{"vulnerability": "CVE-2026-10108", "sightings": [{"uuid": "a53bc8f6-43c8-42a4-bdde-b81777344a7b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10108", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mmzdp6japs2h", "content": "CVE-2026-10108 - xiaomusic 0.5.7 Path Traversal via GET /music endpoint\nCVE ID : CVE-2026-10108\n \n Published : May 29, 2026, 6:16 p.m. | 55\u00a0minutes ago\n \n Description : xiaomusic v0.5.7 contains an unauthenticated path traversal vulnerability in the GET /music/{file_path:path}...", "creation_timestamp": "2026-05-29T20:08:59.445774Z"}, {"uuid": "359c147e-2348-400f-a19a-5c03806ce71e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10108", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mn3x35uqub2h", "content": "\ud83d\udfe0 CVE-2026-10108 - High (7.5)\n\nxiaomusic v0.5.7 contains an unauthenticated path traversal vulnerability in the GET /music/{file...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-10108/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-05-30T21:01:03.306922Z"}, {"uuid": "dc7cd286-fd9d-4c3f-8079-1d4bbd1ff445", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-101084", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mwjq3rqld42u", "content": "CVE-2026-101084 - obot\nVersions of the obot platform before the latest update allow a logged-in user who knows a server identifier to connect to MCP servers that should be off\u2011limits. This can let\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#obot #obotplatform #CVE #infosec", "creation_timestamp": "2026-09-27T21:20:07.745319Z"}, {"uuid": "43ea5fb9-e77d-4f4d-ae8b-d2f0b4b2c209", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-101084", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mwjsqhmdoy2u", "content": "\ud83d\udea8 CVE-2026-101084 \u2014 CVSS 9.3 CRITICAL\n\nobot versions before v0.21.1 fail to enforce Access Control Rules on the /mcp-connect endpoint, allowing an...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-101084\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-27T22:07:29.366484Z"}, {"uuid": "9940df0f-d777-4822-b27e-e1ed745cbf8e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-101087", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/fok6niznifkck", "content": "CVE-2026-101087 - Nezha 2.0.10 through 2.3.2 SSRF Denylist Bypass IPv6\nCVE ID : CVE-2026-101087\n \n Published : Sept. 27, 2026, 8:49 p.m. | 20\u00a0minutes ago\n \n Description : Nezha versions 2.0.10 through 2.3.2 use a restricted HTTP client to validate user-configurable notificatio...", "creation_timestamp": "2026-09-27T22:32:16.050949Z"}, {"uuid": "b35170e7-276e-4654-8dda-b02ceb069af7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-101086", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/iy7flpgoy7526", "content": "CVE-2026-101086 - Nezha Dashboard before 2.3.5 Task Type Validation Bypass\nCVE ID : CVE-2026-101086\n \n Published : Sept. 27, 2026, 8:49 p.m. | 20\u00a0minutes ago\n \n Description : Nezha Dashboard versions before 2.3.5 fail to restrict service monitor task types to supported probe t...", "creation_timestamp": "2026-09-27T22:38:15.844499Z"}, {"uuid": "ec024d49-97ba-473b-b055-966986a376db", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-101088", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/4hmnrwz4jogk2", "content": "CVE-2026-101088 - Nezha before 2.3.1 Denial of Service via Concurrent Server Delete\nCVE ID : CVE-2026-101088\n \n Published : Sept. 27, 2026, 8:49 p.m. | 20\u00a0minutes ago\n \n Description : Nezha is a server and website monitoring tool. In versions >= 2.2.11 and < 2.3.1, the s...", "creation_timestamp": "2026-09-27T22:44:16.195735Z"}, {"uuid": "844314cc-22ca-43cc-bb9f-db8ad170f131", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-101084", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwjzw55n4t2y", "content": "\ud83d\udd34 CVE-2026-101084 - Critical (9.6)\n\nobot versions before v0.21.1 fail to enforce Access Control Rules on the /mcp-connect endpoint, a...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-101084/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-28T00:15:56.514939Z"}, {"uuid": "9e3ff03b-caf6-4bfa-9c0a-2593348951ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-101084", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117346784083424784", "content": "obot-platform obot <0.21.1 suffers a CRITICAL auth bypass (CVE-2026-101084): authenticated users with server IDs can access restricted MCP servers via /mcp-connect. Patch to 0.21.1 now! https://radar.offseq.com/threat/cve-2026-101084-authorization-bypass-through-user-controlled-key-in-obot-platform-obot-2f19c5f80b1ebeae #OffSeq #CVE2026101084 #infosec #vuln", "creation_timestamp": "2026-09-28T04:30:26.225764Z"}, {"uuid": "55a231ac-915e-46bf-b031-cd11f964e4ad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-101084", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mwki5bpbxu2q", "content": "CVE-2026-101084: CRITICAL flaw in obot-platform obot <0.21.1. Authenticated users can bypass authorization on /mcp-connect and manipulate backend systems. Upgrade to 0.21.1 ASAP. https://radar.offseq.com/threat/cve-2026-101084-authorization-bypass-through-user-controlled-key-in-obot-platform-obot...", "creation_timestamp": "2026-09-28T04:30:28.185776Z"}, {"uuid": "9331db21-9e9f-4af3-b1d5-c8c6cd8cff06", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-101081", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/117349641010207368", "content": "A severe vulnerability was disclosed for D-Link DI-8400 (CVE-2026-101081) https://vuldb.com/vuln/410953", "creation_timestamp": "2026-09-28T16:36:59.239725Z"}, {"uuid": "37d622bf-f9e2-451e-8c70-a8cffdfdbf95", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-101081", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mwlrzrcgvj26", "content": "CVE-2026-101081 - di-8400\nThe router\u2019s web\u2011based settings page contains a coding mistake that can be triggered by sending specially crafted data, causing the device to run unintended code. An attacker who can\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#di8400 #dlink #CVE #infosec", "creation_timestamp": "2026-09-28T17:00:06.967224Z"}, {"uuid": "6ea68feb-bab7-4745-b84c-cda349d7c532", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-101081", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mwltjkg5ol2r", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-101081: D-Link DI-8400 Web Administration Service menu_nat_more.asp menu_nat_more_asp stack-based overflow\nCVSS 9.1\nhttps://beta.vulnsea.com/cve/CVE-2026-101081\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-28T17:26:50.636870Z"}, {"uuid": "a31fd569-9011-448a-9810-a8c5a714efbe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-101081", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwltrodklu2k", "content": "\ud83d\udd34 CVE-2026-101081 - Critical (9.1)\n\nA security flaw has been discovered in D-Link DI-8400 16.07. This vulnerability affects the funct...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-101081/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-28T17:31:24.559107Z"}]}