{"vulnerability": "cve-2026-10874", "sightings": [{"uuid": "b6804146-19d9-4ca2-bf7e-591249b40770", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108745", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117422398405248745", "content": "CVE-2026-108745 CloudBeaver through 25.3.5 Missing Authorization via /api/sql-result-value Servlet CloudBeaver through 25.3.5 contains a missing authorization vulnerability in WebSQLResultServlet that allows any web session holder to read other users' LOB export files from a shared folder. Attackers can guess table and column names and enumerate second-resolution timestamps to download victims' LOB values, including data from connections they cannot query.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108745https://hackmd.io/@haind03/cloudbeaver-sql-lob-servlet-missing-authorizationhttps://github.com/dbeaver/cloudbeaver/blob/48885c48f5fbd363bf3391f47a669629b4f3dd24/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/service/sql/WebSQLResultServlet.java#L57-L94https://github.com/dbeaver/cloudbeaver/blob/48885c48f5fbd363bf3391f47a669629b4f3dd24/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/service/sql/WebSQLDataLOBReceiver.java#L37-L70https://github.com/dbeaver/cloudbeaverhttps://www.vulncheck.com/advisories/cloudbeaver-through-25.3.5-missing-authorization-via-api-sql-result-value-servlet#DBeaver #CloudBeaver#CVE_2026_108745#bot", "creation_timestamp": "2026-10-11T13:00:09.017820Z"}, {"uuid": "0f7cde0f-9e29-4de3-8df6-ffb47f58eec2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108749", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117422408995215554", "content": "CVE-2026-108749 docling-serve 1.14.0 through 1.36.0 Missing Authentication via Memory Management Endpoints docling-serve 1.14.0 through 1.36.0 contains a missing authentication vulnerability that allows unauthenticated attackers to access /v1/memory/stats and /v1/memory/counts because they omit the require_auth dependency. Attackers can bypass the configured DOCLING_SERVE_API_KEY to read process and cgroup memory telemetry, object type histograms, and force repeated gc.collect() heap enumeration.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108749https://hackmd.io/@haind03/docling-serve-memory-endpoints-api-key-bypasshttps://github.com/docling-project/docling-serve/blob/07b1d3d3b515afd9196148e0353d54ea38de2a37/docling_serve/app.py#L1631-L1687https://github.com/docling-project/docling-serve/blob/07b1d3d3b515afd9196148e0353d54ea38de2a37/docling_serve/auth.py#L49-L55https://github.com/docling-project/docling-servehttps://www.vulncheck.com/advisories/docling-serve-1.14.0-through-1.36.0-missing-authentication-via-memory-management-endpoints#docling-project #docling-serve#CVE_2026_108749#bot", "creation_timestamp": "2026-10-11T13:02:50.555496Z"}, {"uuid": "2a1ff7e4-08c7-4795-978c-58895ed841b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108747", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117422403708877241", "content": "CVE-2026-108747 Lightdash through 2.556.0 Authorization Bypass via Personal Access Token Deletion Lightdash through 2.556.0 contains an authorization bypass vulnerability that allows authenticated organization members to delete other users' personal access tokens by supplying their UUID. Attackers can send DELETE requests to the personal-access-tokens route with a victim's token UUID, even across organizations, to revoke it and break API integrations.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108747https://hackmd.io/@haind03/lightdash-pat-delete-ownership-bypass-20261011https://github.com/lightdash/lightdash/blob/c890f0b982efb51f1f8d1535d4e334447cec2ed7/packages/backend/src/services/PersonalAccessTokenService.ts#L107-L134https://github.com/lightdash/lightdash/blob/c890f0b982efb51f1f8d1535d4e334447cec2ed7/packages/backend/src/models/DashboardModel/PersonalAccessTokenModel.ts#L157-L162https://github.com/lightdash/lightdashhttps://www.vulncheck.com/advisories/lightdash-through-2.556.0-authorization-bypass-via-personal-access-token-deletion#Lightdash #lightdash#CVE_2026_108747#bot", "creation_timestamp": "2026-10-11T13:01:29.975180Z"}, {"uuid": "a5785a28-dbce-4325-a883-b64cf71c8303", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108740", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117422387792660278", "content": "CVE-2026-108740 GoatCounter through 2.7.0 Privilege Escalation via /user/pref Mass Assignment GoatCounter through 2.7.0 contains a mass assignment privilege escalation vulnerability in the userPrefSave handler that allows logged-in users to modify protected account fields via form-encoded requests. Attackers with read-only access can POST user.access[all]=* and user.email_verified=true to /user/pref, bypassing readonly tags to gain superuser or admin access.