CVE WatchOct 6, 2026

CVE-2026-105294

Legcord 1.1.0 through 1.3.0 contains a configuration injection vulnerability that allows script in the Discord page to write any config key

CVSS

7.4

High

EPSS

0.2%

KEV

—

Exploit Today

0-100

Published: Oct 5, 2026 · Last modified: Oct 6, 2026 · CWE-15

EPSS · 30d

0.2%EPSS · 30 days0.2%

2026-10-052026-10-21

Technical description

Legcord 1.1.0 through 1.3.0 contains a configuration injection vulnerability that allows script in the Discord page to write any config key via the window.legcord settings.setConfig bridge. Attackers exploiting a Discord XSS can set additionalArguments to persistently add --proxy-server and --ignore-certificate-errors switches, routing all client traffic through an interception proxy.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2025-68403—

1.1%

——0An external control of system or configuration setting vulnerability has been reported to affect QuRouter. If a local attacker gains an administrator account, they can then exploit the vulnerability to modify data on the system. We have already fixed the vulnerability in the following version: QuRouter 2.7.2.113 and later3d CVE-2026-110845—

25.7%

——8n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a code execution vulnerability in the Git node Log operation, which fails to strip a repository's local git configuration before invoking an external program. Authenticated members who can point the node, including as an agent tool, at a repository whose local configuration they control can execute programs as the n8n process user.8d CVE-2026-962185.5 MED

45.3%

——14Improper access control in Windows Update Stack allows an authorized attacker to perform tampering locally.6d CVE-2026-961887.3 HIG

29.2%

——9External control of system or configuration setting in Microsoft PowerToys allows an authorized attacker to elevate privileges locally.9d CVE-2026-730277.8 HIG

29.0%

——9External control of system or configuration setting in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally.6d CVE-2026-1078188.4 HIG

25.7%

——8MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster during the next service restart. A database user with FILE privilege and a secure-file-priv configuration permitting writes to /run/mysqld could create that file and inject attacker-controlled environment values into the restarted service. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.8d