Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
8.3 HIGH
CVE-2026-116236 — Oray Pugongying X5 Pro PPPoE WAN Setting upload_files plugin_init unrestricted upload

A vulnerability has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this issue is the function plugin_init of the file /tmp/upload_files of the component PPPoE WAN Setting Handler. Such manip…

pugongying_x5_pro | Remote | Misconfiguration
Oct 26, 2026 Oct 26, 2026
Oct 26, 2026
Oct 26, 2026
9.1 CRITICAL
CVE-2026-116235 — Oray Pugongying X5 Pro L2TP Authentication crlf injection

A flaw has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this vulnerability is an unknown functionality of the component L2TP Authentication. This manipulation of the argument Username caus…

pugongying_x5_pro | Remote | Injection
Oct 26, 2026 Oct 26, 2026
Oct 26, 2026
Oct 26, 2026
9.1 CRITICAL
CVE-2026-116234 — Oray Pugongying X5 Pro IPsec Policy ipsec.conf crlf injection

A vulnerability was detected in Oray Pugongying X5 Pro 7.6.1. Affected is an unknown function of the file /etc/ipsec.conf of the component IPsec Policy Handler. The manipulation of the argument secpr…

pugongying_x5_pro | Remote | Injection
Oct 26, 2026 Oct 26, 2026
Oct 26, 2026
Oct 26, 2026
9.1 CRITICAL
CVE-2026-116233 — Oray Pugongying X5 Pro Dnsmasq crlf injection

A security vulnerability has been detected in Oray Pugongying X5 Pro 7.6.1. This impacts an unknown function of the component Dnsmasq. The manipulation of the argument rent_time leads to crlf injecti…

pugongying_x5_pro | Remote | Injection
Oct 26, 2026 Oct 26, 2026
Oct 26, 2026
Oct 26, 2026
5.6 MEDIUM
CVE-2026-115425 — Multiple cross-site scripting (XSS) in OPNsense

Multiple cross site scripting (XSS) vulnerabilities affect OPNsense firewall vesrion 26.7.1_1 and earlier allows low privileged attacker to execute Javascript in the context of another user visiting …

Remote | Cross-Site Scripting
Oct 26, 2026 Oct 26, 2026
Oct 26, 2026
Oct 26, 2026
6.9 MEDIUM
CVE-2026-113438 — Pleasanter LDAP Authentication Bypass Vulnerability

Pleasanter provided fails to properly verify passwords in LDAP authentication when processing specially crafted requests under certain configurations. If exploited, an attacker may bypass LDAP authe…

pleasanter | Authentication
Oct 26, 2026 Oct 26, 2026
Oct 26, 2026
Oct 26, 2026
4.3 MEDIUM
CVE-2026-112828 — WordPress AI Engine plugin <= 3.8.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in Meow Apps AI Engine ai-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Engine: from n/a through 3.8.6.

ai_engine | Remote | Authorization
Oct 26, 2026 Oct 26, 2026
Oct 26, 2026
Oct 26, 2026
8.8 HIGH
CVE-2026-111841 — WordPress FunnelKit Automations plugin <= 3.8.5.2 - Cross Site Request Forgery (CSRF) vul…

Cross-Site Request Forgery (CSRF) vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Cross Site Request Forgery.This issue affects FunnelKit Automations: from n/a through 3.8…

funnelkit_automations | Remote | Cross-Site Request Forgery
Oct 26, 2026 Oct 26, 2026
Oct 26, 2026
Oct 26, 2026
4.3 MEDIUM
CVE-2026-110376 — WordPress DEPART plugin <= 1.0.10 - Broken Access Control vulnerability

Missing Authorization vulnerability in VillaTheme DEPART depart-deposit-and-part-payment-for-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DEPART: fro…

Remote | Authorization
Oct 26, 2026 Oct 26, 2026
Oct 26, 2026
Oct 26, 2026
5.3 MEDIUM
CVE-2026-101259 — Apache Camel: Camel-CoAP Information Disclosure via Unmuted Consumer Exceptions

Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel CoAP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.2. …

camel | Remote | Information Disclosure
Oct 26, 2026 Oct 26, 2026
Oct 26, 2026
Oct 26, 2026
7.6 HIGH
CVE-2026-96581 — An upsert on the primary key in Ash ignores attribute multitenancy, so one tenant can rea…

Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash allows a user of one tenant to read, overwrite and take over another tenant's records via an upserting create action.…

ash ash_framework | Remote | Authorization
Oct 26, 2026 Oct 26, 2026
Oct 26, 2026
Oct 26, 2026
9.9 CRITICAL
CVE-2026-116232 — Oray Pugongying X5 Pro SNMP snmp_set crlf injection

A weakness has been identified in Oray Pugongying X5 Pro 7.6.1. This affects the function snmp_set of the component SNMP Handler. Executing a manipulation of the argument info.community can lead to c…

pugongying_x5_pro | Remote | Injection
Oct 26, 2026 Oct 26, 2026
Oct 26, 2026
Oct 26, 2026
9.9 CRITICAL
CVE-2026-116231 — Oray Pugongying X5 Pro Ser2net crlf injection

A security flaw has been discovered in Oray Pugongying X5 Pro 7.6.1. The impacted element is an unknown function of the component Ser2net. Performing a manipulation of the argument regmsg results in …

pugongying_x5_pro | Remote | Injection
Oct 26, 2026 Oct 26, 2026
Oct 26, 2026
Oct 26, 2026
7.5 HIGH
CVE-2026-116230 — Ndemic Creations Plague Inc Evolved Workshop Scenario Loader deserialization

A vulnerability was identified in Ndemic Creations Plague Inc Evolved up to 1.24.0.3. The affected element is an unknown function of the component Workshop Scenario Loader. Such manipulation leads to…

plague_inc_evolved | Remote | Injection
Oct 26, 2026 Oct 26, 2026
Oct 26, 2026
Oct 26, 2026
4.0 MEDIUM
CVE-2026-116229 — ffxiv-teamcraft FFXIV Teamcraft Renderer-Process IPC Bridge preload.ts clipboard.readText…

A vulnerability was determined in ffxiv-teamcraft FFXIV Teamcraft up to 11.4.31. Impacted is the function clipboard.readText of the file apps/electron/src/preload.ts of the component Renderer-Process…

ffxiv_teamcraft | Remote | Cross-Site Scripting
Oct 26, 2026 Oct 26, 2026
Oct 26, 2026
Oct 26, 2026
3.3 LOW
CVE-2026-116228 — 777genius agent-teams-ai Local HTTP Service HttpServer.ts doStart missing authentication

A vulnerability was found in 777genius agent-teams-ai up to 2.17.10. This issue affects the function doStart of the file src/main/services/infrastructure/HttpServer.ts of the component Local HTTP Ser…

agent-teams-ai | Authentication
Oct 26, 2026 Oct 26, 2026
Oct 26, 2026
Oct 26, 2026
3.3 LOW
CVE-2026-116227 — Edimax BR-6208AC Virtual Server cross site scripting

A vulnerability has been found in Edimax BR-6208AC 1.32. This vulnerability affects unknown code of the component Virtual Server Page. The manipulation leads to cross site scripting. Remote exploitat…

br-6208ac_firmware br-6208ac | Remote | Cross-Site Scripting
Oct 26, 2026 Oct 26, 2026
Oct 26, 2026
Oct 26, 2026
4.3 MEDIUM
CVE-2026-116224 — fr0tt benotes Bookmark Metadata Endpoint PostController.php getUrlInfo server-side reques…

A vulnerability has been found in fr0tt benotes up to 2.8.1. This affects the function getUrlInfo of the file app/Http/Controllers/PostController.php of the component Bookmark Metadata Endpoint. The …

benotes | Remote | Server-Side Request Forgery
Oct 26, 2026 Oct 26, 2026
Oct 26, 2026
Oct 26, 2026
6.5 MEDIUM
CVE-2026-116223 — icret EasyImage del.php privileges management

A flaw has been found in icret EasyImage up to 2.8.7. The impacted element is an unknown function of the file app/del.php. Executing a manipulation of the argument hash can lead to improper privilege…

easyimage | Remote | Authorization
Oct 26, 2026 Oct 26, 2026
Oct 26, 2026
Oct 26, 2026
7.5 HIGH
CVE-2026-116124 — GNOME libgsf OLE2 gsf-infile-msole.c ole_info_read_metabat heap-based overflow

A security vulnerability has been detected in GNOME libgsf up to 1.14.60. The impacted element is the function ole_info_read_metabat of the file gsf/gsf-infile-msole.c of the component OLE2 Parser. T…

libgsf | Remote | Memory Corruption
Oct 26, 2026 Oct 26, 2026
Oct 26, 2026
Oct 26, 2026
Showing 20 of 15734 Results