🚨 Fuji Electric V-SFT File Parsing Flaw Risks Code Execution
Organizations using V-SFT in industrial environments should prioritize vendor updates and restrict untrusted V7 files. Treat project files received from external sources as potentially dangerous until the issue is remediated.
CVE-2026-107900 is a HIGH-severity out-of-bounds read vulnerability in Fuji Electric V-SFT, rated CVSS 7.8. The flaw affects VS6ComFile!CCheck::ItemCheck and can be triggered by opening a specially crafted V7 file, potentially exposing sensitive information or enabling arbitrary code execution.
🔗 Read more 🔗
Source: NVD
⚠️ Fuji Electric V-SFT Symbol Macro Parsing Exposes Systems
V-SFT administrators should check for security updates promptly, particularly on engineering workstations handling externally supplied projects. Avoid opening unfamiliar V7 files until appropriate mitigations are in place.
CVE-2026-107899 is a HIGH-severity vulnerability with a CVSS score of 7.8 affecting Fuji Electric V-SFT. An out-of-bounds read in VS6EditData!CDataRomErrorCheck::CheckSymbolMacroParam can be triggered through a malicious V7 file, potentially causing information disclosure or arbitrary code execution.
🔗 Read more 🔗
Source: NVD
🚨 Malicious V7 Files Threaten Fuji Electric V-SFT Macro Processing
Engineering teams running V-SFT should prioritize checking for vendor fixes and limit the use of untrusted project files. This deserves prompt attention wherever operators routinely exchange V7 files.
CVE-2026-107898 affects Fuji Electric V-SFT and carries a HIGH severity rating with CVSS 7.8. The vulnerability is an out-of-bounds read in VS6EditData!CDataRomErrorCheck::MacroCommandCheck, where opening a crafted V7 file may result in information exposure or arbitrary code execution.
🔗 Read more 🔗
Source: NVD
🛡️ Fuji Electric V-SFT Memory Handling Bug Opens Code Execution Risk
Administrators responsible for V-SFT deployments should review vendor advisories and apply fixes when available. Until then, keep untrusted V7 files away from engineering workstations, especially in sensitive industrial environments.
CVE-2026-107897 is a HIGH-severity out-of-bounds read vulnerability in Fuji Electric V-SFT, assigned CVSS 7.8. The affected function, VS6MemInIF!set_temp_type_default, may process malicious V7 files in a way that exposes information or permits arbitrary code execution.
🔗 Read more 🔗
Source: NVD
⚠️ Fuji Electric V-SFT Graphics Loader Vulnerable to Crafted Files
Teams maintaining V-SFT installations should seek updated software and enforce cautious handling of imported project files. Prioritize workstations that regularly open V7 files from third parties.
CVE-2026-107896 is a HIGH-severity vulnerability affecting Fuji Electric V-SFT with a CVSS score of 7.8. An out-of-bounds read in VS6ComFile!load_gr_item can be triggered by opening a crafted V7 file, potentially leading to information exposure or arbitrary code execution.
🔗 Read more 🔗
Source: NVD
🚨 Out-of-Bounds Write in Fuji Electric V-SFT Threatens Code Execution
V-SFT users should treat this as a priority memory-safety issue and check for vendor remediation immediately. Avoid untrusted V7 files, particularly on engineering machines with access to operational technology environments.
CVE-2026-107895 is a HIGH-severity out-of-bounds write vulnerability in Fuji Electric V-SFT, rated CVSS 7.8. Opening a specially crafted V7 file may exploit the memory corruption issue, potentially exposing information or enabling arbitrary code execution on the affected system.
🔗 Read more 🔗
Source: NVD
🔥 Stack Buffer Overflow Puts Fuji Electric V-SFT Workstations at Risk
Engineering workstation owners should prioritize remediation and avoid opening V7 files from unknown sources. Stack buffer overflows can have serious consequences, so review available vendor fixes as soon as possible.
