V-SFT software from FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in the VS6ComFile!load_gr_item function. Exploiting this flaw by opening a specially crafted V7 file may result in information disclosure or arbitrary code execution on affected versions up to 6.2.11.0. The vulnerability has a high severity rating with a CVSS score of 7.8.
V-SFT software by FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. has an out-of-bounds write vulnerability. This flaw can be triggered by opening a specially crafted V7 file, potentially allowing information disclosure or arbitrary code execution. The vulnerability affects versions from 0 up to and including 6.2.11.0. It has a high severity rating with a CVSS score of 7.8.
V-SFT software by FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. has a stack-based buffer overflow vulnerability. This flaw can be triggered by opening a specially crafted V7 file, potentially allowing information disclosure or arbitrary code execution. The vulnerability affects versions from 0 up to and including 6.2.11.0. It has a high severity rating with a CVSS score of 7.8.
CVE-2026-116223 is a medium-severity vulnerability in icret EasyImage versions 2.8.0 through 2.8.7. It involves improper privilege management due to manipulation of the 'hash' argument in the app/del.php file. This flaw can be exploited remotely without authentication. A patch identified by commit b12cb67d447bcbb67e21c8f011d0f5638229760c has been released to fix the issue. Exploit code is publicly available, increasing the risk of exploitation.
The Payment Gateway WordPress plugin up to version 2.2.0 has an authentication flaw where it does not verify that a shared secret is configured before using it to authenticate bank payment-notification callbacks. This allows unauthenticated attackers to forge valid notifications and mark any WooCommerce order as paid if the secret is not set. Additionally, the same callback can be used to move any pending order to a failed state regardless of secret configuration.
The OPay Payment Gateway for WooCommerce WordPress plugin up to version 2.5.5 has an improper authentication vulnerability. The plugin does not properly verify that payment notifications come from the legitimate payment provider because the secret used for signature validation is empty by default. This flaw allows unauthenticated attackers to forge valid notifications and manipulate order statuses, marking orders as paid, cancelled, or failed.
The Mintpay for WooCommerce WordPress plugin up to version 2.2.3 contains an improper access control vulnerability. This flaw allows unauthenticated attackers to manipulate payment callbacks, enabling them to mark arbitrary orders as paid, cancel orders, and access sensitive order details including customer contact information.
The Online Payments with iK Pay Gateway WordPress plugin before version 3.0.4 contains an authentication flaw that allows unauthenticated attackers to forge payment gateway callbacks. This vulnerability enables attackers to mark arbitrary orders as paid without actual payment or mark unprocessed orders as failed.
The CCAvenue Payment Gateway for WooCommerce plugin up to version 3.1 has an improper access control vulnerability. It fails to verify that payment-confirmation requests originate from the legitimate payment provider. The verification key is derived from a value that is empty by default, allowing unauthenticated attackers to forge payment confirmations and mark orders as paid without actual payment.
CVE-2026-116124 is a heap-based buffer overflow vulnerability in GNOME libgsf versions 1.14.0 through 1.14.19. The flaw exists in the ole_info_read_metabat function within the OLE2 Parser component, allowing remote attackers to trigger the overflow. This vulnerability has a medium severity rating with a CVSS 4.0 score of 5.3. A patch identified by commit a8e25560b74f84c3f86df6ca0ac59195fa5af68a is available to address the issue.
CVE-2026-116123 is a medium-severity vulnerability in NocoDB version 2026.07.0 involving improper restriction of excessive authentication attempts in the validatePassword function within /auth/user/signup. The vulnerability can be exploited remotely but requires high complexity and is difficult to exploit. The vendor has documented this behavior as intentional and has not provided a response or patch, deleting the related GitHub issue without explanation.
CVE-2026-116122 is an information disclosure vulnerability in NocoDB version 2026.07.0 affecting the AuthService.validateUser function in the Sign-in Endpoint. The flaw allows remote attackers to manipulate the salt argument, potentially exposing sensitive information. The attack complexity is high, and exploitability is difficult. The vendor has not responded to disclosure attempts and deleted the related GitHub issue. No patch or official fix has been announced.
CVE-2026-116121 is a race condition vulnerability in NocoDB affecting version 2026.08.0. The flaw exists in the processing of the file users.service.ts within the Registration component. Exploitation requires a high level of complexity and is considered difficult. The vulnerability can be exploited remotely without user interaction or privileges. The vendor has not provided a response or patch and deleted the related GitHub issue without explanation.
CVE-2026-116120 is a resource allocation vulnerability in NocoDB version 2026.07 affecting the UserRefreshToken.deleteAllUserToken function within the /auth/user/signup component. The vulnerability allows remote attackers to cause resource allocation issues due to the absence of in-app rate limiting on unauthenticated signup and password-forgot endpoints. Exploitation complexity is high, and the vendor has not provided a response or patch, with the issue reportedly deleted from GitHub without explanation.
CVE-2026-116119 is a medium severity race condition vulnerability in NocoDB version 2026.08.0 affecting the Password-Reset Flow component. The flaw exists in the file packages/nocodb/src/services/users/users.service.ts and can be exploited remotely. The vendor has not provided any response or patch, and the GitHub issue related to this vulnerability was deleted without explanation.
The Electronic delivery item Inspection Support System by Japan's Ministry of Land, Infrastructure, Transport and Tourism has an improper file access permission vulnerability. This flaw allows tampering with files in the application's installation folder, potentially leading to arbitrary code execution. The vulnerability is rated high severity with a CVSS score of 7.8. No patch or remediation information is currently provided.
CVE-2026-116118 is an OS command injection vulnerability in the Sed Command Filter component of Z.ai Zcode versions 3.14.0 through 3.15.1. This flaw allows remote attackers to execute arbitrary operating system commands. The vulnerability has been publicly disclosed, but no known exploits are currently observed in the wild. The CVSS 4.0 base score is 5.3, indicating a medium severity level.
CVE-2026-116117 is a path traversal vulnerability in the halo-dev halo product affecting versions 2.27.0-beta.0 and 2.27.0-beta.1. The flaw exists in the DefaultViewNameResolver component's resolveViewNameOrDefault function, where manipulation of the template argument can lead to unauthorized file path access. The vulnerability can be exploited remotely without authentication. Exploit code has been published publicly. The vendor has not responded to the disclosure and no patch or official fix is currently available.
CVE-2026-116116 is a critical vulnerability in the Yoosee GM8135S Camera version 21.00.01.36 involving improper verification of cryptographic signatures in the Secure Boot component. Exploitation requires local access and high privileges. Public exploit code is available, but no vendor response or patch has been provided.
Multiple vulnerabilities have been identified in FUJI ELECTRIC V-SFT as of October 2026. Specific details about the nature of these vulnerabilities, affected versions, and potential impacts have not been disclosed. No information about available patches or exploits in the wild is currently provided.