{"vulnerability": "CVE-2026-10890", "sightings": [{"uuid": "854d96c1-19b0-4ad6-abdd-35f64a4be434", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-10890", "type": "seen", "source": "https://infosec.exchange/users/cR0w/statuses/116697713800926918", "content": "Good lord that's a lot of CVEs for a product that is specifically designed to execute untrusted code from the internet and spy on users:\n\nCVE-2026-10881CVE-2026-10882CVE-2026-10883CVE-2026-10884CVE-2026-10885CVE-2026-10886CVE-2026-10887CVE-2026-10888CVE-2026-10889CVE-2026-10890CVE-2026-10891CVE-2026-10892CVE-2026-10893CVE-2026-10894CVE-2026-10895CVE-2026-10896CVE-2026-10897CVE-2026-10898CVE-2026-10899CVE-2026-10900CVE-2026-10901CVE-2026-10902CVE-2026-10903CVE-2026-10904CVE-2026-10905CVE-2026-10906CVE-2026-10907CVE-2026-10908CVE-2026-10909CVE-2026-10910CVE-2026-10911CVE-2026-10912CVE-2026-10913CVE-2026-10914CVE-2026-10915CVE-2026-10916CVE-2026-10917CVE-2026-10918CVE-2026-10919CVE-2026-10920CVE-2026-10921CVE-2026-10922CVE-2026-10923CVE-2026-10924CVE-2026-10925CVE-2026-10926CVE-2026-10927CVE-2026-10928CVE-2026-10929CVE-2026-10930CVE-2026-10931CVE-2026-10932CVE-2026-10933CVE-2026-10934CVE-2026-10935CVE-2026-10936CVE-2026-10937CVE-2026-10938CVE-2026-10939CVE-2026-10940CVE-2026-10941CVE-2026-10942CVE-2026-10943CVE-2026-10944CVE-2026-10945CVE-2026-10946CVE-2026-10947CVE-2026-10948CVE-2026-10949CVE-2026-10950CVE-2026-10951CVE-2026-10952CVE-2026-10953CVE-2026-10954CVE-2026-10955CVE-2026-10956CVE-2026-10957CVE-2026-10958CVE-2026-10959CVE-2026-10960CVE-2026-10961CVE-2026-10962CVE-2026-10963CVE-2026-10964CVE-2026-10965CVE-2026-10966CVE-2026-10967CVE-2026-10968CVE-2026-10969CVE-2026-10970CVE-2026-10971CVE-2026-10972CVE-2026-10973CVE-2026-10974CVE-2026-10975CVE-2026-10976CVE-2026-10977CVE-2026-10978CVE-2026-10979CVE-2026-10980CVE-2026-10981CVE-2026-10982CVE-2026-10983CVE-2026-10984CVE-2026-10985CVE-2026-10986CVE-2026-10987CVE-2026-10988CVE-2026-10989CVE-2026-10990CVE-2026-10991CVE-2026-10992CVE-2026-10993CVE-2026-10994CVE-2026-10995CVE-2026-10996CVE-2026-10997CVE-2026-10998CVE-2026-10999CVE-2026-11000CVE-2026-11001CVE-2026-11002CVE-2026-11003CVE-2026-11004CVE-2026-11005CVE-2026-11006CVE-2026-11007CVE-2026-11008CVE-2026-11009CVE-2026-11010CVE-2026-11011CVE-2026-11012CVE-2026-11013CVE-2026-11014CVE-2026-11015CVE-2026-11016CVE-2026-11017CVE-2026-11018CVE-2026-11019CVE-2026-11020CVE-2026-11021CVE-2026-11022CVE-2026-11023CVE-2026-11024CVE-2026-11025CVE-2026-11026CVE-2026-11027CVE-2026-11028CVE-2026-11029CVE-2026-11030CVE-2026-11031CVE-2026-11032CVE-2026-11033CVE-2026-11034CVE-2026-11035CVE-2026-11036CVE-2026-11037CVE-2026-11038CVE-2026-11039CVE-2026-11040CVE-2026-11041CVE-2026-11042CVE-2026-11043CVE-2026-11044CVE-2026-11045CVE-2026-11046CVE-2026-11047CVE-2026-11048CVE-2026-11049CVE-2026-11050CVE-2026-11051CVE-2026-11052CVE-2026-11054CVE-2026-11055CVE-2026-11056CVE-2026-11057CVE-2026-11058CVE-2026-11059CVE-2026-11060CVE-2026-11061CVE-2026-11062CVE-2026-11063CVE-2026-11064CVE-2026-11065CVE-2026-11066CVE-2026-11067CVE-2026-11068CVE-2026-11069CVE-2026-11070CVE-2026-11071CVE-2026-11072CVE-2026-11073CVE-2026-11074CVE-2026-11075CVE-2026-11076CVE-2026-11077CVE-2026-11078CVE-2026-11079CVE-2026-11080CVE-2026-11081CVE-2026-11082CVE-2026-11083CVE-2026-11084CVE-2026-11085CVE-2026-11086CVE-2026-11087CVE-2026-11088CVE-2026-11089CVE-2026-11090CVE-2026-11091CVE-2026-11092CVE-2026-11093CVE-2026-11094CVE-2026-11095CVE-2026-11096CVE-2026-11097CVE-2026-11098CVE-2026-11100CVE-2026-11101CVE-2026-11102CVE-2026-11103CVE-2026-11104CVE-2026-11105CVE-2026-11106CVE-2026-11107CVE-2026-11108CVE-2026-11109