CVE-2026-120224
Critical · 9.9CVSS
9.9
EPSS
0.4%
Published
Nov 1, 2026
CISA due date
—
The record
A security flaw has been discovered in Oray Pugongying X5 Pro up to 7.6.1. Affected is the function run_apis_by_json/run_async_task of the component API Authorization. The manipulation results in improper authorization. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-121539 A vulnerability was found in miroslavpejic85 MiroTalk P2P up to 2.0.87/2.1.38. CWE-266
- CVE-2026-121514 A weakness has been identified in EasySoft ZenTao PMS up to 22.6. CWE-266
- CVE-2026-119922 Improper access control in the Babelfish for PostgreSQL extension versions 1.2-1.5… CWE-266
- CVE-2026-120185 A security flaw has been discovered in ken678 YznCMS up to 2.2.0. CWE-266
- CVE-2026-54854 Contributor Privilege Escalation in Profile Builder <= 4.0.5 versions. CWE-266
- CVE-2026-118086 Subscriber Privilege Escalation in WP BASE Booking <= 6.5.2 versions. CWE-266
- CVE-2026-116386 Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 4.0.2 versions. CWE-266
- CVE-2026-119599 AxonHub through 1.0.0-beta11 contains a privilege escalation vulnerability that allows… CWE-266