Threats affecting pkg:bitnami/redis

Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash allows a user of one tenant to read, overwrite and take over another tenant's records via an upserting create action. Under attribute multitenancy, Ash.Actions.Create (lib/ash/actions/create/create.ex) and Ash.Actions.Create.Bulk (lib/ash/actions/create/bulk.ex) upserted on the primary key, or on an all_tenants? identity, without scoping the conflicting record to the request's tenant. A caller of a create action with upsert? true that accepts the primary key, supplying a record id from another tenant, updated that record's upsert fields and received all of its attributes in the result. With the default upsert fields the tenant attribute was written too, moving the record into the caller's tenant. Read and update policies do not run for upserts, and tenant-scoped create policies pass because the tenant is the caller's own. This issue affects ash: from 1.22.0 before 3.37.2.

CVE-2026-116229 is a cross-site scripting (XSS) vulnerability in the ffxiv-teamcraft FFXIV Teamcraft application affecting versions 11.4.0 through 11.4.19. The flaw exists in the clipboard.readText function within the Renderer-Process IPC Bridge component. This vulnerability can be exploited remotely and has been publicly disclosed. A fix is available in version 11.4.32.

The Eurobank WooCommerce Payment Gateway WordPress plugin through 2.1.1 does not verify that a payment-confirmation request genuinely originates from the payment provider, and ships with the secret that would authenticate it empty by default, allowing unauthenticated attackers to mark any pending order as paid, and to force any order into a failed status without any secret at all.

The GiveWP WordPress plugin before 4.19.0.1 does not restrict the currency of a donation to the one the site or form accepts, while comparing its amount limits as bare numbers, allowing unauthenticated users to make donations below a form's configured minimum or fixed amount.

CVE-2026-116228 is a medium-severity vulnerability in 777genius agent-teams-ai up to version 2.17.10. It involves missing authentication in the Local HTTP Service component, specifically in the doStart function of src/main/services/infrastructure/HttpServer.ts. Exploitation requires local access. Public exploit code exists, but no vendor response or patch has been provided.

CVE-2026-116227 is a cross-site scripting (XSS) vulnerability in the Virtual Server Page component of Edimax BR-6208AC firmware version 1.32. This vulnerability allows remote attackers with high privileges to execute reflected XSS attacks. The vulnerability has been publicly disclosed, but the vendor has not responded or issued a fix.

CVE-2026-116224 is a server-side request forgery (SSRF) vulnerability in fr0tt benotes affecting versions 2.8.0 and 2.8.1. The flaw exists in the getUrlInfo function of the Bookmark Metadata Endpoint, allowing remote attackers to manipulate the url argument to induce SSRF. The vulnerability has been publicly disclosed, but no vendor response or patch is currently available.

V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6ComFile!CCheck::ItemCheck. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.

V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6EditData!CDataRomErrorCheck::CheckSymbolMacroParam. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.

V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6EditData!CDataRomErrorCheck::MacroCommandCheck. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.

V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6MemInIF!set_temp_type_default. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.

V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6ComFile!load_gr_item. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.

V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds write vulnerability. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.

V-SFT provided by FUJI ELECTRIC CO., LTD. contains a stack-based buffer overflow vulnerability. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.

CVE-2026-116223 is a medium-severity vulnerability in icret EasyImage versions 2.8.0 through 2.8.7. It involves improper privilege management due to manipulation of the 'hash' argument in the app/del.php file. This flaw can be exploited remotely without authentication. A patch identified by commit b12cb67d447bcbb67e21c8f011d0f5638229760c has been released to fix the issue. Exploit code is publicly available, increasing the risk of exploitation.

The Payment Gateway WordPress plugin up to version 2.2.0 has an authentication flaw where it does not verify that a shared secret is configured before using it to authenticate bank payment-notification callbacks. This allows unauthenticated attackers to forge valid notifications and mark any WooCommerce order as paid if the secret is not set. Additionally, the same callback can be used to move any pending order to a failed state regardless of secret configuration.

The OPay Payment Gateway for WooCommerce WordPress plugin through 2.5.5 does not properly verify that payment notifications originate from the payment provider, as the secret used to validate their signature is empty by default, allowing unauthenticated attackers to forge a valid notification and mark arbitrary orders as paid, cancelled or failed.

The Mintpay for WooCommerce WordPress plugin through 2.2.3 does not verify the authenticity of the payment callback it processes, allowing unauthenticated attackers to mark arbitrary orders as paid, to cancel arbitrary orders, and to disclose order details including customer contact information.

The Online Payments with iK Pay Gateway WordPress plugin before 3.0.4 does not properly verify the authenticity of its payment gateway callback on a default installation, allowing unauthenticated attackers to forge a successful payment notification and mark arbitrary orders as paid without any payment being made, and to mark arbitrary unprocessed orders as failed.

The CCAvenue Payment Gateway for WooCommerce WordPress plugin through 3.1 does not verify that a payment-confirmation request genuinely originates from the payment provider, and derives its verification key from a value that is empty on a default install, allowing unauthenticated attackers to forge a confirmation and mark any WooCommerce order as paid without payment.