CVE-2026-11110CVE-2026-11111CVE-2026-11112CVE-2026-11113CVE-2026-11114CVE-2026-11115CVE-2026-11116CVE-2026-11117CVE-2026-11118CVE-2026-11119CVE-2026-11120CVE-2026-11121CVE-2026-11122CVE-2026-11123CVE-2026-11124CVE-2026-11125CVE-2026-11126CVE-2026-11127CVE-2026-11128CVE-2026-11129CVE-2026-11130CVE-2026-11131CVE-2026-11132CVE-2026-11133CVE-2026-11134CVE-2026-11135CVE-2026-11136CVE-2026-11137CVE-2026-11138CVE-2026-11139CVE-2026-11140CVE-2026-11141CVE-2026-11142CVE-2026-11143CVE-2026-11144CVE-2026-11145CVE-2026-11146CVE-2026-11147CVE-2026-11148CVE-2026-11149CVE-2026-11150CVE-2026-11151CVE-2026-11152CVE-2026-11153CVE-2026-11154CVE-2026-11155CVE-2026-11156CVE-2026-11157CVE-2026-11158CVE-2026-11159CVE-2026-11160CVE-2026-11161CVE-2026-11162CVE-2026-11163CVE-2026-11164CVE-2026-11165CVE-2026-11166CVE-2026-11167CVE-2026-11168CVE-2026-11169CVE-2026-11170CVE-2026-11171CVE-2026-11172CVE-2026-11173CVE-2026-11174CVE-2026-11175CVE-2026-11176CVE-2026-11177CVE-2026-11178CVE-2026-11179CVE-2026-11180CVE-2026-11181CVE-2026-11182CVE-2026-11183CVE-2026-11184CVE-2026-11185CVE-2026-11186CVE-2026-11187CVE-2026-11188CVE-2026-11189CVE-2026-11190CVE-2026-11191CVE-2026-11192CVE-2026-11193CVE-2026-11194CVE-2026-11195CVE-2026-11196CVE-2026-11197CVE-2026-11198CVE-2026-11199CVE-2026-11200CVE-2026-11201CVE-2026-11202CVE-2026-11203CVE-2026-11204CVE-2026-11205CVE-2026-11206CVE-2026-11207CVE-2026-11208CVE-2026-11209CVE-2026-11210CVE-2026-11211CVE-2026-11212CVE-2026-11213CVE-2026-11214CVE-2026-11215CVE-2026-11216CVE-2026-11217CVE-2026-11218CVE-2026-11219CVE-2026-11220CVE-2026-11221CVE-2026-11222CVE-2026-11223CVE-2026-11224CVE-2026-11225CVE-2026-11226CVE-2026-11227CVE-2026-11228CVE-2026-11229CVE-2026-11230CVE-2026-11231CVE-2026-11232CVE-2026-11233CVE-2026-11234CVE-2026-11235CVE-2026-11236CVE-2026-11237CVE-2026-11238CVE-2026-11239CVE-2026-11240CVE-2026-11241CVE-2026-11242CVE-2026-11243CVE-2026-11244CVE-2026-11245CVE-2026-11246CVE-2026-11247CVE-2026-11248CVE-2026-11249CVE-2026-11250CVE-2026-11251CVE-2026-11252CVE-2026-11253CVE-2026-11254CVE-2026-11255CVE-2026-11256CVE-2026-11257CVE-2026-11258CVE-2026-11259CVE-2026-11260CVE-2026-11261CVE-2026-11262CVE-2026-11263CVE-2026-11264CVE-2026-11265CVE-2026-11266CVE-2026-11267CVE-2026-11268CVE-2026-11269CVE-2026-11270CVE-2026-11271CVE-2026-11272CVE-2026-11273CVE-2026-11274CVE-2026-11275CVE-2026-11276CVE-2026-11277CVE-2026-11278CVE-2026-11279CVE-2026-11280CVE-2026-11281CVE-2026-11282CVE-2026-11283CVE-2026-11284CVE-2026-11285CVE-2026-11286CVE-2026-11287CVE-2026-11288CVE-2026-11289CVE-2026-11290CVE-2026-11291CVE-2026-11292CVE-2026-11293CVE-2026-11294CVE-2026-11295CVE-2026-11296CVE-2026-11297CVE-2026-11298CVE-2026-11299CVE-2026-11300CVE-2026-11301CVE-2026-11302CVE-2026-11303CVE-2026-11304CVE-2026-11305CVE-2026-11306CVE-2026-11307CVE-2026-11308CVE-2026-11309", "creation_timestamp": "2026-06-05T13:23:25.704482Z"}, {"uuid": "b3e46f1e-be9b-42d0-8d8b-49df02311f67", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-10890", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/microsoft-edge-multiple-vulnerabilities_20260608", "content": "", "creation_timestamp": "2026-06-07T18:00:00.000000Z"}, {"uuid": "7ce122e5-913f-4ee2-b72c-cb8ac97b7307", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-10890", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities_20260608", "content": "", "creation_timestamp": "2026-06-07T18:00:00.000000Z"}, {"uuid": "bb40b33f-08a5-4b48-a1b5-e9efd1ed7f12", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108905", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/fi4zkm7geesbp", "content": "CVE-2026-108905 - pH7Builder before 18.6.0 Hard-Coded API Key Bypass via Host Header\nCVE ID : CVE-2026-108905\n \n Published : Oct. 11, 2026, 3:16 p.m. | 1\u00a0hour, 8\u00a0minutes ago\n \n Description : pH7Builder (pH7 Social Dating CMS) before 18.6.0 contains a hard-coded API key vulnera...", "creation_timestamp": "2026-10-11T17:03:10.491511Z"}, {"uuid": "66fb0d5c-29d1-4f0b-96fd-0c9dd4908b3e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108904", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/552nyswbspaen", "content": "CVE-2026-108904 - pH7Builder before 18.5.0 Sensitive Data Exposure via Member API UserController\nCVE ID : CVE-2026-108904\n \n Published : Oct. 11, 2026, 3:16 p.m. | 1\u00a0hour, 8\u00a0minutes ago\n \n Description : pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an information d...", "creation_timestamp": "2026-10-11T17:09:10.580139Z"}, {"uuid": "ba826ae8-2933-40be-8db3-005b8a4526cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108903", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/6lxydpcpjo7tp", "content": "CVE-2026-108903 - pH7Builder before 19.3.0 CAPTCHA Bypass via Client-Chosen Form ID\nCVE ID : CVE-2026-108903\n \n Published : Oct. 11, 2026, 3:16 p.m. | 1\u00a0hour, 8\u00a0minutes ago\n \n Description : pH7Builder (pH7 Social Dating CMS) before 19.3.0 contains a CAPTCHA bypass vulnerabilit...", "creation_timestamp": "2026-10-11T17:15:10.648054Z"}, {"uuid": "7a1c2c41-5b1b-43d0-932f-e44c52594f32", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108902", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117422881703608371", "content": "CVE-2026-108902 pH7Builder before 18.5.0 Path Traversal Arbitrary File Deletion via picture_link pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains a path traversal vulnerability in the picture module deletePhoto() action that allows authenticated members to delete arbitrary files. Attackers can supply ../ sequences in the POST picture_link parameter to remove other members' photos or configuration and cache files, causing content loss and denial of service.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108902https://github.com/pH7Software/pH7-Social-Dating-CMS/commit/2ffa19ac36d58dbaac37e1c4912be469d67ee75chttps://github.com/pH7Software/pH7-Social-Dating-CMS/blob/v18.4.1/_protected/app/system/core/classes/PictureCore.php#L23-L38https://github.com/pH7Software/pH7-Social-Dating-CMShttps://www.vulncheck.com/advisories/ph7builder-before-18.5.0-path-traversal-arbitrary-file-deletion-via-picture-link#ph7software #ph7builder#CVE_2026_108902#bot", "creation_timestamp": "2026-10-11T15:03:03.593895Z"}, {"uuid": "5726c860-cbbb-47e0-a66d-a147dcd5f358", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108903", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117422884345969835", "content": "CVE-2026-108903 pH7Builder before 19.3.0 CAPTCHA Bypass via Client-Chosen Form ID pH7Builder (pH7 Social Dating CMS) before 19.3.0 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to skip form validation by supplying a client-chosen form ID to PFBC Form::isValid(). Attackers can load a CAPTCHA-free form like login or search, then submit its ID with contact, comment, forum, invite or signup data to automate abuse.