CVE-2026-107193: A flaw
- Severity
- 6.5 (MEDIUM)
- Vendor
- REDHAT
- Patch status
- Unknown
- Published
- 2026-10-12T06:16:58.463
Why it matters
Vulnerability requiring standard triage and vendor validation.
Recommended admin actions
- Review during normal vulnerability triage unless the affected system is internet-facing or business-critical.
- Treat internet-facing systems as higher priority.
Technical summary
A flaw has been found in **permission filters** in the **foreman** package. The API loads a filter by its identifier and does not apply the search limit on the caller's permission. A low-privileged network attacker or user must already be allowed to delete filters for one role only. They can delete filters that belong to other unlocked roles. Those other roles then lose the access the deleted filters had granted.
View the official NVD record for CVE-2026-107193
CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.
VULNERABILITY PULSE
730 RECORDS
SECURE FEED ACTIVE
| AFFECTED PRODUCT | ACTION | ||
|---|---|---|---|
| CVE-2026-89111 |
The SAP Cloud SDK for Python
Reporter: CNA
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-97229 |
GitLab PATCH
Reporter: CVE
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-85947 |
Progress MarkLogic Server 12.x releases PATCH
Reporter: SECURITY
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-85948 |
Progress MarkLogic Server 12.x releases PATCH
Reporter: SECURITY
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-85955 |
Progress MarkLogic Server 12.x releases PATCH
Reporter: SECURITY
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-77366 |
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults PATCH
Reporter: SECURITY-ADVISORIES
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-96012 |
IBM Db2 Mirror for i 7.4, 7.5, and 7.6
Reporter: PSIRT
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-96119 |
IBM
Reporter: PSIRT
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-89107 |
SAP
Reporter: CNA
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-89110 |
SAP
Reporter: CNA
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-109390 |
AnyDesk PATCH
Reporter: CVE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-57118 |
PraisonAI PATCH
Reporter: SECURITY-ADVISORIES
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-109575 |
Data Plane API EE PATCH
Reporter: CVE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-90920 |
IBM
Reporter: PSIRT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-87689 |
The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store PATCH
Reporter: CVE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-85956 |
Progress MarkLogic Server 12.x releases PATCH
Reporter: SECURITY
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-9191 |
Progress MarkLogic Server 12.x releases PATCH
Reporter: SECURITY
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-82101 |
IBM
Reporter: PSIRT
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-82103 |
IBM
Reporter: PSIRT
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-82110 |
IBM
Reporter: PSIRT
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-108929 |
NR268
Reporter: CNA
|
9.4
CRITICAL
|
VIEW RECORD |
| CVE-2026-63350 |
the user’s browser session and perform PLC operations
Reporter: PRODUCTCERT
|
9.4
CRITICAL
|
VIEW RECORD |
| CVE-2026-63353 |
Affected devices do not properly sanitize comment fields contained in imported trace files
Reporter: PRODUCTCERT
|
9.4
CRITICAL
|
VIEW RECORD |
| CVE-2026-63354 |
imported CSV trace files
Reporter: PRODUCTCERT
|
9.4
CRITICAL
|
VIEW RECORD |
| CVE-2026-108892 |
E1700
Reporter: CNA
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-92681 |
@neo4j/graphql PATCH
Reporter: 3B236295-4CCD-4A1F-A1C1-A72EECC8D7B6
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-108907 |
NR268
Reporter: CNA
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-109321 |
Grav Login OAuth plugin (grav-plugin-login-oauth) PATCH
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-109372 |
ZITADEL 4.x PATCH
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-108917 |
BR-6208AC
Reporter: CNA
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-108918 |
BR-6208AC
Reporter: CNA
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2025-71429 |
GPT-SoVITS
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-109566 |
Rapyd Admin from 9.0.0 PATCH
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-109569 |
sandboxed.sh
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-44828 |
Qexo PATCH
Reporter: SECURITY-ADVISORIES
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-109758 |
a Node.js 24/Express deployment
Reporter: SECURITY
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-109109 |
WL-WN530BE1-A
Reporter: CNA
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-109110 |
WL-WN592AX6
Reporter: CNA
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-109391 |
Squash
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-109399 |
SWUpdate
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-109238 |
Crawl4AI 0.7.0 PATCH
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-109357 |
LibreNMS PATCH
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-109373 |
ZITADEL 3.0.0 PATCH
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-109422 |
NetEase Cloud Music for Windows
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2020-37279 |
easy-pdf-merge 0.1.0
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-109573 |
phpMyFAQ PATCH
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-109394 |
Thirty bees
Reporter: DISCLOSURE
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-87744 |
A flaw was found in Quarkus REST Data Panache. This vulnerability
Reporter: SECALERT
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-108362 |
ra-tls-clients PATCH
Reporter: SECURITY-ADVISORIES
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-109423 |
NetEase Cloud Music for Windows
Reporter: DISCLOSURE
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-53997 |
Netherman Portal del Hermano (portaldelhermano.es) PATCH
