CVE-2026-108682
Low · CVSS 2.1Published 2026-10-11
CVSS
2.1
Low
EPSS
—
exploit probability
Active Exploit
No
not yet listed
What is CVE-2026-108682?
A weakness has been identified in zhayujie CowAgent up to 2.1.6. The affected element is the function read of the file /upload of the component Web Console. This manipulation causes denial of service. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score Explained
CVSS 2.1 is Low severity. Impact is limited and exploitation is difficult. Patch when convenient.
EPSS Exploitation Probability
No EPSS score yet — model needs more data on this CVE.
References & Patches
- ›https://github.com/hackerguopeng/cve/tree/main/CowAgent_Web_Upload_File_Directory_DoS_Report
- ›https://vuldb.com/cve/CVE-2026-108682
- ›https://vuldb.com/submit/958012
- ›https://vuldb.com/vuln/416390
- ›https://vuldb.com/vuln/416390/cti
Track vulnerabilities for your stack
Tell us what tech you run — Node.js, Python, Java, nginx, whatever — and get a weekly email when new CVEs affect it.
Recent CVEs
- CVE-2026-104703Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.—
- CVE-2026-108770A weakness has been identified in Appwrite up to 2.3.0. This vulnerability affects the function PublicHostname of the file src/Appwrite/Platform/Modules/Avatars/Http/Screenshots/Get.php of the component Browser Screenshot Service. This manipulation of the argument url causes server-side request forgery. The attack can be initiated remotely. Upgrading to version 2.4.0 is able to resolve this issue. Patch name: 393255e7302ae5503331d45802e2eee01c6a47fe. You should upgrade the affected component.6.9
- CVE-2026-108772A security vulnerability has been detected in bleenco abstruse up to 2.1.0. This issue affects the function filepath.Join of the file server/api/worker/download_cache.go of the component Cache Endpoint. Such manipulation of the argument File leads to path traversal. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.5.5
- CVE-2026-108773A vulnerability was detected in erzhongxmu JEEWMS up to 2026.09.27-W39. Impacted is the function docheck of the file src/main/java/com/zzjee/wm/controller/WmOmNoticeHController.java. Performing a manipulation of the argument goodscode results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.2.1
- CVE-2026-108769A security flaw has been discovered in zhayujie CowAgent up to 2.2.0. This affects an unknown part of the file Markdown.tsx of the component Markdown Rendering. The manipulation results in denial of service. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.2.1
- CVE-2026-108978Heap-based buffer overflow vulnerability in Samsung Opensource rlottie allows Buffer Overflow via Environment Variables.
This issue affects rlottie: e57b094f03c39a751a1fded6f7d6c13f1ed95ec9.5.5