CVE-2026-108858: Predibase LoRAX
- Severity
- 6.8 (MEDIUM)
- Vendor
- PREDIBASE LORAX THROUGH
- Affected versions
- Through 0.12.1
- Patch status
- Unknown
- Published
- 2026-10-11T14:17:05.640
Why it matters
This matters because the issue affects identity or token handling. Successful exploitation could allow unauthorized authentication, client manipulation, or access to protected services.
Recommended admin actions
- Review during normal vulnerability triage unless the affected system is internet-facing or business-critical.
- Compare installed versions against the affected version range in the advisory.
Technical summary
Predibase LoRAX through 0.12.1 contains a sensitive information exposure vulnerability that writes the caller-supplied api_token from POST /generate request bodies into router logs. Attackers with access to router logs or OTLP trace backends can recover other users' private-adapter tokens recorded through the instrumented GenerateParameters span field.
View the official NVD record for CVE-2026-108858
CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.
VULNERABILITY PULSE
730 RECORDS
SECURE FEED ACTIVE
| AFFECTED PRODUCT | ACTION | ||
|---|---|---|---|
| CVE-2026-89111 |
The SAP Cloud SDK for Python
Reporter: CNA
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-97229 |
GitLab PATCH
Reporter: CVE
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-85947 |
Progress MarkLogic Server 12.x releases PATCH
Reporter: SECURITY
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-85948 |
Progress MarkLogic Server 12.x releases PATCH
Reporter: SECURITY
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-85955 |
Progress MarkLogic Server 12.x releases PATCH
Reporter: SECURITY
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-77366 |
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults PATCH
Reporter: SECURITY-ADVISORIES
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-96012 |
IBM Db2 Mirror for i 7.4, 7.5, and 7.6
Reporter: PSIRT
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-96119 |
IBM
Reporter: PSIRT
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-89107 |
SAP
Reporter: CNA
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-89110 |
SAP
Reporter: CNA
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-109390 |
AnyDesk PATCH
Reporter: CVE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-57118 |
PraisonAI PATCH
Reporter: SECURITY-ADVISORIES
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-109575 |
Data Plane API EE PATCH
Reporter: CVE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-90920 |
IBM
Reporter: PSIRT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-87689 |
The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store PATCH
Reporter: CVE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-85956 |
Progress MarkLogic Server 12.x releases PATCH
Reporter: SECURITY
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-9191 |
Progress MarkLogic Server 12.x releases PATCH
Reporter: SECURITY
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-82101 |
IBM
Reporter: PSIRT
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-82103 |
IBM
Reporter: PSIRT
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-82110 |
IBM
Reporter: PSIRT
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-108929 |
NR268
Reporter: CNA
|
9.4
CRITICAL
|
VIEW RECORD |
| CVE-2026-63350 |
the user’s browser session and perform PLC operations
Reporter: PRODUCTCERT
|
9.4
CRITICAL
|
VIEW RECORD |
| CVE-2026-63353 |
Affected devices do not properly sanitize comment fields contained in imported trace files
Reporter: PRODUCTCERT
|
9.4
CRITICAL
|
VIEW RECORD |
| CVE-2026-63354 |
imported CSV trace files
Reporter: PRODUCTCERT
|
9.4
CRITICAL
|
VIEW RECORD |
| CVE-2026-108892 |
E1700
Reporter: CNA
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-92681 |
@neo4j/graphql PATCH
Reporter: 3B236295-4CCD-4A1F-A1C1-A72EECC8D7B6
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-108907 |
NR268
Reporter: CNA
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-109321 |
Grav Login OAuth plugin (grav-plugin-login-oauth) PATCH
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-109372 |
ZITADEL 4.x PATCH
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-108917 |
BR-6208AC
Reporter: CNA
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-108918 |
BR-6208AC
Reporter: CNA
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2025-71429 |
GPT-SoVITS
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-109566 |
Rapyd Admin from 9.0.0 PATCH
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-109569 |
sandboxed.sh
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-44828 |
Qexo PATCH
Reporter: SECURITY-ADVISORIES
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-109758 |
a Node.js 24/Express deployment
Reporter: SECURITY
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-109109 |
WL-WN530BE1-A
Reporter: CNA
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-109110 |
WL-WN592AX6
Reporter: CNA
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-109391 |
Squash
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-109399 |
SWUpdate
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-109238 |
Crawl4AI 0.7.0 PATCH
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-109357 |
LibreNMS PATCH
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-109373 |
ZITADEL 3.0.0 PATCH
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-109422 |
NetEase Cloud Music for Windows
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2020-37279 |
easy-pdf-merge 0.1.0
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-109573 |
phpMyFAQ PATCH
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-109394 |
Thirty bees
Reporter: DISCLOSURE
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-87744 |
A flaw was found in Quarkus REST Data Panache. This vulnerability
Reporter: SECALERT
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-108362 |
ra-tls-clients PATCH
Reporter: SECURITY-ADVISORIES
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-109423 |
NetEase Cloud Music for Windows
Reporter: DISCLOSURE
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-53997 |
