CVE-2026-41226

MediumCVSS 5.1/10Last modified Aug 31, 2026

Description

Open redirect vulnerability exists in Multiple laser printers and MFPs which implement Ricoh Web Image Monitor. When accessing a specially crafted URL, the user may be redirected to an arbitrary website. As a result, the user may become a victim of a phishing attack.

Metrics

CVSS 4.0 5.1/10CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-601

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Apr 30, 2026
Last modified
Aug 31, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-412277.5On an HTTP/2 virtual server with Layer 7 DoS Protection configured, undisclosed traffic can result in an increase in memory consumption causCVE-2026-412289.9Froxlor is open source server administration software. Prior to version 2.3.6, the Froxlor API endpoint `Customers.update` (and `Admins.updaCVE-2026-412299.1Froxlor is open source server administration software. Prior to version 2.3.6, `PhpHelper::parseArrayToString()` writes string values into sCVE-2026-41234.3The RW Elephant Rental Inventory plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 2.3.13. ThiCVE-2026-412308.5Froxlor is open source server administration software. Prior to version 2.3.6, `DomainZones::add()` accepts arbitrary DNS record types withoCVE-2026-412317.5Froxlor is open source server administration software. Prior to version 2.3.6, `DataDump.add()` constructs the export destination path from CVE-2026-412325.0Froxlor is open source server administration software. Prior to version 2.3.6, in `EmailSender::add()`, the domain ownership validation for CVE-2026-412335.4Froxlor is open source server administration software. Prior to version 2.3.6, in `Domains.add()`, the `adminid` parameter is accepted from CVE-2026-412347.6Froxlor is open source server administration software. Prior to version 2.3.7, the `DomainZones.add` API endpoint does not sanitize newline CVE-2026-412358.6Froxlor is open source server administration software. Version 2.3.6 lets administrators configure `system.available_shells` as the approvedCVE-2026-412368.8Froxlor is open source server administration software. Version 2.3.6 contains a symlink-following flaw in the root-owned SSH key synchronizaCVE-2026-412378.6Froxlor is open source server administration software. In version 2.3.6 and earlier, the LOC record regex uses `\s+` which matches newlines
CVE-2026-41226: Medium severity, CVSS 5.1 | Vulnix