CVE-2026-109190

MediumCVSS 6.3/10Last modified Oct 16, 2026

Description

A vulnerability has been found in conductor-oss conductor 3.31.2. This affects the function ListApiToolsTask.start of the file ListApiToolsTask.java of the component API Tool Configuration. The manipulation of the argument specUrl leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published: Oct 13, 2026
Last modified: Oct 16, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1091914.3The Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy plugin for WordPress is vulnerable to Sensitive Information Ex CVE-2026-1091937.2The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via t CVE-2026-1091946.4A flaw was found in Red Hat Quay. The build trigger management application programming interface (API) fails to verify whether a requested t CVE-2026-1091953.1A flaw was found in Quay. An authenticated attacker can access repository auto-prune configurations from other namespaces, leading to unauth CVE-2026-1091987.2The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user CVE-2026-1091998.8LogicalDOC Community Edition through 9.3 contains a code injection vulnerability that allows authenticated users to execute OS commands by s CVE-2026-10927.5GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.10 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 CVE-2026-109208.3Insufficient validation of untrusted input in WebShare in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker who had comp CVE-2026-1092006.4LogicalDOC Community Edition through 9.3 contains a server-side request forgery vulnerability in the default-enabled XMLConverter that fetch CVE-2026-1092018.3LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in SoapDocumentService operations that allows authen CVE-2026-1092026.5LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the zip-export servlet that allows authenticated CVE-2026-1092036.5LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the ConvertPdf servlet that allows authenticated