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108740https://hackmd.io/@haind03/goatcounter-user-pref-access-mass-assignment-20261011https://github.com/arp242/goatcounter/blob/7e91d8a9bdbb0dd48496e498c5680f8f3477a1b4/handlers/settings_user.go#L33-L99https://github.com/arp242/goatcounter/blob/7e91d8a9bdbb0dd48496e498c5680f8f3477a1b4/user.go#L191-L218https://github.com/arp242/goatcounterhttps://www.vulncheck.com/advisories/goatcounter-through-2.7.0-privilege-escalation-via-user-pref-mass-assignment#arp242 #GoatCounter#CVE_2026_108740#bot", "creation_timestamp": "2026-10-11T12:57:27.219613Z"}, {"uuid": "8d070b6b-c3f3-4818-9161-88075901499d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108741", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117422390433417196", "content": "CVE-2026-108741 Shepherd through 0.3.1 SSRF via DNS Rebinding in Citation Checker Shepherd (shepherd-ai) through 0.3.1 contains a server-side request forgery guard bypass in the citation-checker extra because the public_url guard validates a resolved address but fetch re-resolves the hostname at connect time. Attackers who plant a crafted reference URL in a checked document and control its DNS can rebind it to internal addresses, sending GET requests to internal HTTP(S) services and capturing responses in evidence files.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108741https://hackmd.io/@haind03/shepherd-citation-checker-dns-rebinding-ssrfhttps://github.com/shepherd-agents/shepherd/blob/d34d5ca334871dfcb5a3dc76dd78045829fa4e56/shepherd/extras/citation-checker/src/shepherd_citation_checker/_engine/network.py#L9-L17https://github.com/shepherd-agents/shepherd/blob/d34d5ca334871dfcb5a3dc76dd78045829fa4e56/shepherd/extras/citation-checker/src/shepherd_citation_checker/_engine/fetch.py#L34-L55https://github.com/shepherd-agents/shepherdhttps://www.vulncheck.com/advisories/shepherd-through-0.3.1-ssrf-via-dns-rebinding-in-citation-checker#shepherd-agents #Shepherd#CVE_2026_108741#bot", "creation_timestamp": "2026-10-11T12:58:07.280981Z"}, {"uuid": "fb15a022-ee61-47a3-8979-b67f6e3ee12b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108742", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117422393096711522", "content": "CVE-2026-108742 CloudBeaver through 25.3.5 Missing Authorization via initConnection GraphQL Mutation CloudBeaver through 25.3.5 contains a missing authorization vulnerability in the initConnection GraphQL mutation that lets view-only shared-project members persist credentials without datasource-edit permission. Attackers can set saveCredentials and sharedCredentials flags with chosen authProperties so other users connect to the shared connection under the attacker's database identity.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108742https://hackmd.io/@haind03/cloudbeaver-initconnection-shared-credential-authz-bypasshttps://github.com/dbeaver/cloudbeaver/blob/48885c48f5fbd363bf3391f47a669629b4f3dd24/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/service/core/DBWServiceCore.java#L130-L140https://github.com/dbeaver/cloudbeaver/blob/48885c48f5fbd363bf3391f47a669629b4f3dd24/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/service/core/impl/WebServiceCore.java#L349-L480https://github.com/dbeaver/cloudbeaverhttps://www.vulncheck.com/advisories/cloudbeaver-through-25.3.5-missing-authorization-via-initconnection-graphql-mutation#DBeaver #CloudBeaver#CVE_2026_108742#bot", "creation_timestamp": "2026-10-11T12:58:48.001116Z"}, {"uuid": "ea98f34c-d30c-4cc9-ae3b-b4cbc0a8e018", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108744", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117422395740394416", "content": "CVE-2026-108744 pbi-cli 3.10.1 through 3.12.0 OS Command Injection via Desktop Sync pbi-cli 3.10.1 through 3.12.0 contains an OS command injection vulnerability in desktop_sync.py that passes unquoted .pbip paths to cmd /c start when reopening projects. Attackers can lure victims into opening a Power BI project from a space-free path containing & to run commands with victim privileges during report write or reload.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108744https://hackmd.io/@haind/pbi-cli-desktop-sync-pbip-cmd-argument-injectionhttps://github.com/MinaSaad1/pbi-cli/blob/c8655cb9a131e2ce87ae5e1380994099f693d6af/src/pbi_cli/utils/desktop_sync.py#L398-L405https://github.com/MinaSaad1/pbi-cli/blob/c8655cb9a131e2ce87ae5e1380994099f693d6af/src/pbi_cli/utils/desktop_sync.py#L286-L291https://github.com/MinaSaad1/pbi-clihttps://www.vulncheck.com/advisories/pbi-cli-3.10.1-through-3.12.0-os-command-injection-via-desktop-sync#MinaSaad1 #pbi-cli#CVE_2026_108744#bot", "creation_timestamp": "2026-10-11T12:59:28.257826Z"}, {"uuid": "5b35c28f-63b6-424d-b43a-b9894aa68fb0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108746", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117422401047715506", "content": "CVE-2026-108746 Vearch 3.5.2 through 3.5.9 Incorrect Authorization via Role.HasPermissionForResources Vearch 3.5.2 through 3.5.9 contains an incorrect authorization vulnerability in Role.HasPermissionForResources that ignores stored ReadOnly or None privilege levels for resources listed in a role. Authenticated non-root users can upsert and delete documents with read-only access, or call PUT /roles to grant their role WriteRead privileges, escalating toward cluster administrator access.