CVE-2026-116237

HighCVSS 8.4/10Last modified Nov 2, 2026

Description

A vulnerability was found in Oray Pugongying X5 Pro 7.6.1. This affects an unknown part of the component Dnsmasq. Performing a manipulation results in crlf injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 8.4/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-93

Affected software

No affected versions have been published.

Timeline

Published: Oct 26, 2026
Last modified: Nov 2, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1162389.8In server mode pgAdmin 4 locks an internal account after MAX_LOGIN_ATTEMPTS failed logins (3 by default). The limit could be bypassed, givin CVE-2026-1162398.8In server mode pgAdmin 4 keeps an account per authentication source, so the same username can exist as, for example, an internal account and CVE-2026-116249.4The Model Context Protocol has a security warning advising servers to validate the "Origin" header on all incoming connections to prevent DN CVE-2026-1162406.5In server mode pgAdmin 4 validates a path into the user's storage directory with check_access_permission(), which builds the absolute path w CVE-2026-1162418.8pgAdmin 4's Import/Export Data tool wraps a user's query export in a psql \copy (...) TO command and checks that the query's parentheses are CVE-2026-1162429.6pgAdmin 4 opens SSH tunnels with the sshtunnel library but gave it neither host_pkey_directories nor ssh_config_file, so it always loaded th CVE-2026-1162438.8pgAdmin 4 runs pg_dump, pg_restore, pg_dumpall and psql from the binary path a user sets in their preferences. In server mode the binary pat CVE-2026-1162449.6When a pgAdmin 4 connection was not meant to use a Kerberos user's delegated credentials, pgAdmin removed KRB5CCNAME from its environment, s CVE-2026-1162459.6libpq looks a connection service up in the service file of the operating-system account running pgAdmin 4, and an entry there can hold a pas CVE-2026-1162467.6To pass a server's password to psql and to the utilities pgAdmin 4 runs as background processes, the server manager wrote it into pgAdmin's CVE-2026-1162479.6When a server in pgAdmin 4 had no password file, client certificate or client key configured, or the configured one could not be found, pgAd CVE-2026-1162486.8In pgAdmin 4 server mode only administrators are meant to share a server with all users; the server dialog shows the Shared switch only to t