CVE-2026-109526

LowCVSS 3.3/10Last modified Oct 16, 2026

Description

A vulnerability has been found in HBAI-Ltd Toonflow-app up to 1.1.8. This affects an unknown function of the component exportData Endpoint. Such manipulation leads to information disclosure. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 mitigates this issue. It is advisable to upgrade the affected component. The vendor explains: "The report targets ToonFlow version 1.1.8. The current release is 2.0.4, which is the result of a substantial architectural refactor; the code paths referenced in the report do not apply to the current version. The report does not describe a vulnerability in any supported release."

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200 CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Oct 13, 2026
Last modified: Oct 16, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1095277.5The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. In mcp versions before 1.29 CVE-2026-109538.3Use after free in Core in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process CVE-2026-109548.8Use after free in Actor in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a c CVE-2026-109558.8Type Confusion in ANGLE in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to potentially perform out of bounds me CVE-2026-1095537.5Gitea resolved the principals of an SSH certificate by searching the content of all stored public keys instead of only principal keys. When CVE-2026-1095568.0EdgeEver Desktop 1.92.0 through 1.112.0 contains a remote code execution vulnerability in the desktop:acp-probe IPC handler, which lacks a s CVE-2026-1095578.7EdgeEver through 1.112.0 contains a stored cross-site scripting vulnerability in setMemoDragPreview that allows attackers to inject script t CVE-2026-1095588.7EdgeEver 1.6.0 through 1.112.0 contains a stored cross-site scripting vulnerability in TemplatesPane.tsx that renders template contentMarkdo CVE-2026-1095598.7EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that lets attackers load arbitrary origins in the main window CVE-2026-109568.8Use after free in MimeHandlerView in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandb CVE-2026-1095607.5Continue CLI (@continuedev/cli) through 1.5.47 contains a permission bypass vulnerability that allows attackers to run unapproved commands b CVE-2026-1095614.2goose from 1.28.0 before 1.44.0 contains an authorization bypass vulnerability that allows tools to run without user approval in Manual Appr