CVE-2026-110632: MyReport Updater
- Severity
- 9.2 (CRITICAL)
- Vendor
- REPORT ONE
- Affected versions
- 0 through 2.1.1
- Patch status
- Unknown
- Published
- 2026-10-14T15:17:16.143
- Modified
- 2026-10-14T19:17:10.787
Why it matters
This matters because the affected product may be exploitable without valid credentials. Internet-facing deployments should be reviewed first.
Recommended admin actions
- Prioritize validation immediately due to critical CVSS severity.
- Compare installed versions against the affected version range in the advisory.
- Treat internet-facing systems as higher priority.
Technical summary
Report One MyReport Updater through 2.1.1 exposes an unauthenticated gRPC service on TCP port 9095 that allows remote attackers to redirect the SYSTEM updater by invoking the UpdateConfigReferent method. Attackers can point the updater to a malicious reference server serving modified module archives with matching MD5 digests to write files and execute code as SYSTEM.
View the official NVD record for CVE-2026-110632
CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.
VULNERABILITY PULSE
993 RECORDS
SECURE FEED ACTIVE
| AFFECTED PRODUCT | ACTION | ||
|---|---|---|---|
| CVE-2026-48382 |
ADOBE
Reporter: PSIRT
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-48383 |
ADOBE
Reporter: PSIRT
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-90532 |
ADOBE
Reporter: PSIRT
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-105899 |
ADOBE
Reporter: PSIRT
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-106622 |
ADOBE
Reporter: PSIRT
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-106624 |
ADOBE
Reporter: PSIRT
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-107594 |
File Upload to Order PATCH
Reporter: CONTACT
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-55572 |
e107 is a content management system (CMS) PATCH
Reporter: SECURITY-ADVISORIES
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-103848 |
ADOBE
Reporter: PSIRT
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-105895 |
ADOBE
Reporter: PSIRT
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-75732 |
ADOBE
Reporter: PSIRT
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-105903 |
ADOBE
Reporter: PSIRT
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-106612 |
ADOBE
Reporter: PSIRT
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-97381 |
LegacyUpdate PATCH
Reporter: SECURITY-ADVISORIES
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-77524 |
KEDA is a Kubernetes-based Event Driven Autoscaling component. In PATCH
Reporter: SECURITY-ADVISORIES
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-108390 |
Hestia Control Panel is a lightweight and powerful control panel for the modern web PATCH
Reporter: SECURITY-ADVISORIES
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-104252 |
Vitess is a database clustering system for horizontal scaling of MySQL PATCH
Reporter: SECURITY-ADVISORIES
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-110392 |
an OS command ('OS command injection') vulnerability in Samsung Open Source QA-Board
Reporter: PSIRT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-93388 |
Printcart Store – Web to Print Product Designer for WooCommerce
Reporter: SECURITY
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-110002 |
Snazzy Social Media Feed
Reporter: SECURITY
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-97657 |
Abandoned Cart Pro for WooCommerce
Reporter: SECURITY
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-97668 |
Abandoned Cart Pro for WooCommerce
Reporter: SECURITY
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-104800 |
AGE-GATE
Reporter: SECURITY
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-87855 |
JTL-Connector for WooCommerce
Reporter: SECURITY
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-104748 |
SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications
Reporter: SECURITY
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-107424 |
M A Vinoth Kumar Frontend Dashboard frontend-dashboard
Reporter: AUDIT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-108291 |
Deserialization of Untrusted Data vulnerability in itthinx Affiliates affiliates
Reporter: AUDIT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-16740 |
TR7 ASP: from 1.0.40.236 PATCH
Reporter: ILETISIM
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-16741 |
TR7 ASP: from 1.0.40.236 PATCH
Reporter: ILETISIM
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-108065 |
Channel Software WebAlliance eCommerce [VERSION — missing]
Reporter: CVE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-59774 |
Gitea
Reporter: 88EE5874-CF24-4952-AEA0-31AFFEDB7FF2
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-76519 EXPLOITED |
Cisco Secure Email
Reporter: PSIRT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-55573 |
e107 is a content management system (CMS) PATCH
Reporter: SECURITY-ADVISORIES
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-102238 |
Product identification pending
Reporter: SECURE
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-90531 |
ADOBE
Reporter: PSIRT
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-106620 |
ADOBE
Reporter: PSIRT
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-75994 |
ADOBE
Reporter: PSIRT
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-110136 |
chrome PATCH
Reporter: CHROME-CVE-ADMIN
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-110142 |
chrome PATCH
Reporter: CHROME-CVE-ADMIN
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-110149 |
chrome PATCH
Reporter: CHROME-CVE-ADMIN
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-110152 |
chrome PATCH
Reporter: CHROME-CVE-ADMIN
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-110159 |
chrome PATCH
Reporter: CHROME-CVE-ADMIN
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-110161 |
chrome PATCH
Reporter: CHROME-CVE-ADMIN
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-110165 |
chrome PATCH
Reporter: CHROME-CVE-ADMIN
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-89310 |
JTL-WMS
