CVE Vulnerabilities - 13 October 2026

Conductor OSS lets attackers send internal network requests

CVE-2026-109402

The MCP Service in Conductor OSS version 3.22.0 can be tricked into contacting any address you specify. This could let a remote attacker make the server talk to internal systems or external sites, pot...

2.1

MeterSphere can be tricked into making unauthorized server calls

CVE-2026-109189

MeterSphere versions up to 3.6.9‑lts let an attacker supply a crafted URL that causes the system to send requests to any address you choose. This can be used to access internal services or expose sens...

2.1

Conductor OSS API tool config permits remote request spoofing

CVE-2026-109190

Conductor OSS version 3.31.2 lets a remote user manipulate a URL parameter in the API tool configuration, causing the server to make arbitrary HTTP requests on their behalf. This could expose internal...

2.1

Online Cake Ordering System remote data theft via SQL injection

CVE-2026-108959

The addtransacdetail.php page in the Online Cake Ordering System can be tricked into running harmful database commands when a specially crafted ID is supplied. This lets an attacker read, change, or d...

2.1

Netgear EX3700 and EX6120 admin web login can be hijacked

CVE-2026-11730

The web management interfaces on the Netgear EX3700 and EX6120 Wi‑Fi extenders use predictable session identifiers. An attacker who is on the same network and learns the Wi‑Fi password could guess a v...

2.1

cal.com can let remote users delete others' credentials

CVE-2026-109143

Versions of cal.com and cal.diy up to 6.2.0 let an attacker change a team identifier in a delete‑request API and remove credential records that belong to other teams. This can be done over the network...

2.1

Online Reviewer System lets remote attackers change user profiles

CVE-2026-108948

The Online Reviewer System version 1.0 contains a flaw in the user profile update code that lets an attacker change how data is handled by sending a crafted usertype_id value. This can be triggered ov...

2.1

Polaris Office App Android lets files be saved outside safe folder

CVE-2026-109106

The Android version of Polaris Office App (9.9.19) can be tricked into saving a document in any location on the device because it does not correctly check the file name you give it. This could let som...

1.9

PublicCMS pay endpoint can redirect users to any site

CVE-2026-109160

The pay feature in PublicCMS versions up to 5.202608.a lets attackers change the return URL parameter, causing the system to send users to a malicious website. This open redirect can be triggered remo...

2.1

RuoYi-Cloud-Plus lets logged-in users delete others’ social logins

CVE-2026-110107

In RuoYi-Cloud-Plus versions up to 6.0.0, a logged‑in user can send a simple request that removes another person's linked social‑media account. This deletes the stored OAuth credentials, preventing th...

2.3

FortiSIEM 7.5.0 allows unauthorized code execution via web request

CVE-2026-106176

Fortinet FortiSIEM version 7.5.0 does not properly check who can send certain web requests. An attacker could send a specially crafted request and cause the system to run code or commands it should no...

3.8

Libreswan can be locked out by fake certificates

CVE-2026-77205 UBUNTU-CVE-2026-77205

The Libreswan VPN software, when running in FIPS mode, keeps malformed certificates in its cache and then blocks any legitimate certificates that share the same serial number. This lets an attacker se...

3.7

fastify allows restricted header to bypass validation

CVE-2026-107832 GHSA-389g-gv7q-r4x8

Versions of the fastify web framework between 5.12.2 and 5.12.5 may let a request carry a header that should be blocked because the software checks header names in the wrong case. This can let unwante...

3.7

joi package can be exploited without proper validation

CVE-2026-84368 GHSA-6w3j-5fw6-r9vr ROOT-APP-NPM-CVE-2026-84368

The joi validation library used in several Node.js projects (including hapi/joi and @rootio/joi) has a flaw that could let attackers send specially crafted data to bypass checks. Update to the latest ...

3.7

Indico event system may expose speaker emails via export cache

CVE-2026-108388 GHSA-p9vj-86c7-h7q3

In Indico versions 3.3.3 through 3.3.13, a low‑privilege user can trick a privileged user into creating a contribution export that stores speaker or author email addresses in a shared cache. Those cac...

3.5

Huawei OpenBMC may read beyond buffer on short responses

CVE-2026-65200

The OpenBMC device‑management service that handles PLDM and NCSI messages can be tricked by a device that sends an unusually short reply. This causes the software to read far past the intended data ar...

3.5

GitLab may let logged-in users contact internal servers

CVE-2026-100104 BIT-gitlab-2026-100104 UBUNTU-CVE-2026-100104

GitLab versions from 10.3 up to 19.4.1 allow a signed‑in user to trick the system into sending requests to internal network resources when importing a repository. This could expose internal services o...

3.5

SAP Cloud Connector may leak internal system info

CVE-2026-58242

The SAP Cloud Connector can be tricked by a low‑privilege user on the same network to reveal limited details about your internal systems. This exposure is minor and does not affect data integrity or s...

3.5

Red Hat Enterprise Linux may crash on bad device data

CVE-2026-110036

A bug in the device-mapper-persistent-data component used by Red Hat Enterprise Linux can cause the system to stop working if it reads specially crafted device information. An arithmetic mistake leads...

3.3

Toonflow-app may leak data via exportData endpoint

CVE-2026-109526

The Toonflow application (versions up to 1.1.8) can expose internal information when its exportData function is accessed locally. This could allow a nearby user to view data that should remain private...

1.9

Linux kernel could let attacker gain root access

CVE-2025-71148 ROOT-OS-UBUNTU-2404-CVE-2025-71148 UBUNTU-CVE-2025-71148 DEBIAN-CVE-2025-71148

The Linux kernel packages in several distributions (Ubuntu 24.04, Debian, and certain Canonical builds) contain a flaw that could allow an attacker to obtain full system control. This could compromise...

3.3

Google Chrome can leak data via crafted web page

CVE-2026-110141

Older versions of Google Chrome may let a remote attacker view data from other sites when they visit a specially made page. This could expose confidential information without the user noticing. Upgrad...

3.1

H3C HDM G5 firmware can be signed with attacker key

CVE-2026-65197

The H3C HDM Family-A G5 device stores a public key in a file that can be changed by anyone with firmware‑update rights. By replacing this key, an attacker can sign a malicious firmware image and the d...

3.1

GitLab could let token import projects to wrong groups

CVE-2026-82632 BIT-gitlab-2026-82632

GitLab versions before the recent patches let a user who has a personal access token limited to importing their own projects accidentally import a project into a group they don’t belong to. This could...

3.1

GitLab allows maintainer to delete protected package data

CVE-2026-103549 BIT-gitlab-2026-103549 UBUNTU-CVE-2026-103549

All GitLab Community and Enterprise editions released before the latest patches let a logged-in user with maintainer rights erase package information that should only be removable by higher‑level admi...

2.7