CVE-2026-108682

MediumCVSS 5.4/10Last modified Oct 14, 2026

Description

A weakness has been identified in zhayujie CowAgent up to 2.1.6. The affected element is the function read of the file /upload of the component Web Console. This manipulation causes denial of service. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-404

Affected software

Vendor	Product	Versions
zhayujie	CowAgent	2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.1.4; 2.1.5; 2.1.6

References

Timeline

Published: Oct 11, 2026
Last modified: Oct 14, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1086834.3A security vulnerability has been detected in zhayujie CowAgent up to 2.1.9. The impacted element is an unknown function of the component Me CVE-2026-1086846.3A vulnerability was detected in erzhongxmu Jeewms up to 3.7. This affects the function getTreeData of the file src/main/java/com/jeecg/demo/CVE-2026-1086853.7The WP Post Author WordPress plugin before 4.2.0 does not check that the account was created before updating its profile during front-end r CVE-2026-1086863.7The WP Post Author WordPress plugin before 4.2.0 does not restrict the integration settings it returns to visitors, allowing unauthenticate CVE-2026-1086884.3Eladmin through 2.7 contains a missing authorization vulnerability in the LocalStorageController uploadPicture handler that allows low-privi CVE-2026-1086895.4Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows authenticated users to write into other users' AI c CVE-2026-1086904.3mall4j through 4.0 contains an information disclosure vulnerability that allows authenticated customers to read other shoppers' cart items d CVE-2026-1086915.4mall4j through 4.0 contains an improper authorization vulnerability that allows authenticated storefront customers to delete other shoppers'CVE-2026-1086926.51Panel-dev CordysCRM from 1.9.0 before 1.9.2 contains a missing authorization vulnerability in eight ModuleFieldController /field/source dat CVE-2026-1086937.8ImageMagick on Windows through 7.1.2-33 and 6.9.13-58 contains an uncontrolled search path vulnerability in NTGhostscriptEXE() that launches CVE-2026-1086946.5ConvertX through 0.19.0 contains an arbitrary file read vulnerability that allows authenticated users to read server files because src/conve CVE-2026-1086957.1MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accounts to modify marketp