Reporter: A6D3DC9E-0591-4A13-BCE7-0F5B31FF6158
|
9.4
CRITICAL
|
VIEW RECORD |
| CVE-2026-106629 |
ADOBE
Reporter: PSIRT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-106630 |
ADOBE
Reporter: PSIRT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-63146 |
Omnispace Agora Project PATCH
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-83662 |
ADOBE
Reporter: PSIRT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-49950 |
Xorbits Xoscar
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-90530 |
ADOBE
Reporter: PSIRT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2020-37282 |
office-converter
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-110612 |
vlife
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-110631 |
Komodo
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-110634 |
git-diff PATCH
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-110635 |
webp-converter PATCH
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-110636 |
pypdftk
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-110638 |
doc-recog
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-110639 |
@mborne/extract PATCH
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-110640 |
Whisper-node
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-110643 |
transcribe2texts
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-110644 |
nodejs-whisper
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-110645 |
Video-stitch PATCH
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-110649 |
Stills PATCH
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-110650 |
The thumbnail Python package
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-101950 |
Junos OS
Reporter: SIRT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-101956 |
Junos OS
Reporter: SIRT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-101967 |
Junos OS Evolved
Reporter: SIRT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-101980 |
Junos OS
Reporter: SIRT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-101986 |
Junos OS
Reporter: SIRT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-101990 |
Junos OS
Reporter: SIRT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-102031 |
Junos OS Evolved
Reporter: SIRT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-102175 |
Junos OS
Reporter: SIRT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-102178 |
Junos OS
Reporter: SIRT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-102182 |
the kmd component of Juniper Networks Junos OS on MX Series PATCH
Reporter: SIRT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-109439 |
Lantronix XPress-DR and XPress-DR-I (CoBos-family) firmware
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-33792 |
Junos OS
Reporter: SIRT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-33796 |
Junos OS
Reporter: SIRT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-101954 |
Junos OS
Reporter: SIRT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-101982 |
Junos OS
Reporter: SIRT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-101983 |
Junos OS
Reporter: SIRT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-103415 |
ECLIPSE
Reporter: EMO
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-77371 |
Product identification pending PATCH
Reporter: SECURITY-ADVISORIES
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-92152 |
Product identification pending PATCH
Reporter: SECURITY-ADVISORIES
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-110536 |
DIR-868L
Reporter: CNA
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-110447 |
Collabora Online Built-in CODE Server PATCH
Reporter: CVE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-14851 |
Copart’s online billing service
Reporter: CVE-COORDINATION
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2020-37281 |
Gravitee API Management
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-110616 |
NullHub
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-110628 |
Kan 0.5.5
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-110632 |
MyReport Updater
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-110646 |
Beganovich snappdf from 1.1.0 PATCH
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-15176 |
NGINX Plus
Reporter: F5SIRT
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-93479 |
NGINX Plus
Reporter: F5SIRT
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-97205 |
NGINX Plus
Reporter: F5SIRT
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-101955 |
Junos OS
Reporter: SIRT
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-101997 |
Junos OS
Reporter: SIRT
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-102037 |
Junos OS
Reporter: SIRT
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-102062 |
Junos OS
Reporter: SIRT
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-102068 |
Junos OS Evolved
Reporter: SIRT
|
9.2
CRITICAL
|
VIEW RECORD |
About the Vulnerability Pulse CVE Feed
The Vulnerability Pulse feed tracks live CVE advisories sourced from the National Vulnerability Database and vendor security disclosures. It is designed for SOC analysts, IT administrators, and security teams who need a fast, filterable view of current vulnerabilities without digging through raw NVD data.
How to Use the CVE Advisory Tracker
Use the severity filters to narrow results to Critical or High priority vulnerabilities. Filter by vendor to focus on software and hardware relevant to your environment. Export to CSV for reporting, ticketing, or patch prioritization workflows.
What Is a CVE Advisory?
A CVE (Common Vulnerabilities and Exposures) advisory is a public disclosure of a security vulnerability assigned a unique identifier by MITRE. Advisories include severity scores (CVSS), affected versions, and remediation guidance. Monitoring CVE advisories is a core function of vulnerability management programs and SOC operations.
CVE Analysis & Writeups
For in-depth analysis of specific vulnerabilities, visit the IT Knowledge Bases blog for CVE breakdowns, exploitation analysis, and remediation guidance written for security practitioners.