Netherman Portal del Hermano (portaldelhermano.es) PATCH
Reporter: DISCLOSURE
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-89108 |
SAP
Reporter: CNA
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-49483 |
Product identification pending PATCH
Reporter: SECURITY-ADVISORIES
|
8.9
HIGH
|
VIEW RECORD |
| CVE-2026-44415 |
SIEMENS
Reporter: PRODUCTCERT
|
8.9
HIGH
|
VIEW RECORD |
| CVE-2026-52903 |
REDHAT
Reporter: SECALERT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-12613 |
Ministry of Justice General Directorate of Information Technology UYAP Document Editor PATCH
Reporter: ILETISIM
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-109371 |
ZITADEL 3.0.0 PATCH
Reporter: DISCLOSURE
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-77363 |
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults PATCH
Reporter: SECURITY-ADVISORIES
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-105464 |
IBM Db2 11.5.0
Reporter: PSIRT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-105465 |
IBM Db2 11.5.0
Reporter: PSIRT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-57143 |
praisonaiagents PATCH
Reporter: SECURITY-ADVISORIES
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2021-48012 |
fast-toml
Reporter: DISCLOSURE
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-84313 |
Nginx UI is a web user interface for the Nginx web server PATCH
Reporter: SECURITY-ADVISORIES
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-84316 |
Nginx UI is a web user interface for the Nginx web server PATCH
Reporter: SECURITY-ADVISORIES
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-84317 |
Nginx UI is a web user interface for the Nginx web server PATCH
Reporter: SECURITY-ADVISORIES
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-84318 |
nginx-ui PATCH
Reporter: SECURITY-ADVISORIES
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-102627 |
IBM TRIRIGA Application Platform 5.0.0
Reporter: PSIRT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-19620 |
IBM
Reporter: PSIRT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-19622 |
IBM
Reporter: PSIRT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-82096 |
IBM
Reporter: PSIRT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-82108 |
IBM
Reporter: PSIRT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-89113 |
SAP Commerce Cloud does not sufficiently validate certain user-supplied input
Reporter: CNA
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-102073 |
Product identification pending
Reporter: PRODUCTCERT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-109185 |
jshERP
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-109186 |
jshERP
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-109199 |
LogicalDOC Community Edition
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-109201 |
LogicalDOC Community Edition
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-109205 |
LogicalDOC Community Edition
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-109225 |
SGLang
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-109226 |
SGLang
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-109227 |
SGLang
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-109228 |
SGLang
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-109229 |
SGLang
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-109398 |
Gumlet php-image-resize PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-109305 |
Craft CMS from 5.10.2 PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-109308 |
Craft CMS 4.0.0 PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-109318 |
Grav Git Sync 1.0.2
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-109325 |
Grav from 2.0.22 PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-109326 |
Grav PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-109359 |
Contrast 1.8.0 PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-109363 |
ZcashFoundation Zebra 6.4.0 PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2020-37280 |
cbor-sync
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2021-48011 |
Servor 1.0.0
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-109380 |
modern-tar 0.3.5
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-109563 |
N3.js PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-18529 |
IBM Maximo Application Suite – Location Service for Esri Component 9.2, 9.1, and 9.0
Reporter: PSIRT
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-18537 |
IBM Maximo Application Suite – Location Service for Esri Component 9.2, 9.1, and 9.0
Reporter: PSIRT
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-84314 |
Nginx UI is a web user interface for the Nginx web server PATCH
Reporter: SECURITY-ADVISORIES
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2024-58390 |
Frappe PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-109608 |
Frappe ERPNext PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
About the Vulnerability Pulse CVE Feed
The Vulnerability Pulse feed tracks live CVE advisories sourced from the National Vulnerability Database and vendor security disclosures. It is designed for SOC analysts, IT administrators, and security teams who need a fast, filterable view of current vulnerabilities without digging through raw NVD data.
How to Use the CVE Advisory Tracker
Use the severity filters to narrow results to Critical or High priority vulnerabilities. Filter by vendor to focus on software and hardware relevant to your environment. Export to CSV for reporting, ticketing, or patch prioritization workflows.
What Is a CVE Advisory?
A CVE (Common Vulnerabilities and Exposures) advisory is a public disclosure of a security vulnerability assigned a unique identifier by MITRE. Advisories include severity scores (CVSS), affected versions, and remediation guidance. Monitoring CVE advisories is a core function of vulnerability management programs and SOC operations.
CVE Analysis & Writeups
For in-depth analysis of specific vulnerabilities, visit the IT Knowledge Bases blog for CVE breakdowns, exploitation analysis, and remediation guidance written for security practitioners.