CVE-2026-116233 is a critical security vulnerability in Oray Pugongying X5 Pro version 7.6.1 involving CRLF injection through manipulation of the rent_time argument in the Dnsmasq component. This vulnerability can be exploited remotely and has publicly disclosed exploit code. The vendor has not responded to the disclosure and no patch information is available.
Multiple cross-site scripting (XSS) vulnerabilities exist in OPNsense firewall versions up to and including 26.7.1_1. These flaws allow a low-privileged attacker to execute arbitrary JavaScript in the context of another user who visits a crafted page or clicks a malicious link. The vulnerabilities have a medium severity rating with a CVSS 4.0 score of 5.6.
CVE-2026-116232 is a critical vulnerability in Oray Pugongying X5 Pro version 7.6.1 affecting the SNMP Handler component. It allows remote CRLF injection via manipulation of the info.community argument in the snmp_set function. Public exploit code is available, but the vendor has not responded or issued a fix.
CVE-2026-116231 is a critical CRLF injection vulnerability in Oray Pugongying X5 Pro version 7.6.1. The flaw exists in an unknown function of the Ser2net component, where manipulation of the regmsg argument allows injection. The vulnerability can be exploited remotely and public exploit code is available. The vendor has not responded to disclosure requests and no patch information is provided.
CVE-2026-116230 is a deserialization vulnerability in Ndemic Creations Plague Inc Evolved affecting versions 1.24.0.0 through 1.24.0.3. The flaw exists in an unknown function within the Workshop Scenario Loader component and can be exploited remotely. The vulnerability is fixed in version 1.24.0.4. The CVSS 4.0 base score is 5.3, indicating medium severity.
CVE-2026-96581 is an authorization bypass vulnerability in ash-project's ash framework affecting versions from 1.22.0 up to but not including 3.37.2. It allows a user from one tenant to read, overwrite, and take over records belonging to another tenant by exploiting an upsert create action that does not properly scope records to the request's tenant. The flaw arises because read and update policies are not enforced during upserts, and tenant-scoped create policies validate only against the caller's tenant. This vulnerability is fixed in version 3.37.2.
CVE-2026-116229 is a cross-site scripting (XSS) vulnerability in the ffxiv-teamcraft FFXIV Teamcraft application affecting versions 11.4.0 through 11.4.19. The flaw exists in the clipboard.readText function within the Renderer-Process IPC Bridge component. This vulnerability can be exploited remotely and has been publicly disclosed. A fix is available in version 11.4.32.
The Eurobank WooCommerce Payment Gateway WordPress plugin through 2.1.1 does not verify that a payment-confirmation request genuinely originates from the payment provider, and ships with the secret that would authenticate it empty by default, allowing unauthenticated attackers to mark any pending order as paid, and to force any order into a failed status without any secret at all.
The GiveWP WordPress plugin before 4.19.0.1 does not restrict the currency of a donation to the one the site or form accepts, while comparing its amount limits as bare numbers, allowing unauthenticated users to make donations below a form's configured minimum or fixed amount.
CVE-2026-116228 is a medium-severity vulnerability in 777genius agent-teams-ai up to version 2.17.10. It involves missing authentication in the Local HTTP Service component, specifically in the doStart function of src/main/services/infrastructure/HttpServer.ts. Exploitation requires local access. Public exploit code exists, but no vendor response or patch has been provided.
CVE-2026-116227 is a cross-site scripting (XSS) vulnerability in the Virtual Server Page component of Edimax BR-6208AC firmware version 1.32. This vulnerability allows remote attackers with high privileges to execute reflected XSS attacks. The vulnerability has been publicly disclosed, but the vendor has not responded or issued a fix.
CVE-2026-116224 is a server-side request forgery (SSRF) vulnerability in fr0tt benotes affecting versions 2.8.0 and 2.8.1. The flaw exists in the getUrlInfo function of the Bookmark Metadata Endpoint, allowing remote attackers to manipulate the url argument to induce SSRF. The vulnerability has been publicly disclosed, but no vendor response or patch is currently available.
V-SFT software by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in the VS6ComFile!CCheck::ItemCheck function. This flaw can be triggered by opening a specially crafted V7 file, potentially allowing information disclosure or arbitrary code execution. The vulnerability affects versions from 0 up to and including 6.2.11.0. It has a high severity rating with a CVSS score of 7.8.
V-SFT software by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in the function VS6EditData!CDataRomErrorCheck::CheckSymbolMacroParam. This flaw can be triggered by opening a specially crafted V7 file, potentially leading to information disclosure or arbitrary code execution on the affected system. The vulnerability affects versions from 0 up to and including 6.2.11.0. It has a high severity with a CVSS score of 7.8.
V-SFT software by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in the MacroCommandCheck function of VS6EditData::CDataRomErrorCheck. This flaw can be triggered by opening a specially crafted V7 file, potentially leading to information disclosure or arbitrary code execution. The vulnerability affects versions from 0 up to and including 6.2.11.0. It has a high severity with a CVSS score of 7.8. No patch or fix information is currently provided.
V-SFT software from FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. contains an out-of-bounds read vulnerability in the function VS6MemInIF!set_temp_type_default. This flaw can be triggered by opening a specially crafted V7 file, potentially leading to information disclosure or arbitrary code execution on affected versions.
V-SFT software from FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in the VS6ComFile!load_gr_item function. Exploiting this flaw by opening a specially crafted V7 file may result in information disclosure or arbitrary code execution on affected versions up to 6.2.11.0. The vulnerability has a high severity rating with a CVSS score of 7.8.
V-SFT software by FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. has an out-of-bounds write vulnerability. This flaw can be triggered by opening a specially crafted V7 file, potentially allowing information disclosure or arbitrary code execution. The vulnerability affects versions from 0 up to and including 6.2.11.0. It has a high severity rating with a CVSS score of 7.8.
V-SFT software by FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. has a stack-based buffer overflow vulnerability. This flaw can be triggered by opening a specially crafted V7 file, potentially allowing information disclosure or arbitrary code execution. The vulnerability affects versions from 0 up to and including 6.2.11.0. It has a high severity rating with a CVSS score of 7.8.
CVE-2026-116223 is a medium-severity vulnerability in icret EasyImage versions 2.8.0 through 2.8.7. It involves improper privilege management due to manipulation of the 'hash' argument in the app/del.php file. This flaw can be exploited remotely without authentication. A patch identified by commit b12cb67d447bcbb67e21c8f011d0f5638229760c has been released to fix the issue. Exploit code is publicly available, increasing the risk of exploitation.