CVEs published October 26, 2026

A weakness has been identified in Oray Pugongying X5 Pro 7.6.1.

A security flaw has been discovered in Oray Pugongying X5 Pro 7.6.1.

A flaw has been found in Oray Pugongying X5 Pro 7.6.1.

A vulnerability was detected in Oray Pugongying X5 Pro 7.6.1.

A security vulnerability has been detected in Oray Pugongying X5 Pro 7.6.1.

SOEM version 2.0.0 and earlier contains a vulnerability in multi-segment data transfers where a malicious device can overflow memory buffers.

Cross-Site Request Forgery (CSRF) vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Cross Site Request Forgery.This issue affects FunnelKit Automations: from n/a through 3.8.5.2.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Blind SQL Injection.This issue…

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine jet-engine allows SQL Injection.This issue affects JetEngine: from n/a through 3.9.0.

Electronic delivery item Inspection Support System provided by Japan's Ministry of Land, Infrastructure, Transport and Tourism contains an improper file access permission vulnerability.

A vulnerability was found in Oray Pugongying X5 Pro 7.6.1.

SOEM version 2.0.0 and earlier contains vulnerabilities where a malicious device on the network can send specially crafted messages that cause the master to write data outside allocated memory boundaries.

A vulnerability was detected in Yoosee GM8135S Camera 21.00.01.36.

V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6ComFile!CCheck::ItemCheck.

V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6EditData!CDataRomErrorCheck::CheckSymbolMacroParam.

V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6EditData!CDataRomErrorCheck::MacroCommandCheck.

V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6MemInIF!set_temp_type_default.

V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6ComFile!load_gr_item.

V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds write vulnerability.

V-SFT provided by FUJI ELECTRIC CO., LTD. contains a stack-based buffer overflow vulnerability.

The process_feed_response method in src/mispguard.py was responsible for evaluating feed responses before they reached the MISP instance.

Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash allows a user of one tenant to read, overwrite and take over another tenant's records via an upserting create action.

A vulnerability was determined in BillaBear up to 2025.01.03.

A vulnerability was found in geesondog RhaPHP up to 7ae639ccf8dcb627faace096d030bd4cb4cfb905.

A vulnerability was determined in DedeCMS 5.7.118.

A flaw has been found in halo-dev halo up to 2.27.0-beta.1.

A vulnerability was identified in HashenUdara edoc-doctor-appointment-system up to cc258425b915d1af9e298777ccd26d160493e68d.

A vulnerability was found in GiantappMan LiveWallPaper 2.6.8.0 on Windows.

A security vulnerability has been detected in HeyCyan App 1.0.103 on Android.

A vulnerability has been found in Oray Pugongying X5 Pro 7.6.1.

SOEM version 2.0.0 and earlier contains multiple vulnerabilities in frame processing where a malicious device can cause the master to read data outside allocated buffers.

MISP Guard, a proxy-based security filter for MISP (Malware Information Sharing Platform) feed distribution, contains a case-sensitivity flaw in multiple policy enforcement checks.

Pleasanter provided fails to properly verify passwords in LDAP authentication when processing specially crafted requests under certain configurations.

A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 11 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 9 compatible) (All versions…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Stored XSS.This issue affects Royal…

SOEM version 2.0.0 and earlier contains a vulnerability where a malicious device can crash the master system.

SOEM version 2.0.0 and earlier contains a vulnerability during device configuration where a malicious device can cause memory corruption.

SOEM version 2.0.0 and earlier contains vulnerabilities where a malicious device can send messages that cause the master to read data from memory locations beyond the intended buffer.

A vulnerability was identified in rathena FluxCP up to 98cd4b8fd83228c11b36fb3d097b8e0f7c105a8d.

A flaw has been found in icret EasyImage up to 2.8.7.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Slider b-slider allows Stored XSS.This issue affects B Slider: from n/a through 2.2.2.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Panorama Viewer – 360 Degree Image + Video Viewer panorama allows Stored XSS.This issue affects…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Advanced Post Block - Post Grid for WordPress block editor advanced-post-block allows Stored…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dylan Kuhn Geo Mashup geo-mashup allows Stored XSS.This issue affects Geo Mashup: from n/a through…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Weber Lazy Load for Videos lazy-load-for-videos allows Stored XSS.This issue affects Lazy Load for…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Smart Widgets Better Post & Filter Widgets for Elementor better-post-filter-widgets-for-elementor…

Missing Authorization vulnerability in WP Smart Widgets Better Post & Filter Widgets for Elementor better-post-filter-widgets-for-elementor allows Exploiting Incorrectly Configured Access Control Security…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Image Gallery block – Create and display photo gallery/photo album. 3d-image-gallery allows…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Stored XSS.This issue…

Insertion of Sensitive Information Into Sent Data vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Retrieve Embedded Sensitive Data.This issue affects Media LIbrary…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Funa Ad Inserter ad-inserter allows Reflected XSS.This issue affects Ad Inserter: from n/a through…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSmartFilters jet-smart-filters allows Stored XSS.This issue affects JetSmartFilters: from…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows DOM-Based XSS.This issue affects Royal…

The Mintpay for WooCommerce WordPress plugin through 2.2.3 does not verify the authenticity of the payment callback it processes, allowing unauthenticated attackers to mark arbitrary orders as paid, to…

A vulnerability was identified in libimobiledevice up to 1.4.0.

