{ "schemaVersion": 1, "site": "https://cveboard.org", "generatedAt": "2026-10-23T19:18:11.440Z", "lastRun": "2026-10-23T19:01:02.861Z", "liveDays": 14, "filters": { "kind": null, "exploited": false, "severity": null, "ecosystems": [], "tag": "ahsay" }, "attribution": [ { "source": "CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "licence": "US government work" }, { "source": "GitHub Advisory Database", "url": "https://github.com/advisories", "licence": "CC BY 4.0" }, { "source": "Have I Been Pwned", "url": "https://haveibeenpwned.com/", "licence": "CC BY 4.0" }, { "source": "CVE Program (CVE records)", "url": "https://www.cve.org/Legal/TermsOfUse", "licence": "CVE Terms of Use", "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.", "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy." }, { "source": "FIRST EPSS", "url": "https://www.first.org/epss/", "licence": "free to use; FIRST requests attribution" } ], "incidents": [ { "id": "cve-2026-105134", "url": "https://cveboard.org/i/cve-2026-105134", "urlPt": "https://cveboard.org/pt/i/cve-2026-105134", "json": "https://cveboard.org/i/cve-2026-105134.json", "kind": "vuln", "live": true, "knownExploited": true, "severity": "critical", "title": "Ahsay AhsayCBS Command Injection Vulnerability", "summary": "Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133.", "titlePt": "Vulnerabilidade de injeção de comando no Ahsay AhsayCBS", "summaryPt": "Ahsay AhsayCBS contém uma vulnerabilidade de injeção de comando que poderia permitir que um atacante remoto execute comandos do sistema operacional por meio da manipulação do parâmetro random no endpoint /rps/api/json/UpdateReceivers.do do componente Replication Receiver. Esta vulnerabilidade pode ser encadeada com CVE-2026-105133.", "affected": [ { "vendor": "Ahsay", "product": "AhsayCBS", "defaultStatus": "unknown", "versions": [ { "version": "10.3.0", "status": "affected", "lessThan": null, "lessThanOrEqual": null }, { "version": "10.3.1", "status": "affected", "lessThan": null, "lessThanOrEqual": null }, { "version": "10.3.2", "status": "affected", "lessThan": null, "lessThanOrEqual": null }, { "version": "10.3.4", "status": "unaffected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [ "10.3.4" ] } ], "omitted": 0, "references": [ { "url": "https://www.ahsay.com/en/support/help-centre/release-notes/cbs/v10.3.4", "tag": "patch" } ], "cwes": [ { "id": "CWE-78", "name": "OS Command Injection" }, { "id": "CWE-77", "name": "Command Injection" } ], "ssvc": { "exploitation": "active", "automatable": "yes", "impact": "total", "at": "2026-10-14T00:00:00.000Z" }, "fix": "listed", "tags": [ "ahsay" ], "cves": [ "CVE-2026-105134" ], "ghsa": null, "cvss": { "score": 10, "version": "4.0", "by": "VulDB" }, "epss": { "percentage": 0.3831, "percentile": 0.98568, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [], "vendor": "Ahsay", "product": "AhsayCBS", "kev": { "dateAdded": "2026-10-14", "dueDate": "2026-10-17", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable.", "ransomware": false }, "breach": null, "retracted": false, "sources": [ { "label": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-105134" } ], "publishedAt": "2026-10-14T00:00:00.000Z", "updatedAt": "2026-10-14T00:00:00.000Z" }, { "id": "cve-2026-105133", "url": "https://cveboard.org/i/cve-2026-105133", "urlPt": "https://cveboard.org/pt/i/cve-2026-105133", "json": "https://cveboard.org/i/cve-2026-105133.json", "kind": "vuln", "live": true, "knownExploited": true, "severity": "moderate", "title": "Ahsay AhsayCBS Improper Authentication Vulnerability", "summary": "Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPwd function. This vulnerability can be chained with CVE-2026-105134.", "titlePt": "Vulnerabilidade de autenticação inadequada no Ahsay AhsayCBS", "summaryPt": "Ahsay AhsayCBS contém uma vulnerabilidade de autenticação inadequada que poderia permitir que um atacante remoto contorne a autenticação por meio da manipulação do parâmetro aleatório na função checkSysPwd do componente API. Esta vulnerabilidade pode ser encadeada com CVE-2026-105134.", "affected": [ { "vendor": "Ahsay", "product": "AhsayCBS", "defaultStatus": "unknown", "versions": [ { "version": "10.3.0", "status": "affected", "lessThan": null, "lessThanOrEqual": null }, { "version": "10.3.1", "status": "affected", "lessThan": null, "lessThanOrEqual": null }, { "version": "10.3.2", "status": "affected", "lessThan": null, "lessThanOrEqual": null }, { "version": "10.3.4", "status": "unaffected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [ "10.3.4" ] } ], "omitted": 0, "references": [ { "url": "https://www.ahsay.com/en/support/help-centre/release-notes/cbs/v10.3.4", "tag": "patch" } ], "cwes": [ { "id": "CWE-287", "name": "Improper Authentication" } ], "ssvc": { "exploitation": "active", "automatable": "yes", "impact": "partial", "at": "2026-10-14T00:00:00.000Z" }, "fix": "listed", "tags": [ "ahsay" ], "cves": [ "CVE-2026-105133" ], "ghsa": null, "cvss": { "score": 6.9, "version": "4.0", "by": "VulDB" }, "epss": { "percentage": 0.05794, "percentile": 0.93098, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [], "vendor": "Ahsay", "product": "AhsayCBS", "kev": { "dateAdded": "2026-10-14", "dueDate": "2026-10-17", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable.", "ransomware": false }, "breach": null, "retracted": false, "sources": [ { "label": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-105133" } ], "publishedAt": "2026-10-14T00:00:00.000Z", "updatedAt": "2026-10-14T00:00:00.000Z" } ], "tag": { "tag": "ahsay", "name": "Ahsay", "kev": { "name": "Ahsay", "total": 2, "last": "2026-10-14" } } }