CVE-2026-108769

Publié : 11 octobre 2026

Modifié : 11 octobre 2026

Score CVSS

4.3

MEDIUM

Description détaillée

A security flaw has been discovered in zhayujie CowAgent up to 2.2.0. This affects an unknown part of the file Markdown.tsx of the component Markdown Rendering. The manipulation results in denial of service. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Références et Patchs

https://github.com/outlookgp/CVE/tree/main/CowAgent_Markdown_Stream_Render_DoS_Report https://vuldb.com/cve/CVE-2026-108769 https://vuldb.com/submit/958041 https://vuldb.com/vuln/416551 https://vuldb.com/vuln/416551/cti

Dernières Vulnérabilités

CVE-2026-108978

Heap-based buffer overflow vulnerability in Samsung Opensource rlottie allows Buffer Overflow via Environment Variables. This issue affects rlottie: e57b094f03c39a751a1fded6f7d6c13f1ed95ec9.

VOIR DÉTAILS

CVE-2026-108976

GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete fix for CVE-2026-79992.

VOIR DÉTAILS

CVE-2026-108963

databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., mariadb-dump) with a database name that can be specified by any authenticated user. For example, --result-file=/app/public/index.php can write to index.php. In other words, quoting prevents OS command injection in mariadb-dump, but the argument injection alone is sufficient for code execution indirectly. NOTE: the project's composer.json file does not indicate an independently published databasement Composer package.

VOIR DÉTAILS