CVE-2026-108335: HITACHIVANTARA
- Severity
- 9.1 (CRITICAL)
- Vendor
- HITACHIVANTARA
- Patch status
- Unknown
- Published
- 2026-10-14T22:17:22.290
- Modified
- 2026-10-14T22:17:22.290
Why it matters
This matters because the affected product may allow code execution. Prioritize systems that are internet-facing or have privileged access to other infrastructure.
Recommended admin actions
- Prioritize validation immediately due to critical CVSS severity.
- Review logs for suspicious activity related to the affected application or component.
Technical summary
When the password reset functionality is enabled, and email is configured, an attacker could take over any account using a brute-force attack. There is no rate limiting on the attempts to enter the reset code, leading to the possibility of a brute force solution to the password reset challenge. An attacker could gain administrative access to the application and perform actions like configuring the service or requesting log collection. Device credentials and customer data cannot be accessed with this vulnerability.
View the official NVD record for CVE-2026-108335
CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.
VULNERABILITY PULSE
824 RECORDS
SECURE FEED ACTIVE
| AFFECTED PRODUCT | ACTION | ||
|---|---|---|---|
| CVE-2026-107594 |
File Upload to Order PATCH
Reporter: CONTACT
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-55572 |
e107 is a content management system (CMS) PATCH
Reporter: SECURITY-ADVISORIES
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-77524 |
KEDA is a Kubernetes-based Event Driven Autoscaling component. In PATCH
Reporter: SECURITY-ADVISORIES
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-108390 |
Hestia Control Panel is a lightweight and powerful control panel for the modern web PATCH
Reporter: SECURITY-ADVISORIES
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-110392 |
an OS command ('OS command injection') vulnerability in Samsung Open Source QA-Board
Reporter: PSIRT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-93388 |
Printcart Store – Web to Print Product Designer for WooCommerce
Reporter: SECURITY
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-110002 |
Snazzy Social Media Feed
Reporter: SECURITY
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-97657 |
Abandoned Cart Pro for WooCommerce
Reporter: SECURITY
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-97668 |
Abandoned Cart Pro for WooCommerce
Reporter: SECURITY
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-104800 |
AGE-GATE
Reporter: SECURITY
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-87855 |
JTL-Connector for WooCommerce
Reporter: SECURITY
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-104748 |
SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications
Reporter: SECURITY
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-107424 |
M A Vinoth Kumar Frontend Dashboard frontend-dashboard
Reporter: AUDIT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-108291 |
Deserialization of Untrusted Data vulnerability in itthinx Affiliates affiliates
Reporter: AUDIT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-16740 |
TR7 ASP: from 1.0.40.236 PATCH
Reporter: ILETISIM
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-16741 |
TR7 ASP: from 1.0.40.236 PATCH
Reporter: ILETISIM
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-108065 |
Channel Software WebAlliance eCommerce [VERSION — missing]
Reporter: CVE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-59774 |
Gitea
Reporter: 88EE5874-CF24-4952-AEA0-31AFFEDB7FF2
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-76519 EXPLOITED |
Cisco Secure Email
Reporter: PSIRT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-55573 |
e107 is a content management system (CMS) PATCH
Reporter: SECURITY-ADVISORIES
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-55680 |
WeGIA is a web manager for charitable institutions PATCH
Reporter: SECURITY-ADVISORIES
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-55683 |
WeGIA is a web manager for charitable institutions PATCH
Reporter: SECURITY-ADVISORIES
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-55684 |
WeGIA is a web manager for charitable institutions PATCH
Reporter: SECURITY-ADVISORIES
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-89310 |
JTL-WMS
Reporter: A6D3DC9E-0591-4A13-BCE7-0F5B31FF6158
|
9.4
CRITICAL
|
VIEW RECORD |
| CVE-2020-37282 |
office-converter
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-110612 |
vlife
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-110631 |
Komodo
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-110634 |
git-diff PATCH
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-110635 |
webp-converter PATCH
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-110636 |
pypdftk
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-110638 |
doc-recog
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-110639 |
@mborne/extract PATCH
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-110640 |
Whisper-node
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-110643 |
transcribe2texts
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-110644 |
nodejs-whisper
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-110645 |
Video-stitch PATCH
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-110649 |
Stills PATCH
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-110650 |
The thumbnail Python package
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-101950 |
Junos OS
Reporter: SIRT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-101956 |
Junos OS
Reporter: SIRT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-101967 |
Junos OS Evolved
Reporter: SIRT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-101980 |
Junos OS
Reporter: SIRT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-101986 |
Junos OS
Reporter: SIRT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-101990 |
Junos OS
Reporter: SIRT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-102031 |
Junos OS Evolved
Reporter: SIRT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-102175 |
Junos OS
Reporter: SIRT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-102178 |
Junos OS
Reporter: SIRT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-102182 |
the kmd component of Juniper Networks Junos OS on MX Series PATCH
Reporter: SIRT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-109439 |
Lantronix XPress-DR and XPress-DR-I (CoBos-family) firmware
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-33792 |
