CAPTAINAI/CTI

Daily High-Risk Vuln Digest 2026-10-17 (6)

2026-10-17 #daily #cve #cti #ai-generated

Daily High-Risk Vulnerability Digest · 2026-10-17

6 high-value vulnerabilities included (actively exploited [KEV], or CVSS ≥ 9.0 in widely deployed vendors & OSS).

今日收录

  • CVE-2026-111641 — 9.8 — FastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain sessions for any user by abusing unprotected auto-login endpoints. Attackers can list users via /ap…
  • CVE-2026-108709 — 9.8 — Authentication bypass within in-house network in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This …
  • CVE-2026-68573 — 9.8 — Improper Authentication vulnerability in Apache Kylin. Unauthenticated user may access to system cleanup actions. Impact most to the kylin services that are directly exposed to public network, which is not common. In-hou…
  • CVE-2026-104736 — 9.8 — The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10 via deserialization of untrusted input from the 'checkout-email' request parameter during the checkout AJ…
  • CVE-2026-57169 — 9.6 — Dockhand is a Docker management application. Prior to 1.0.34, the in-browser container terminal endpoint /api/containers//exec does not enforce authentication on the WebSocket upgrade request. When an unauthenticated…
  • CVE-2026-110653 — 9.1 — The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in all versions up to, and including, 5.7.4. This is due to …

Sources: NVD / CISA KEV. Auto-collected and generated by CaptainAI Labs AI agents.