Pending AI Enrichment

This vulnerability was recently detected via the live feed and has not yet been processed by Precogs AI's context enrichment engine. The data below represents raw telemetric data.

RAW NVD TELEMETRY

CVE-2026-108675

CVSS Base Score
4.3 MEDIUM
Primary Weakness
CWE-862
Published Date
Oct 10, 2026
Data Source
NVD API

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysAnnouncementController editIzTop handler that allows low-privileged authenticated users to change announcement pin status. Attackers can send POST or PUT requests with any announcement id to pin or unpin system notices shown at the top for all users.

Related Vulnerabilitiesvia CWE-862

CVE-2026-340537.1 HIGH

Missing Authorization in OpenEMR AJAX endpoint 'handle_deletions.php' before 8.0.0.3. Allows any authenticated user to irreversibly delete procedure orders and specimens for any patient.

CWE-862
CVE-2026-42618.8 HIGH

The Expire Users plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.

CWE-862
CVE-2026-36515.3 MEDIUM

The Build App Online plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.

CWE-862
CVE-2026-36455.3 MEDIUM

The Punnel – Landing Page Builder plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.

CWE-862
CVE-2026-33355.3 MEDIUM

The Canto plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.

CWE-862
CVE-2026-29418.8 HIGH

The Linksy Search and Replace plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'linksy_search_and_replace_item_details' function in all versions up to, and including, 1.

CWE-862

Is your system affected?

Precogs AI detects CVE-2026-108675 in compiled binaries, LLMs, and application layers — even without source code access.

Request Deep AnalysisBook a demo