The Payment Gateway WordPress plugin up to version 2.2.0 has an authentication flaw where it does not verify that a shared secret is configured before using it to authenticate bank payment-notification callbacks. This allows unauthenticated attackers to forge valid notifications and mark any WooCommerce order as paid if the secret is not set. Additionally, the same callback can be used to move any pending order to a failed state regardless of secret configuration.
The OPay Payment Gateway for WooCommerce WordPress plugin through 2.5.5 does not properly verify that payment notifications originate from the payment provider, as the secret used to validate their signature is empty by default, allowing unauthenticated attackers to forge a valid notification and mark arbitrary orders as paid, cancelled or failed.
The Mintpay for WooCommerce WordPress plugin through 2.2.3 does not verify the authenticity of the payment callback it processes, allowing unauthenticated attackers to mark arbitrary orders as paid, to cancel arbitrary orders, and to disclose order details including customer contact information.
The Online Payments with iK Pay Gateway WordPress plugin before 3.0.4 does not properly verify the authenticity of its payment gateway callback on a default installation, allowing unauthenticated attackers to forge a successful payment notification and mark arbitrary orders as paid without any payment being made, and to mark arbitrary unprocessed orders as failed.
The CCAvenue Payment Gateway for WooCommerce WordPress plugin through 3.1 does not verify that a payment-confirmation request genuinely originates from the payment provider, and derives its verification key from a value that is empty on a default install, allowing unauthenticated attackers to forge a confirmation and mark any WooCommerce order as paid without payment.
CVE-2026-116124 is a heap-based buffer overflow vulnerability in GNOME libgsf versions 1.14.0 through 1.14.19. The flaw exists in the ole_info_read_metabat function within the OLE2 Parser component, allowing remote attackers to trigger the overflow. This vulnerability has a medium severity rating with a CVSS 4.0 score of 5.3. A patch identified by commit a8e25560b74f84c3f86df6ca0ac59195fa5af68a is available to address the issue.
CVE-2026-116123 is a medium-severity vulnerability in NocoDB version 2026.07.0 involving improper restriction of excessive authentication attempts in the validatePassword function within /auth/user/signup. The vulnerability can be exploited remotely but requires high complexity and is difficult to exploit. The vendor has documented this behavior as intentional and has not provided a response or patch, deleting the related GitHub issue without explanation.
CVE-2026-116122 is an information disclosure vulnerability in NocoDB version 2026.07.0 affecting the AuthService.validateUser function in the Sign-in Endpoint. The flaw allows remote attackers to manipulate the salt argument, potentially exposing sensitive information. The attack complexity is high, and exploitability is difficult. The vendor has not responded to disclosure attempts and deleted the related GitHub issue. No patch or official fix has been announced.
CVE-2026-116121 is a race condition vulnerability in NocoDB affecting version 2026.08.0. The flaw exists in the processing of the file users.service.ts within the Registration component. Exploitation requires a high level of complexity and is considered difficult. The vulnerability can be exploited remotely without user interaction or privileges. The vendor has not provided a response or patch and deleted the related GitHub issue without explanation.
CVE-2026-116120 is a resource allocation vulnerability in NocoDB version 2026.07 affecting the UserRefreshToken.deleteAllUserToken function within the /auth/user/signup component. The vulnerability allows remote attackers to cause resource allocation issues due to the absence of in-app rate limiting on unauthenticated signup and password-forgot endpoints. Exploitation complexity is high, and the vendor has not provided a response or patch, with the issue reportedly deleted from GitHub without explanation.
CVE-2026-116119 is a medium severity race condition vulnerability in NocoDB version 2026.08.0 affecting the Password-Reset Flow component. The flaw exists in the file packages/nocodb/src/services/users/users.service.ts and can be exploited remotely. The vendor has not provided any response or patch, and the GitHub issue related to this vulnerability was deleted without explanation.
The Electronic delivery item Inspection Support System by Japan's Ministry of Land, Infrastructure, Transport and Tourism has an improper file access permission vulnerability. This flaw allows tampering with files in the application's installation folder, potentially leading to arbitrary code execution. The vulnerability is rated high severity with a CVSS score of 7.8. No patch or remediation information is currently provided.
CVE-2026-116118 is an OS command injection vulnerability in the Sed Command Filter component of Z.ai Zcode versions 3.14.0 through 3.15.1. This flaw allows remote attackers to execute arbitrary operating system commands. The vulnerability has been publicly disclosed, but no known exploits are currently observed in the wild. The CVSS 4.0 base score is 5.3, indicating a medium severity level.
CVE-2026-116117 is a path traversal vulnerability in the halo-dev halo product affecting versions 2.27.0-beta.0 and 2.27.0-beta.1. The flaw exists in the DefaultViewNameResolver component's resolveViewNameOrDefault function, where manipulation of the template argument can lead to unauthorized file path access. The vulnerability can be exploited remotely without authentication. Exploit code has been published publicly. The vendor has not responded to the disclosure and no patch or official fix is currently available.
CVE-2026-116116 is a critical vulnerability in the Yoosee GM8135S Camera version 21.00.01.36 involving improper verification of cryptographic signatures in the Secure Boot component. Exploitation requires local access and high privileges. Public exploit code is available, but no vendor response or patch has been provided.
Multiple vulnerabilities have been identified in FUJI ELECTRIC V-SFT as of October 2026. Specific details about the nature of these vulnerabilities, affected versions, and potential impacts have not been disclosed. No information about available patches or exploits in the wild is currently provided.
The URL https://pentest-tools.com/ was observed twice in attacker activity on 2026-10-26 by OffSeq Mirage honeypot sensors. It was used in attacker payloads involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating it may serve as a tool download, callback, or exploitation target. The attacker infrastructure was located in Germany. There is no evidence of active exploitation or known threat actors associated with this URL at this time.
CVE-2026-116115 is a low-severity vulnerability in the Yoosee GM8135S Camera version 21.00.01.36. It involves improper initialization related to the WiFi configuration file wpa_supplicantX.conf. The vulnerability can only be exploited from within the local network and requires high attack complexity. Public exploit details exist, but no known exploitation in the wild has been reported. The vendor has not provided a response or patch for this issue.
CVE-2026-116114 is a medium severity vulnerability in the Yoosee GM8135S Camera version 21.00.01.36. It involves cleartext transmission of sensitive information via the Live UDP H.264 Video Stream Handler component. The vulnerability can be exploited remotely but requires high attack complexity and no user interaction. Public exploit code is available, but no vendor response or patch has been provided.
This entry is a daily update from the SANS Internet Storm Center (ISC) titled 'ISC Stormcast For Monday, October 26th, 2026.' It provides general information about the ISC's activities and resources but does not contain any specific security threat or vulnerability details.