CVE-2026-108948
A vulnerability has been found in code-projects Online Reviewer System 1.0. This vulnerability affects unknown code of the file /reviewer/sy
CVSS
5.4
Medium
EPSS
0.3%
p18
KEV
—
Exploit Today
5
0-100
Published: Oct 13, 2026 · Last modified: Oct 13, 2026 · CWE-913 · CWE-915
0.3%EPSS · 30 days0.3%
2026-10-132026-10-14
A vulnerability has been found in code-projects Online Reviewer System 1.0. This vulnerability affects unknown code of the file /reviewer/system/system/admins/manage/users/btn_functions.php of the component User Profile Update Handler. The manipulation of the argument usertype_id leads to dynamically-determined object attributes. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1027345.5 MED2.2%
——1asteval is a Python expression evaluator designed for restricted execution. Prior to 1.0.9, in asteval/astutils.py, the default Interpreter with numpy enabled exposes a ctypes type and permits from_address memory access. safe_getattr blocks the ctypes module but not reachable ctypes type objects, while attribute assignments use unfiltered setattr instead of safe_setattr. An attacker-controlled expression can derive an address with id, read memory through from_address, and write through an attribute assignment. The expression can read or corrupt arbitrary process memory, escape the intended sandbox, execute code, disclose secrets, or crash the host process. This issue is fixed in version 1.0.9.2dCVE-2026-92119—19.9%
——6REST API Mass Assignment vulnerability in Apache Allura.
This issue affects Apache Allura: through 1.21.0.
Users are recommended to upgrade to version 1.22.0, which fixes the issue.2dCVE-2026-1091868.8 HIG27.9%
——8jshERP through 3.6 contains a mass assignment vulnerability in the UserController update handler that allows authenticated users to overwrite protected fields including tenant_id and password. Attackers can send a crafted PUT /user/update body to switch into another tenant on next login or overwrite other users' password hashes for account takeover.3dCVE-2026-1088197.3 HIG22.7%
——7A security flaw has been discovered in agno-agi agno up to 3.0.6/3.1.1. This vulnerability affects the function exec of the component Agent Orchestration Layer. Performing a manipulation of the argument code results in dynamically-managed code resources. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance.2dCVE-2026-1087408.3 HIG24.3%
——7GoatCounter through 2.7.0 contains a mass assignment privilege escalation vulnerability in the userPrefSave handler that allows logged-in users to modify protected account fields via form-encoded requests. Attackers with read-only access can POST user.access[all]=* and user.email_verified=true to /user/pref, bypassing readonly tags to gain superuser or admin access.2dCVE-2026-103663—52.6%
——16Ollama is vulnerable to path traversal in the `/api/pull` endpoint due to insufficient validation of layer digests by the `digestToPath` function. An unauthenticated remote attacker can specify a path traversal sequence as a layer digest, causing a malicious binary to be written outside the model store.
Critically if the server process has write access to `/usr/lib/ollama` (the default in most Ollama Docker images), an attacker can write the malicious file to that directory. On the next server restart, the file is loaded and executed, resulting in remote code execution as root.
This issue was fixed in version 0.35.0.7d