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108746https://hackmd.io/@haind/vearch-rbac-privilege-level-ignored-authz-bypasshttps://github.com/vearch/vearch/blob/bae78b189ff0ab1d8ac659c6acaeeb5f630db33f/internal/entity/user.go#L300-L313https://github.com/vearch/vearch/blob/bae78b189ff0ab1d8ac659c6acaeeb5f630db33f/internal/master/services/role_service.go#L180-L229https://github.com/vearch/vearchhttps://www.vulncheck.com/advisories/vearch-3.5.2-through-3.5.9-incorrect-authorization-via-role-haspermissionforresources#Vearch #vearch#CVE_2026_108746#bot", "creation_timestamp": "2026-10-11T13:00:49.358132Z"}, {"uuid": "453031e5-de3a-4914-9f5b-fc093b724c22", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108748", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117422406353032656", "content": "CVE-2026-108748 Quarkus LangChain4j 1.9.0 through 1.14.1 Memory Exhaustion via /_chat/routes WebSocket Quarkus LangChain4j 1.9.0 through 1.14.1 contains a missing release of memory vulnerability in the chat-scopes WebSocket /_chat/routes endpoint that allows unauthenticated remote clients to exhaust server memory. Attackers can send repeated CONNECT frames reusing one chatId, leaving orphaned scopes in activeScopes until the JVM exits and degrading availability.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108748https://hackmd.io/@haind/quarkus-langchain4j-chatscope-orphan-leakhttps://github.com/quarkiverse/quarkus-langchain4j/blob/658ac8268e1a453a6a2066952d9495fb925479e3/chat-scopes/websocket/runtime/src/main/java/io/quarkiverse/langchain4j/chatscopes/websocket/internal/ChatRouteEndpoint.java#L122-L160https://github.com/quarkiverse/quarkus-langchain4j/blob/658ac8268e1a453a6a2066952d9495fb925479e3/chat-scopes/core/runtime/src/main/java/io/quarkiverse/langchain4j/chatscopes/internal/ChatScopeManagedContext.java#L297-L311https://github.com/quarkiverse/quarkus-langchain4jhttps://www.vulncheck.com/advisories/quarkus-langchain4j-1.9.0-through-1.14.1-memory-exhaustion-via-chat-routes-websocket#quarkiverse #quarkus-langchain4j#CVE_2026_108748#bot", "creation_timestamp": "2026-10-11T13:02:10.172252Z"}, {"uuid": "01917ae0-87cf-4eae-b712-efb46b024683", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108741", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/7vqimuwltarnq", "content": "CVE-2026-108741 - Shepherd through 0.3.1 SSRF via DNS Rebinding in Citation Checker\nCVE ID : CVE-2026-108741\n \n Published : Oct. 11, 2026, 12:19 p.m. | 26\u00a0minutes ago\n \n Description : Shepherd (shepherd-ai) through 0.3.1 contains a server-side request forgery guard bypass in t...", "creation_timestamp": "2026-10-11T13:44:10.325417Z"}, {"uuid": "bcf834e1-5fd4-4c74-8ee1-094f2532e3e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108740", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/jbq624gokhrgz", "content": "CVE-2026-108740 - GoatCounter through 2.7.0 Privilege Escalation via /user/pref Mass Assignment\nCVE ID : CVE-2026-108740\n \n Published : Oct. 11, 2026, 1:17 p.m. | 13\u00a0minutes ago\n \n Description : GoatCounter through 2.7.0 contains a mass assignment privilege escalation vulnerab...", "creation_timestamp": "2026-10-11T14:08:10.379624Z"}, {"uuid": "f503c9bd-d408-499b-897c-993b4d7843ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108746", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117424797573650839", "content": "CVE-2026-108746 - Critical PrivEsc in Vearch. Broken authorization lets read-only users gain full cluster admin rights. CVSS 8.8. Audit roles now. #CVE #Vearch #infosec\nhttps://www.valtersit.com/cve/CVE-2026-108746/", "creation_timestamp": "2026-10-11T23:10:29.621542Z"}, {"uuid": "290711ed-79cf-4888-ab39-c30ff14d2cc5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108746", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mxnbduhkhw2b", "content": "\ud83d\udfe0 CVE-2026-108746 - High (8.8)\n\nVearch 3.5.2 through 3.5.9 contains an incorrect authorization vulnerability in Role.HasPermissio...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-108746/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-12T00:32:03.780781Z"}, {"uuid": "44a9a4dd-ac41-4f95-8b8e-f3da45257f96", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108740", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mxncziwarb2b", "content": "\ud83d\udfe0 CVE-2026-108740 - High (8.3)\n\nGoatCounter through 2.7.0 contains a mass assignment privilege escalation vulnerability in the us...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-108740/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-12T01:02:03.678873Z"}, {"uuid": "02624c49-7e4d-436e-a4a6-4ecef9a2540c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108746", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxnjmlee552w", "content": "CVE-2026-108746 - vearch\nVersions 3.5.2 through 3.5.9 of Vearch do not correctly check permission levels, so users who should only view data can add, change, or delete records. This also lets them change their own\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#vearch #CVE #infosec", "creation_timestamp": "2026-10-12T03:00:05.809524Z"}]}