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108903https://github.com/pH7Software/pH7-Social-Dating-CMS/commit/4758d7d2ebfd5772faa25ef728c14f8f452e82f4https://github.com/pH7Software/pH7-Social-Dating-CMS/blob/v19.2.0/_protected/app/system/modules/contact/forms/ContactForm.php#L33-L38https://github.com/pH7Software/pH7-Social-Dating-CMShttps://www.vulncheck.com/advisories/ph7builder-before-19.3.0-captcha-bypass-via-client-chosen-form-id#ph7software #ph7builder#CVE_2026_108903#bot", "creation_timestamp": "2026-10-11T15:03:43.913230Z"}, {"uuid": "5748d17a-028f-4b73-bad9-447cbf74c930", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108904", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117422886988492062", "content": "CVE-2026-108904 pH7Builder before 18.5.0 Sensitive Data Exposure via Member API UserController pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an information disclosure vulnerability that allows API clients to obtain sensitive member data because UserController::users() and user() return unfiltered database rows. Attackers holding a valid private API key can retrieve bcrypt password hashes, non-expiring hashValidation reset tokens, and TOTP secrets to take over accounts and bypass two-factor authentication.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108904https://github.com/pH7Software/pH7-Social-Dating-CMS/commit/52a59da534c7666f7607c8a9b8c42037eb4de66dhttps://github.com/pH7Software/pH7-Social-Dating-CMS/blob/v18.4.1/_protected/app/system/modules/api/controllers/UserController.php#L161-L206https://github.com/pH7Software/pH7-Social-Dating-CMShttps://www.vulncheck.com/advisories/ph7builder-before-18.5.0-sensitive-data-exposure-via-member-api-usercontroller#ph7software #ph7builder#CVE_2026_108904#bot", "creation_timestamp": "2026-10-11T15:04:24.150699Z"}, {"uuid": "bb71182a-b15f-4947-b3aa-2398af604331", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108905", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117422889650330915", "content": "CVE-2026-108905 pH7Builder before 18.6.0 Hard-Coded API Key Bypass via Host Header pH7Builder (pH7 Social Dating CMS) before 18.6.0 contains a hard-coded API key vulnerability in Tool.class.php that allows unauthenticated attackers to bypass API access checks by spoofing the Host header. Attackers can send Host: localhost with private_api_key=dev772277 and the default allowed URL to retrieve member emails, IP addresses, phone numbers, and bank account fields.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108905https://github.com/pH7Software/pH7-Social-Dating-CMS/commit/cfe1e0c418946b868db8c399d0cf6b122552efd2https://github.com/pH7Software/pH7-Social-Dating-CMS/blob/v18.5.1/_protected/framework/Api/Tool.class.php#L25-L48https://github.com/pH7Software/pH7-Social-Dating-CMShttps://www.vulncheck.com/advisories/ph7builder-before-18.6.0-hard-coded-api-key-bypass-via-host-header#ph7software #ph7builder#CVE_2026_108905#bot", "creation_timestamp": "2026-10-11T15:05:04.830926Z"}, {"uuid": "69e36e57-2bf8-4b5a-a8c2-a81bffc31cbd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108902", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mxmpovrakq2a", "content": "\ud83d\udfe0 CVE-2026-108902 - High (8.1)\n\npH7Builder (pH7 Social Dating CMS) before 18.5.0 contains a path traversal vulnerability in the p...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-108902/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-11T19:16:07.223775Z"}, {"uuid": "6595f20f-c8a7-48d4-be79-ef4d466783ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108905", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mxmpp42rtb23", "content": "\ud83d\udfe0 CVE-2026-108905 - High (7.5)\n\npH7Builder (pH7 Social Dating CMS) before 18.6.0 contains a hard-coded API key vulnerability in T...