Tagged “cve.org”
CVEs tagged cve.org, newest first.
47291 CVEsRSS
CVE-2026-103381Medium· 6.5Mintpay <= 2.2.3 - Unauthenticated Order Payment Completion and Cancellation via Callback Forgery
The Mintpay for WooCommerce WordPress plugin through 2.2.3 does not verify the authenticity of the payment callback it processes, allowing unauthenticated attackers to mark arbitrary orders as paid, to cancel arbitrary orders, and to dis…
CVE-2026-103306Medium· 5.3iKhokha Payment Gateway < 3.0.4 - Unauthenticated Order Payment Forgery via Callback
The Online Payments with iK Pay Gateway WordPress plugin before 3.0.4 does not properly verify the authenticity of its payment gateway callback on a default installation, allowing unauthenticated attackers to forge a successful payment n…
CVE-2026-103319Medium· 5.3OPay Payment Gateway for WooCommerce <= 2.5.5 - Unauthenticated Payment Confirmation Forgery via Empty Default Secret Key
The OPay Payment Gateway for WooCommerce WordPress plugin through 2.5.5 does not properly verify that payment notifications originate from the payment provider, as the secret used to validate their signature is empty by default, allowing…
CVE-2026-103299Medium· 5.3nexi Alpha Bank for WooCommerce <= 2.2.0 - Unauthenticated Payment Confirmation Forgery via Empty Shared Secret
The Payment Gateway WordPress plugin through 2.2.0 does not ensure a shared secret is configured before using it to authenticate the bank's payment-notification callback, allowing unauthenticated attackers to forge a valid notification …
CVE-2026-103298Medium· 5.3CCAvenue Payment Gateway for WooCommerce <= 3.1 - Unauthenticated Order Payment Completion via Webhook Forgery
The CCAvenue Payment Gateway for WooCommerce WordPress plugin through 3.1 does not verify that a payment-confirmation request genuinely originates from the payment provider, and derives its verification key from a value that is empty on …
CVE-2026-116223Medium· 6.5PoCicret EasyImage del.php privileges management
A flaw has been found in icret EasyImage up to 2.8.7. The impacted element is an unknown function of the file app/del.php. Executing a manipulation of the argument hash can lead to improper privilege management. The attack can be launche…
CVE-2026-107894High· 7.8V-SFT provided by FUJI ELECTRIC CO., LTD
V-SFT provided by FUJI ELECTRIC CO., LTD. contains a stack-based buffer overflow vulnerability. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.
CVE-2026-107896High· 7.8V-SFT provided by FUJI ELECTRIC CO., LTD
V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6ComFile!load_gr_item. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.
CVE-2026-107895High· 7.8V-SFT provided by FUJI ELECTRIC CO., LTD
V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds write vulnerability. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.
CVE-2026-107900High· 7.8V-SFT provided by FUJI ELECTRIC CO., LTD
V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6ComFile!CCheck::ItemCheck. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.
CVE-2026-107897High· 7.8V-SFT provided by FUJI ELECTRIC CO., LTD
V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6MemInIF!set_temp_type_default. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.
CVE-2026-107899High· 7.8V-SFT provided by FUJI ELECTRIC CO., LTD
V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6EditData!CDataRomErrorCheck::CheckSymbolMacroParam. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on th…
CVE-2026-107898High· 7.8V-SFT provided by FUJI ELECTRIC CO., LTD
V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6EditData!CDataRomErrorCheck::MacroCommandCheck. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the af…
CVE-2026-116227Low· 2.4PoCEdimax BR-6208AC Virtual Server cross site scripting
A vulnerability has been found in Edimax BR-6208AC 1.32. This vulnerability affects unknown code of the component Virtual Server Page. The manipulation leads to cross site scripting. Remote exploitation of the attack is possible. The exp…
CVE-2026-116224Medium· 4.3PoCfr0tt benotes Bookmark Metadata Endpoint PostController.php getUrlInfo server-side request forgery
A vulnerability has been found in fr0tt benotes up to 2.8.1. This affects the function getUrlInfo of the file app/Http/Controllers/PostController.php of the component Bookmark Metadata Endpoint. The manipulation of the argument url leads…
CVE-2026-116228Low· 3.3PoC777genius agent-teams-ai Local HTTP Service HttpServer.ts doStart missing authentication
A vulnerability was found in 777genius agent-teams-ai up to 2.17.10. This issue affects the function doStart of the file src/main/services/infrastructure/HttpServer.ts of the component Local HTTP Service. The manipulation results in miss…