CVE-2026-107894 is a HIGH-severity stack-based buffer overflow vulnerability affecting Fuji Electric V-SFT, with a CVSS score of 7.8. Processing a maliciously crafted V7 file may trigger the overflow, potentially resulting in information disclosure or arbitrary code execution.
🔗 Read more 🔗
Source: NVD
🌐 Public Exploit Targets Remote Path Traversal in Halo CMS
Administrators running affected Halo instances should investigate immediately because a public exploit is available and remote attacks are possible. Monitor suspicious template requests, restrict unnecessary exposure and check for patched releases or mitigations. Public exploit availability does not itself confirm active exploitation.
CVE-2026-116117 is a HIGH-severity path traversal vulnerability in halo-dev halo up to 2.27.0-beta.1, rated CVSS 7.3. The issue affects run.halo.app.theme.DefaultViewNameResolver.resolveViewNameOrDefault, where manipulation of the template argument may enable remote path traversal. An exploit has been publicly released, and the vendor reportedly did not respond to the disclosure.
🔗 Read more 🔗
Source: NVD
🚨 Insecure File Permissions Enable Code Execution in Japanese Government Software
Organizations using this inspection software should urgently review installation directory permissions and apply vendor guidance or fixes. Restrict modification rights to trusted administrators to reduce the risk of software tampering and code execution.
CVE-2026-113345 is a HIGH-severity vulnerability with a CVSS 4.0 score of 8.5 affecting the Electronic Delivery Item Inspection Support System provided by Japan’s Ministry of Land, Infrastructure, Transport and Tourism. Improper file access permissions allow files in the application’s installation directory to be tampered with, potentially resulting in arbitrary code execution.
🔗 Read more 🔗
Source: NVD
📷 Yoosee Camera Secure Boot Flaw Undermines Firmware Trust
Operators managing affected Yoosee cameras should prioritize firmware security reviews, restrict physical and local access, and check for vendor fixes. The public exploit increases concern, although the stated local-access requirement limits the remote attack scenario.
CVE-2026-116116 is a HIGH-severity vulnerability affecting the Secure Boot component of Yoosee GM8135S Camera 21.00.01.36, rated CVSS 8.2. Improper verification of cryptographic signatures may allow an attacker with local access to undermine secure boot protections. A public exploit is available, and the vendor reportedly did not respond to the disclosure.
🔗 Read more 🔗
Source: NVD
💉 Public SQL Injection Exploit Threatens Doctor Appointment System
Administrators running this appointment system should investigate urgently because remote exploitation is possible and exploit code is public. Review the affected endpoint, restrict unnecessary access, inspect database activity and apply verified source-level fixes when available. Systems handling patient information deserve particular attention.
CVE-2026-116112 is a HIGH-severity SQL injection vulnerability in HashenUdara edoc-doctor-appointment-system up to commit cc258425b915d1af9e298777ccd26d160493e68d, rated CVSS 7.3. The issue affects admin/add-new.php, where manipulation of the spec argument can enable remote SQL injection. A public exploit is available, the vendor reportedly did not respond, and the rolling-release model provides no clear affected or fixed version numbers.
🔗 Read more 🔗
Source: NVD
🔓 LiveWallPaper Upload Endpoint Exposed by Missing Authentication
Windows administrators using LiveWallPaper 2.6.8.0 should apply the identified patch promptly and prevent untrusted network access to the affected upload endpoint. With public exploit details available and authentication missing, exposed installations deserve urgent review.
CVE-2026-116110 is a HIGH-severity missing authentication vulnerability in GiantappMan LiveWallPaper 2.6.8.0 on Windows, with a CVSS score of 7.3. The flaw affects the /LiveWallpaper/UploadFile endpoint in the SignalR Hub component and can be exploited remotely. A public exploit exists, and a corrective patch is identified by commit b62f878899adbfc2968e3345442f3a3df91b774d.
🔗 Read more 🔗
Source: NVD