CVE-2026-113437 is a path traversal vulnerability in DOS Co., Ltd.'s SS1 and SS1 Cloud products, as well as the ODM product rocoeyes by Rococo Co. Ltd. This flaw allows an attacker to delete arbitrary files by improperly limiting pathname access to restricted directories. The vulnerability has a CVSS 3.0 base score of 5.3, indicating a medium severity level. No public exploits or known active exploitation have been reported. The affected version is specified as version 0. No patch or remediation information is provided.
CVE-2026-109582 is a medium severity vulnerability in DOS Co., Ltd.'s SS1 product involving insecure storage of sensitive information. This flaw allows sensitive data used by the product to potentially be obtained by unauthorized parties. The vulnerability has a CVSS 3.0 base score of 4.0, indicating limited impact primarily on confidentiality with no impact on integrity or availability. No known exploits or patches are currently reported.
CVE-2026-124579 is an injection vulnerability in aaPanel BillionMail versions 4.0 through 4.9. It affects the Relay Configuration API component, specifically the file core/api/relay/v1/relay.go. The issue arises from manipulation of the helo_name argument, which can be exploited remotely. The vulnerability has a medium severity with a CVSS score of 5.3. Public exploit code has been disclosed, but the vendor has not responded or provided a patch.
Effekseer versions up to 1.80.7 improperly validate effect files, which can cause the host process to crash when a crafted file is loaded. This vulnerability leads to denial of service but does not impact confidentiality or integrity.
CVE-2026-124578 is a medium-severity vulnerability in the Pantum BP5100DW printer firmware version 3.A.4.7. It involves missing authentication in an unknown function within the /shtml/omDB.shtml file of the device's web interface, allowing remote attackers to potentially access functionality without proper authentication. The vendor has not responded to disclosure attempts, and no patch or fix information is currently available.
CVE-2026-124577 is a critical improper authentication vulnerability in the Intelbras SG 2404 PoE L2+ Web Management Interface. It affects versions 1.00.70 and 1.00.72 and allows remote attackers to bypass authentication via manipulation of an unknown function in the /EXCU_SHELL file. Public exploit code is available. Upgrading to version 1.00.74 resolves the issue.
Red Hat OpenShift Container Platform 4.12.103 includes a critical security fix addressing a kernel vulnerability (CVE-2026-98432) related to IPv4 option memory management. The update fixes improper freeing of inet_opt and ireq_opt after an RCU grace period. Users of OpenShift Container Platform 4.12 are advised to upgrade to this release to mitigate the issue.
CVE-2026-124576 is a security vulnerability in BeikeShop versions up to 2.0.0.31 affecting the OrderRepo::getOrderByNumber function in the Guest Order Lookup component. The flaw allows remote manipulation of the order_number argument, leading to enforcement of behavioral workflow. The issue is addressed by upgrading to version 2.0.0.32.
CVE-2026-124575 is a vulnerability in SiteServer SSCMS affecting versions 7.0 through 7.4.0. It involves improper restriction of excessive authentication attempts due to manipulation of the isForceLogoutAndLogin argument in the Admin-Login CAPTCHA component. The vulnerability can be exploited remotely but requires high complexity and is difficult to exploit. A patch identified by commit df3becb7ebb00a48435418a44fd08a459eb38ace is available to address this issue.
CVE-2026-124574 is an improper authorization vulnerability in the chenyme grok2api product affecting versions 3.1.0 through 3.1.6. The flaw exists in the beginSelectionSession function within the Video Job Retry Handler component. This vulnerability can be exploited remotely without user interaction. A public exploit has been disclosed. Upgrading to version 3.1.7 resolves the issue.
A SQL injection vulnerability exists in SourceCodester Simple CRUD using PHP and FPDF 1.0, specifically in the app/register.php file via the firstname argument. This flaw allows remote attackers with low privileges to manipulate SQL queries, potentially impacting confidentiality, integrity, and availability. An exploit has been published, increasing the risk of exploitation. The vulnerability has a medium severity rating with a CVSS score of 6.3.
A medium-severity vulnerability (CVE-2026-124566) exists in the fushengqian fuint component affecting the aliPayCallback function in ClientPayController.java. The flaw allows remote manipulation that enforces behavioral workflow changes. The product uses a rolling release model, so specific affected versions are not provided. The vendor has not responded to disclosure attempts, and no patch information is available.
A vulnerability in fushengqian fuintCatering's updateCommissionCash function allows improper access control due to manipulation of the Status argument. This flaw can be exploited remotely and results in limited integrity and availability impact. The product uses rolling releases, so specific affected and fixed versions are not available. The vendor has not responded to the disclosure.
A cross-site scripting (XSS) vulnerability exists in SourceCodester Online Leave Management System 1.0 within the Employee Avatar Upload Extension. The flaw arises from improper handling of the employee avatar filename parameter in the app/classes/Master.php file, allowing remote attackers to inject malicious scripts. Exploit code is publicly available. The vulnerability has a low CVSS score of 2.4, indicating limited impact.
A security vulnerability (CVE-2026-124565) exists in the fushengqian fuint software up to commit 36cc31b08d77facc94e8959afa02224891b4fe5f. The flaw is in the confirm function of MerchantOrderController.java within the Order Verification component, causing improper access controls. The vulnerability can be exploited remotely. The vendor has not provided version details or responded to disclosure. The CVSS score is 4.3, indicating medium severity.
A vulnerability in the RefundServiceImpl.agreeRefund function of the Refund Agreement component in fushengqian fuintCatering allows improper access control. This flaw can be exploited remotely and affects versions up to commit 6d054f5788ac8645eb491f79242bb8a625efc133. The product uses a rolling release model, so no specific version numbers are provided. The vendor has not responded to disclosure attempts. The CVSS score is 4.3, indicating medium severity.
A buffer overflow vulnerability exists in the SetWanSettings function of the HNAP Handler component in D-Link DIR-878 firmware version 1.20B05. This vulnerability can be triggered remotely by manipulating DNS configuration arguments. The affected product is no longer supported by the vendor. Exploit code is publicly available. The vulnerability has a high severity score and impacts availability.
A path traversal vulnerability exists in the GetListDirectory function of the HNAP Handler component in D-Link DIR-878 firmware version 1.20B05. This flaw allows remote attackers to manipulate the ListDirectoryPath argument to access unauthorized directories. The affected product is no longer supported by the vendor. Public exploit code is available. The vulnerability has a CVSS 3.1 base score of 5.3, indicating medium severity.
A buffer overflow vulnerability exists in the SetWanSettings function of the HNAP Handler component on D-Link DIR-878 firmware version 1.20B05. This flaw can be exploited remotely by manipulating the Primary/Secondary argument. The vulnerability has a high severity score and public exploit code is available. The affected product is no longer supported by the vendor.
A critical buffer overflow vulnerability exists in the data receiving process of NEC Corporation WebSAM WinShare versions 7.5.0 and earlier, 7.6.0, and 7.7.0 through 7.7.2 on Windows. This flaw allows a remote unauthenticated attacker to execute arbitrary code with SYSTEM privileges by sending a crafted packet containing a malformed data size value in the protocol header.