CVE-2026-111974Medium· 5.3GiveWP < 4.19.0.1 - Unauthenticated Donation Amount Restriction Bypass via Currency
The GiveWP WordPress plugin before 4.19.0.1 does not restrict the currency of a donation to the one the site or form accepts, while comparing its amount limits as bare numbers, allowing unauthenticated users to make donations below a for…
CVE-2026-103300Medium· 5.3Eurobank WooCommerce Payment Gateway <= 2.1.1 - Unauthenticated Order Payment Forgery via Unverified Callback
The Eurobank WooCommerce Payment Gateway WordPress plugin through 2.1.1 does not verify that a payment-confirmation request genuinely originates from the payment provider, and ships with the secret that would authenticate it empty by def…
CVE-2026-116122Low· 3.7NocoDB Sign-in Endpoint AuthService.validateUser information disclosure
A security flaw has been discovered in NocoDB up to 2026.07.0. Impacted is the function AuthService.validateUser of the component Sign-in Endpoint. Performing a manipulation of the argument salt results in information disclosure. It is p…
CVE-2026-116123Low· 3.7NocoDB signup validatePassword excessive authentication
A weakness has been identified in NocoDB up to 2026.07.0. The affected element is the function validatePassword of the file /auth/user/signup. Executing a manipulation can lead to improper restriction of excessive authentication attempts…
CVE-2026-116117High· 7.3halo-dev halo View Name Resolver DefaultViewNameResolver.java path traversal
A flaw has been found in halo-dev halo up to 2.27.0-beta.1. Affected by this vulnerability is the function run.halo.app.theme.DefaultViewNameResolver.resolveViewNameOrDefault of the file application/src/main/java/run/halo/app/theme/Defau…
CVE-2026-116119Medium· 5.5NocoDB Password-Reset Flow users.service.ts race condition
A vulnerability was found in NocoDB up to 2026.08.0. This affects an unknown part of the file packages/nocodb/src/services/users/users.service.ts of the component Password-Reset Flow. The manipulation results in race condition. The attac…
CVE-2026-116118Medium· 6.3PoCZ.ai Zcode Sed Command Filter os command injection
A vulnerability has been found in Z.ai Zcode up to 3.14.3/3.15.1. Affected by this issue is some unknown functionality of the component Sed Command Filter. The manipulation leads to os command injection. Remote exploitation of the attack…
CVE-2026-113345High· 7.8Electronic delivery item Inspection Support System provided by Japan's Ministry of Land, Infrastructure, Transport and Tourism contains an improper file access permission vulnerability
Electronic delivery item Inspection Support System provided by Japan's Ministry of Land, Infrastructure, Transport and Tourism contains an improper file access permission vulnerability. Files in the installation folder of the application…
CVE-2026-116120Medium· 5.6NocoDB PublicApiLimiterGuard signup UserRefreshToken.deleteAllUserToken allocation of resources
A vulnerability was determined in NocoDB up to 2026.07.0. This vulnerability affects the function UserRefreshToken.deleteAllUserToken of the file /auth/user/signup of the component PublicApiLimiterGuard. This manipulation causes allocati…
CVE-2026-116121Low· 3.7NocoDB Registration users.service.ts race condition
A vulnerability was identified in NocoDB up to 2026.08.0. This issue affects some unknown processing of the file users.service.ts of the component Registration. Such manipulation leads to race condition. The attack may be performed from …
CVE-2026-116115Low· 3.1PoCYoosee GM8135S Camera WiFi Configuration wpa_supplicantX.conf initialization
A security vulnerability has been detected in Yoosee GM8135S Camera 21.00.01.36. This impacts an unknown function of the file wpa_supplicantX.conf of the component WiFi Configuration. Such manipulation leads to improper initialization. T…
CVE-2026-116114Low· 3.7PoCYoosee GM8135S Camera Live UDP H.264 Video Stream npc cleartext transmission
A weakness has been identified in Yoosee GM8135S Camera 21.00.01.36. This affects an unknown function of the file /npc/npc of the component Live UDP H.264 Video Stream Handler. This manipulation causes cleartext transmission of sensitive…
CVE-2026-116113Medium· 6.3PoCGouGuOA Api.php chunkUpload unrestricted upload
A security flaw has been discovered in GouGuOA up to 6.1.2. The impacted element is the function chunkUpload of the file app/disk/controller/Api.php. The manipulation of the argument file_extension results in unrestricted upload. It is p…
CVE-2026-116116High· 8.2PoCYoosee GM8135S Camera Secure Boot signature verification
A vulnerability was detected in Yoosee GM8135S Camera 21.00.01.36. Affected is an unknown function of the component Secure Boot. Performing a manipulation results in improper verification of cryptographic signature. The attack needs to b…