A vulnerability was identified in Ndemic Creations Plague Inc Evolved up to 1.24.0.3.

A security vulnerability has been detected in GNOME libgsf up to 1.14.60.

A vulnerability has been found in Z.ai Zcode up to 3.14.3/3.15.1.

A security flaw has been discovered in GouGuOA up to 6.1.2.

A vulnerability was determined in 2K Games Civilization V 1.0.3.144.

A vulnerability has been found in continuedev Continue 2.0.0.

A security flaw has been discovered in Sony Neural Network Libraries up to 1.39.0.

A vulnerability was identified in Sony Neural Network Libraries up to 1.39.0.

A vulnerability was determined in QuantGeekDev docker-mcp 0.1.0/0.2.0.

A vulnerability was found in itsourcecode Online Cake Ordering System 1.0.

A flaw has been found in Fusion Creators Studio SCP Containment Breach Multiplayer up to 1.295.

A vulnerability was detected in SteelRaven7 Ravenfield 25407073.

A vulnerability was determined in NocoDB up to 2026.07.0.

Multiple cross site scripting (XSS) vulnerabilities affect OPNsense firewall vesrion 26.7.1_1 and earlier allows low privileged attacker to execute Javascript in the context of another user visiting a…

A vulnerability was found in NocoDB up to 2026.08.0.

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache Camel AWS2-s3 component.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Docling component.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Docling component.

A vulnerability was detected in Datafeedr Product Sets Plugin up to 1.3.24 on WordPress.

Missing Authorization vulnerability in Dylan Kuhn Geo Mashup geo-mashup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Geo Mashup: from n/a through 1.13.22.

Authorization Bypass Through User-Controlled Key vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue…

A security flaw has been discovered in libimobiledevice up to 1.4.0.

A vulnerability has been found in PGYER codefever up to 0c35e60f006f9d558cc33a159baf110659351990.

Missing Authorization vulnerability in WPExperts APIExperts Square for WooCommerce woosquare allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects APIExperts Square for…

Missing Authorization vulnerability in WP Discussion Board WP Discussion Board wp-discussion-board allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Discussion…

Missing Authorization vulnerability in Magepeople inc.

Missing Authorization vulnerability in Supsystic Contact Form by Supsystic contact-form-by-supsystic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form…

The GiveWP WordPress plugin before 4.19.0.1 does not restrict the currency of a donation to the one the site or form accepts, while comparing its amount limits as bare numbers, allowing unauthenticated…

Missing Authorization vulnerability in VillaTheme Bopo – WooCommerce Product Bundle Builder bopo-woo-product-bundle-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue…

The OPay Payment Gateway for WooCommerce WordPress plugin through 2.5.5 does not properly verify that payment notifications originate from the payment provider, as the secret used to validate their…

The Online Payments with iK Pay Gateway WordPress plugin before 3.0.4 does not properly verify the authenticity of its payment gateway callback on a default installation, allowing unauthenticated attackers…

The Eurobank WooCommerce Payment Gateway WordPress plugin through 2.1.1 does not verify that a payment-confirmation request genuinely originates from the payment provider, and ships with the secret that…

The CCAvenue Payment Gateway for WooCommerce WordPress plugin through 3.1 does not verify that a payment-confirmation request genuinely originates from the payment provider, and derives its verification key…

Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel CoAP component.

Reflected Cross-Site Scripting (XSS) in Gym Management Software IsMyGym by Zuinq Studio affecting the reservation endpoint where the 'ret' parameter is reflected in the HTTP response without any proper…

A reflected Cross-Site Scripting (XSS) vulnerability has been identified in the web application of the Castile-La Mancha Regional Parliament’s video library.

Insufficient Session Expiration vulnerability in Apache Camel Keycloak component.

A vulnerability has been identified in BRAIN2 versions up to and including version 3.09.

Cross-Site Request Forgery (CSRF) vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Cross Site Request Forgery.This issue affects Media LIbrary Assistant: from n/a…

A vulnerability has been found in fr0tt benotes up to 2.8.1.

A flaw has been found in openbq-org OpenBB up to 4.7.2/5.0.0.

A security vulnerability has been detected in CloudClassroom-PHP-Project.

Missing Authorization vulnerability in WPExperts APIExperts Square for WooCommerce woosquare allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects APIExperts Square for…

Missing Authorization vulnerability in Meow Apps AI Engine ai-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Engine: from n/a through 3.8.6.

Missing Authorization vulnerability in VillaTheme DEPART depart-deposit-and-part-payment-for-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DEPART: from n/a…

A weakness has been identified in NocoDB up to 2026.07.0.

A security flaw has been discovered in NocoDB up to 2026.07.0.

A vulnerability was identified in NocoDB up to 2026.08.0.

A weakness has been identified in Yoosee GM8135S Camera 21.00.01.36.

A weakness has been identified in HeyCyan App 1.0.103 on Android.

A vulnerability was determined in ffxiv-teamcraft FFXIV Teamcraft up to 11.4.31.

A vulnerability was found in 777genius agent-teams-ai up to 2.17.10.

A security vulnerability has been detected in Yoosee GM8135S Camera 21.00.01.36.

A vulnerability has been found in Edimax BR-6208AC 1.32.

A vulnerability has been found in gougucms up to 4.08.18.

The Payment Gateway WordPress plugin through 2.2.0 does not ensure a shared secret is configured before using it to authenticate the bank's payment-notification callback, allowing unauthenticated attackers…