HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-107707 — Intego Antivirus for Windows through 3.0.0.1 contains a link following vulnerabi...

·Source: NIST NVD

Updated:

Executive Summary

Intego Antivirus for Windows through 3.0.0.1 contains a link following vulnerability in its optimization module that allows local unprivileged users to delete arbitrary folders as SYSTEM. Attackers can replace a scanned duplicate file's directory with a junction to C:\Config.msi and abuse Windows Installer rollback to execute code as SYSTEM.

Analysis

Intego Antivirus for Windows through 3.0.0.1 contains a link following vulnerability in its optimization module that allows local unprivileged users to delete arbitrary folders as SYSTEM. Attackers can replace a scanned duplicate file's directory with a junction to C:\Config.msi and abuse Windows Installer rollback to execute code as SYSTEM. CVSS Score: 7.8. Published: 2026-10-08T20:17:35.690.

Indicators of Compromise (2)

CVE (1)
CVE-2026-107707
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Oct 8, 2026. Verified by: NIST.

Related Threats

CRITICALVulnerability

NVD CRITICAL: CVE-2026-77936 — Letta through 0.16.8 ships a compose.yaml that does not enable LETTA_SERVER_SECU...

Letta through 0.16.8 ships a compose.yaml that does not enable LETTA_SERVER_SECURE, so the password middleware is never added and all API routes are unauthenticated, and it exposes a superuser PostgreSQL port with default credentials. Remote attackers can execute arbitrary Python via POST /v1/tools/run, manage /v1/admin users, or run OS commands via COPY PROGRAM.

CVE-2026-77936
NIST NVD
CRITICALVulnerability

NVD CRITICAL: CVE-2026-77933 — DB-GPT through 0.8.2 contains a hardcoded credentials vulnerability in its defau...

DB-GPT through 0.8.2 contains a hardcoded credentials vulnerability in its default docker-compose.yml that sets a static MYSQL_ROOT_PASSWORD and publishes port 3306 on all interfaces. Attackers reaching port 3306 or the shared dbgptnet network can authenticate as root@% to gain full database access including FILE and SUPER privileges.

CVE-2026-77933
NIST NVD
CRITICALVulnerability

NVD CRITICAL: CVE-2026-77932 — DB-GPT through 0.8.2 contains an unauthenticated remote code execution vulnerabi...

DB-GPT through 0.8.2 contains an unauthenticated remote code execution vulnerability because the /api/v1/chat/react-agent endpoint relies on a mock get_user_from_headers function that grants every caller the admin role. Unauthenticated attackers can send prompts that make the ReAct agent's unsandboxed code_interpreter and shell_interpreter tools run arbitrary Python or bash as root in the webserve

CVE-2026-77932
NIST NVD