Reporter: DISCLOSURE
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-89108 |
SAP
Reporter: CNA
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-49483 |
Product identification pending PATCH
Reporter: SECURITY-ADVISORIES
|
8.9
HIGH
|
VIEW RECORD |
| CVE-2026-44415 |
SIEMENS
Reporter: PRODUCTCERT
|
8.9
HIGH
|
VIEW RECORD |
| CVE-2026-52903 |
REDHAT
Reporter: SECALERT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-12613 |
Ministry of Justice General Directorate of Information Technology UYAP Document Editor PATCH
Reporter: ILETISIM
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-109371 |
ZITADEL 3.0.0 PATCH
Reporter: DISCLOSURE
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-77363 |
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults PATCH
Reporter: SECURITY-ADVISORIES
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-105464 |
IBM Db2 11.5.0
Reporter: PSIRT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-105465 |
IBM Db2 11.5.0
Reporter: PSIRT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-57143 |
praisonaiagents PATCH
Reporter: SECURITY-ADVISORIES
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2021-48012 |
fast-toml
Reporter: DISCLOSURE
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-84313 |
Nginx UI is a web user interface for the Nginx web server PATCH
Reporter: SECURITY-ADVISORIES
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-84316 |
Nginx UI is a web user interface for the Nginx web server PATCH
Reporter: SECURITY-ADVISORIES
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-84317 |
Nginx UI is a web user interface for the Nginx web server PATCH
Reporter: SECURITY-ADVISORIES
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-84318 |
nginx-ui PATCH
Reporter: SECURITY-ADVISORIES
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-102627 |
IBM TRIRIGA Application Platform 5.0.0
Reporter: PSIRT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-19620 |
IBM
Reporter: PSIRT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-19622 |
IBM
Reporter: PSIRT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-82096 |
IBM
Reporter: PSIRT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-82108 |
IBM
Reporter: PSIRT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-89113 |
SAP Commerce Cloud does not sufficiently validate certain user-supplied input
Reporter: CNA
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-102073 |
Product identification pending
Reporter: PRODUCTCERT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-109185 |
jshERP
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-109186 |
jshERP
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-109199 |
LogicalDOC Community Edition
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-109201 |
LogicalDOC Community Edition
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-109205 |
LogicalDOC Community Edition
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-109225 |
SGLang
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-109226 |
SGLang
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-109227 |
SGLang
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-109228 |
SGLang
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-109229 |
SGLang
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-109398 |
Gumlet php-image-resize PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-109305 |
Craft CMS from 5.10.2 PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-109308 |
Craft CMS 4.0.0 PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-109318 |
Grav Git Sync 1.0.2
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-109325 |
Grav from 2.0.22 PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-109326 |
Grav PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-109359 |
Contrast 1.8.0 PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-109363 |
ZcashFoundation Zebra 6.4.0 PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2020-37280 |
cbor-sync
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2021-48011 |
Servor 1.0.0
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-109380 |
modern-tar 0.3.5
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-109563 |
N3.js PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-18529 |
IBM Maximo Application Suite – Location Service for Esri Component 9.2, 9.1, and 9.0
Reporter: PSIRT
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-18537 |
IBM Maximo Application Suite – Location Service for Esri Component 9.2, 9.1, and 9.0
Reporter: PSIRT
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-84314 |
Nginx UI is a web user interface for the Nginx web server PATCH
Reporter: SECURITY-ADVISORIES
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2024-58390 |
Frappe PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-109608 |
Frappe ERPNext PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
About the Vulnerability Pulse CVE Feed
The Vulnerability Pulse feed tracks live CVE advisories sourced from the National Vulnerability Database and vendor security disclosures. It is designed for SOC analysts, IT administrators, and security teams who need a fast, filterable view of current vulnerabilities without digging through raw NVD data.
How to Use the CVE Advisory Tracker
Use the severity filters to narrow results to Critical or High priority vulnerabilities. Filter by vendor to focus on software and hardware relevant to your environment. Export to CSV for reporting, ticketing, or patch prioritization workflows.
What Is a CVE Advisory?
A CVE (Common Vulnerabilities and Exposures) advisory is a public disclosure of a security vulnerability assigned a unique identifier by MITRE. Advisories include severity scores (CVSS), affected versions, and remediation guidance. Monitoring CVE advisories is a core function of vulnerability management programs and SOC operations.
CVE Analysis & Writeups
For in-depth analysis of specific vulnerabilities, visit the IT Knowledge Bases blog for CVE breakdowns, exploitation analysis, and remediation guidance written for security practitioners.