Threats tagged 'ghsa-6494-g389-mxj7'

A critical security vulnerability (CVE-2026-120224) exists in Oray Pugongying X5 Pro up to version 7.6.1. The flaw affects the API Authorization component, specifically the run_apis_by_json and run_async_task functions, allowing improper authorization. This vulnerability can be exploited remotely and has a very high CVSS score of 9.9. Public exploit code is available, but the vendor has not responded or issued a patch.