Search: 7.3.1.1

VStarcam O-KAM SuperIPCam version 1.3.3.32 contains a use-after-free vulnerability in the P2P Session Teardown component. This flaw affects the function FUN_005a2d44 in the SuperIPCam.exe file and can be exploited remotely without authentication. The vulnerability has a CVSS score of 7.3, indicating high severity. Public exploit code is available, but the vendor has not responded or issued a patch.

A security flaw has been discovered in dayrui XunRuiCMS up to 4.7.4. Affected by this issue is the function str_replace of the file /var/www/html/zzmob/index.php of the component Mobile Site Directory. The manipulation of the argument dirname results in code injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was identified in dayrui XunRuiCMS up to 4.7.4. Affected by this vulnerability is the function _get_tpl_content of the file dayrui/Fcms/Library/Notice.php of the component Email Template Rendering. The manipulation leads to code injection. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-120347 is a SQL injection vulnerability in dayrui XunRuiCMS versions 4.7.0 through 4.7.4. The flaw exists in the View function of the Member Module component, specifically in the file dayrui/Fcms/Core/View.php. An attacker can remotely manipulate the 'catid' argument to execute SQL injection. Public exploit code has been disclosed. The vulnerability has a medium severity with a CVSS 4.0 base score of 6.9.

CVE-2026-120324 is a path traversal vulnerability in Aklivity Zilla affecting versions up to 1.3.4, 2.4.7, and 2.5.0-rc2. The flaw exists in the Path.resolve function of the FileSystemServerFactory component within the http-filesystem binding. This vulnerability allows remote attackers to manipulate path parameters to access unauthorized file system locations. Public exploit code is available. Upgrading to version 2.5.0-rc3 resolves the issue.

A security flaw has been discovered in samanhappy MCPHub up to 1.0.45/1.1.7. Impacted is an unknown function of the file src/utils/passthroughHeaders.ts. The manipulation of the argument passthroughHeaders results in information disclosure. The attack may be launched remotely. Upgrading to version 1.1.8 is recommended to address this issue. The patch is identified as 040f7b9ae004070bdfe5084cde6bc2c609f78e76. It is advisable to upgrade the affected component.

Multiple security issues were addressed in the bugwarden-0.7.0-1.1 package included in the GA media of openSUSE Tumbleweed. The update fixes vulnerabilities affecting this package version.

FreeRDP, a free implementation of the Remote Desktop Protocol client, contains a denial of service vulnerability due to uninitialized progressive tile handling (CVE-2026-109242). This issue can cause the application to crash or become unresponsive. The vulnerability affects versions prior to 2:2.11.7-7.el9_8.9. A security update addressing this and other denial of service flaws in FreeRDP has been released by Red Hat.

A heap-based buffer overflow vulnerability (CVE-2026-109089) exists in the X.Org X11 libXi runtime library, specifically in the DEVICE_RESOLUTION handling. This flaw could allow arbitrary code execution. An update fixing this issue is available in libXi version 1.7.10-8.el9_8.3 for Red Hat Enterprise Linux 9 and related variants.

A moderate severity vulnerability (CVE-2025-11395) affects the podman tool, which manages pods, container images, and containers as part of the libpod library. The flaw allows arbitrary file write during the import of an OCI archive. This vulnerability is fixed in podman version 7:5.8.2-12.el10_2.alma.1. Red Hat has issued a security advisory and update for Red Hat Enterprise Linux 10 to address this issue.

A code injection vulnerability exists in beecue FastBee up to version 2.1.0 in the Groovy Script Executor component, specifically in the /iot/script file. This vulnerability can be exploited remotely and requires high privileges. The issue has a medium severity rating with a CVSS score of 4.7. A patch identified by commit 890a33846005a937a58cccd738b7fb9821b82ea9 is available to address this issue.

This security update for the SUSE Linux Enterprise Kernel 6.4.0-150700.7.40 addresses multiple security vulnerabilities affecting various kernel components, including crypto, virtiofs, ipv6, netfs, xfrm, ASoC SOF, sctp, ipvs, SUNRPC, nfsd, and ipv4. The fixes resolve issues such as use-after-free, infinite loops, buffer overruns, heap overflow, and other memory handling errors.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Path Traversal.This issue affects JetFormBuilder: from n/a through 3.6.7.1.

A vulnerability in Oray Pugongying X5 Pro up to version 7.6.1 affects the session_get function in session.lua, related to the Session ID Handler. The flaw involves insufficient randomness in the _user argument, which can be exploited remotely. The attack complexity is high and exploitability is difficult. Public exploit code exists, but no vendor response or patch is available. The CVSS score rates this as a low-severity issue with limited impact on confidentiality and no impact on integrity or availability.

A critical security vulnerability (CVE-2026-120224) exists in Oray Pugongying X5 Pro up to version 7.6.1. The flaw affects the API Authorization component, specifically the run_apis_by_json and run_async_task functions, allowing improper authorization. This vulnerability can be exploited remotely and has a very high CVSS score of 9.9. Public exploit code is available, but the vendor has not responded or issued a patch.