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-108905/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-11T19:16:13.691357Z"}, {"uuid": "b4cc0e60-d2f7-4ba2-9919-1575b4ff654a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108900", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117428706680839829", "content": "CVE-2026-108900 Exponent CMS XML-RPC xmlrpc.php userLogin sql injection A vulnerability has been found in Exponent CMS up to 3.0.2patch2. Affected is the function userLogin of the file xmlrpc.php of the component XML-RPC. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108900https://vuldb.com/vuln/416691https://vuldb.com/vuln/416691/ctihttps://vuldb.com/cve/CVE-2026-108900https://vuldb.com/submit/976950https://github.com/dddwmr/CVE/blob/main/SQL%20Injection%20in%20xmlrpc.php%20userLogin%20username%20handling%20when%20USE_XMLRPC%20is%20enabled.md#Exponent #CMS#CVE_2026_108900#bot", "creation_timestamp": "2026-10-12T15:44:25.580490Z"}, {"uuid": "1b978f4d-f174-438d-8507-fdaff625545c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108901", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117428747521378742", "content": "CVE-2026-108901 Shenzhen HCC Technology MPOS M6 PLUS Display QR Code Rendering ui layer A vulnerability was found in Shenzhen HCC Technology MPOS M6 PLUS 1.31-N. Affected by this vulnerability is an unknown functionality of the component Display QR Code Rendering. Performing a manipulation of the argument alignment results in improper restriction of rendered ui layers. The attack can only be performed from the local network. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108901https://vuldb.com/vuln/416692https://vuldb.com/vuln/416692/ctihttps://vuldb.com/cve/CVE-2026-108901https://vuldb.com/submit/976764https://github.com/Davim09/m6plusexploit/blob/main/docs/CVE-4-DisplayInjection.md#ShenzhenHCCTechnology #MPOSM6PLUS#CVE_2026_108901#bot", "creation_timestamp": "2026-10-12T15:54:48.808512Z"}, {"uuid": "b76678c8-8e81-4f82-a684-798483eccd09", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108906", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117428776124580257", "content": "CVE-2026-108906 Netcore NR268 filter_arp_put_file.cgi filter_arp_put_file_cgi out-of-bounds A vulnerability has been found in Netcore NR268 1.7.121109. This affects the function filter_arp_put_file_cgi of the file /router/filter_arp_put_file.cgi. The manipulation of the argument put_file leads to out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108906https://vuldb.com/vuln/416700https://vuldb.com/vuln/416700/ctihttps://vuldb.com/cve/CVE-2026-108906https://vuldb.com/submit/977172https://github.com/draw-ctf/report/blob/main/NR268/2026.09.14-netcore-nr268-arp-import-overread.md#Netcore #NR268#CVE_2026_108906#bot", "creation_timestamp": "2026-10-12T16:02:05.172679Z"}, {"uuid": "b666a6d0-bd5d-4989-8cdb-b4d4ab9c8e78", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108907", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117428870737999001", "content": "CVE-2026-108907 Netcore NR268 CGI Execution user_ok improper authentication A vulnerability was determined in Netcore NR268 1.7.121109. Affected is the function user_ok of the component CGI Execution. This manipulation causes improper authentication. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108907https://vuldb.com/vuln/416702https://vuldb.com/vuln/416702/ctihttps://vuldb.com/cve/CVE-2026-108907https://vuldb.com/submit/977173https://github.com/draw-ctf/report/blob/main/NR268/2026.09.14-netcore-nr268-boa-auth-fail-open.md#Netcore #NR268#CVE_2026_108907#bot", "creation_timestamp": "2026-10-12T16:26:08.932528Z"}]}