements to hide messages from recipients.
- Product
- JeecgBoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' in-application messages CVE-2026-108641 · Other software · jeecgboot · reported by VulnCheckMedium 5.3
JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' in-application messages via the getOne handler of SysAnnouncementSendController. Attackers can obtain delivery record ids from the unguarded /sys/sysAnnouncementSend/list endpoint and supply them as the sendId parameter to retrieve message titles, bodies, senders and recipients.
- Product
- JeecgBoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartRoleController queryById handler that lacks Shiro permission annotations.CVE-2026-108640 · Other software · jeecgboot · reported by VulnCheckMedium 5.3
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartRoleController queryById handler that lacks Shiro permission annotations. Low-privileged authenticated attackers can request GET /sys/sysDepartRole/queryById with any id to read department role names, codes, descriptions and audit fields.
- Product
- JeecgBoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to permanently delete data dictionaries via the deleteCVE-2026-108639 · Other software · jeecgboot · reported by VulnCheckMedium 5.3
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to permanently delete data dictionaries via the deletePhysic handler of SysDictController. Low-privileged attackers can send DELETE requests to /sys/dict/deletePhysic/{id} to irreversibly remove active dictionaries and all their items, bypassing the recycle bin.
- Product
- JeecgBoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove group memberships via the deleteCVE-2026-108638 · Other software · jeecgboot · reported by VulnCheckMedium 5.3
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove group memberships via the deleteGroupUser handler in SysUserController. Attackers can send DELETE requests with arbitrary groupId and userId values to remove any user from any administrator-maintained user group without ownership or tenant checks.
- Product
- JeecgBoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove user group members by calling DECVE-2026-108637 · Other software · jeecgboot · reported by VulnCheckMedium 5.3
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove user group members by calling DELETE /sys/user/deleteUserGroupBatch. Attackers can supply any groupId and comma-separated userIds to delete sys_ugroup_user rows without permission or tenant checks, tampering with administrator-maintained groups.
- Product
- JeecgBoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartController appImportExcel handler that allows any authenticated user to iCVE-2026-108636 · Other software · jeecgboot · reported by VulnCheckMedium 5.3
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartController appImportExcel handler that allows any authenticated user to import departments. Low-privileged attackers can upload a crafted Excel workbook to POST /sys/sysDepart/appImportExcel to create arbitrary sys_depart records in the administrator-maintained department tree.
- Product
- JeecgBoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.