Junos OS
Reporter: SIRT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-33796 |
Junos OS
Reporter: SIRT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-101954 |
Junos OS
Reporter: SIRT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-101982 |
Junos OS
Reporter: SIRT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-101983 |
Junos OS
Reporter: SIRT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-103415 |
ECLIPSE
Reporter: EMO
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-77371 |
Product identification pending PATCH
Reporter: SECURITY-ADVISORIES
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-92152 |
Product identification pending PATCH
Reporter: SECURITY-ADVISORIES
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-110536 |
DIR-868L
Reporter: CNA
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-110862 |
Better Auth from 1.4.0-beta.18 PATCH
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-110447 |
Collabora Online Built-in CODE Server PATCH
Reporter: CVE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-14851 |
Copart’s online billing service
Reporter: CVE-COORDINATION
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2020-37281 |
Gravitee API Management
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-110616 |
NullHub
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-110628 |
Kan 0.5.5
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-110632 |
MyReport Updater
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-110646 |
Beganovich snappdf from 1.1.0 PATCH
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-15176 |
NGINX Plus
Reporter: F5SIRT
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-93479 |
NGINX Plus
Reporter: F5SIRT
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-97205 |
NGINX Plus
Reporter: F5SIRT
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-101955 |
Junos OS
Reporter: SIRT
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-101997 |
Junos OS
Reporter: SIRT
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-102037 |
Junos OS
Reporter: SIRT
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-102062 |
Junos OS
Reporter: SIRT
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-102068 |
Junos OS Evolved
Reporter: SIRT
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-102070 |
Junos OS
Reporter: SIRT
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-102084 |
the VPN daemon of Juniper Networks Junos OS on SRX Series PATCH
Reporter: SIRT
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-33789 |
Junos OS
Reporter: SIRT
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-102748 |
Dgraph is an open source distributed GraphQL database PATCH
Reporter: SECURITY-ADVISORIES
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-110770 |
Databasus 3.7.0
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-110858 |
GitPython from 3.1.30 PATCH
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-92097 |
Click to Chat – HoliThemes
Reporter: SECURITY
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-102893 |
Zulip is an open-source team collaboration tool. In Zulip Server PATCH
Reporter: SECURITY-ADVISORIES
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-102476 |
Product identification pending
Reporter: EMO
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-85714 |
Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files PATCH
Reporter: SECURITY-ADVISORIES
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-108335 |
HITACHIVANTARA
Reporter: SECURITY.VULNERABILITIES
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-108336 |
HITACHIVANTARA
Reporter: SECURITY.VULNERABILITIES
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-110864 |
Better Auth from 1.5.0-beta.12 PATCH
Reporter: DISCLOSURE
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-86002 |
Dokku is a docker-powered platform as a service. In Dokku PATCH
Reporter: SECURITY-ADVISORIES
|
9
CRITICAL
|
VIEW RECORD |
| CVE-2026-91881 |
Dell Terraform Provider for Redfish PATCH
Reporter: SECURITY_ALERT
|
9
CRITICAL
|
VIEW RECORD |
| CVE-2026-110867 |
Renovate PATCH
Reporter: DISCLOSURE
|
9
CRITICAL
|
VIEW RECORD |
| CVE-2026-105429 |
the NetBird client SSH configuration manager (client/ssh/config/manager.go) in NetBird PATCH
Reporter: 33C584B5-0579-4C06-B2A0-8D8329FCAB9C
|
8.9
HIGH
|
VIEW RECORD |
| CVE-2026-107126 |
The WP Booking System WordPress plugin PATCH
Reporter: CONTACT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-86799 |
The Forms WordPress plugin PATCH
Reporter: CONTACT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-105106 |
Koha PATCH
Reporter: 309F9EA4-E3E9-4C6C-B79D-E8EB01244F2C
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-104795 |
REDHAT
Reporter: SECALERT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-106599 |
Deserialization of Untrusted Data vulnerability in Brainstorm Force SureCart surecart
Reporter: AUDIT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-71184 |
Gitea
Reporter: 88EE5874-CF24-4952-AEA0-31AFFEDB7FF2
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-87093 |
MOVEit Transfer PATCH
Reporter: SECURITY
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-89067 |
MOVEit Transfer PATCH
Reporter: SECURITY
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-101966 |
the jti-dialoutd of Juniper Networks Junos OS Evolved
Reporter: SIRT
|
8.8
HIGH
|
VIEW RECORD |
About the Vulnerability Pulse CVE Feed
The Vulnerability Pulse feed tracks live CVE advisories sourced from the National Vulnerability Database and vendor security disclosures. It is designed for SOC analysts, IT administrators, and security teams who need a fast, filterable view of current vulnerabilities without digging through raw NVD data.
How to Use the CVE Advisory Tracker
Use the severity filters to narrow results to Critical or High priority vulnerabilities. Filter by vendor to focus on software and hardware relevant to your environment. Export to CSV for reporting, ticketing, or patch prioritization workflows.
What Is a CVE Advisory?
A CVE (Common Vulnerabilities and Exposures) advisory is a public disclosure of a security vulnerability assigned a unique identifier by MITRE. Advisories include severity scores (CVSS), affected versions, and remediation guidance. Monitoring CVE advisories is a core function of vulnerability management programs and SOC operations.
CVE Analysis & Writeups
For in-depth analysis of specific vulnerabilities, visit the IT Knowledge Bases blog for CVE breakdowns, exploitation analysis, and remediation guidance written for security practitioners.