Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to create, steal, and falsely complete replication tasks via the coro_rpc port. Attackers can invoke CreateCopyTask, CreateMoveTask, FetchTasks, and MarkTaskToComplete with victim client UUIDs disclosed by QueryTask to hijack task queues and record replication that never occurred.
Mooncake Store versions up to 0.3.13.post1 have a missing authentication vulnerability that allows unauthenticated attackers to force-delete any object via specific functions on the coro_rpc port. This can lead to cache loss and request failures.
Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the Store REST service, which binds to 0.0.0.0 without authentication on any route. Unauthenticated attackers can call routes such as /api/get, /api/put, /api/remove_all and /api/mount to read cached KV data with user prompts, inject or delete objects, and mount attacker-described segments.
Remote Monitoring and Management (RMM) software used by Managed Service Providers (MSPs) grants privileged access across multiple customer environments, making its security controls critical to limit risk. This report outlines eight essential security controls MSPs should test when evaluating RMM platforms, including endpoint discovery, patch management, privileged access controls, alert prioritization, secure automation, integration with security operations, recovery readiness, and tenant separation. Recent incidents involving RMM vulnerabilities and exploitation highlight the importance of these controls. MSPs must ensure that RMM tools provide strong identity management, tenant isolation, and seamless integration with security and recovery workflows to reduce the attack surface and potential blast radius from compromised accounts or endpoints.
CVE-2026-85523 is a high-severity OS command injection vulnerability in Felisify Information Technologies Industry and Trade Inc.'s SambaBox product. It affects versions before 5.4.1. The flaw involves improper neutralization of special elements in OS commands, allowing an attacker with limited privileges to execute arbitrary commands. The vulnerability has a CVSS 3.1 score of 8.8, indicating high impact on confidentiality, integrity, and availability.
CVE-2026-34498 is an improper input validation vulnerability in Johnson Controls Illustra Standard - L4L China on Windows that allows OS command injection. It affects versions prior to 6.0.0.66394. The vulnerability has a medium severity with a CVSS 4.0 score of 5.1. No patch or official fix information is provided in the available data.
CVE-2026-91140 is a critical OS command injection vulnerability in Progress Software Autonomous REST Connector GenAI Agents version 2.0. It arises from improper neutralization of special elements in shell-based temporary-file cleanup instructions. An attacker can exploit this by supplying a crafted Swagger/OpenAPI document, leading to arbitrary command execution on a developer's machine when the generator is invoked.
CVE-2026-87975 is an authorization bypass vulnerability in Django affecting versions 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. The issue arises in django.forms.models.BaseModelFormSet.save_existing_objects(), which incorrectly trusts the presence of a primary key on a submitted form's instance as proof that the instance belongs to the formset's limiting queryset. This flaw allows an authenticated user with permission to submit such a formset to delete objects outside the intended queryset by submitting forged management-form data. Models using the default AutoField primary key are not affected. The vulnerability has a medium severity with a CVSS score of 4.3.
An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18.
An incomplete fix for CVE-2026-15307 in Django spatial lookups allows an attacker who can supply `bytes` values to cause the Django process to make network requests via a crafted VRT document referencing an external raster source.
Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.
Django would like to thank sicksec for reporting this issue.
An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18.
`django.utils.http.parse_header_parameters()` was subject to a potential denial-of-service attack due to quadratic time complexity when parsing a value with many separators inside a quoted parameter. An unauthenticated request could reach this parsing through headers such as `Accept` or `Content-Type`, for instance via the content negotiation performed by `HttpRequest.accepts()`. The per-call length limit does not bound the combined size of repeated headers.
Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.
Django would like to thank Jisung Chae for reporting this issue.
An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18.
`django.utils.translation.get_supported_language_variant()` is subject to
a potential denial-of-service attack when processing many distinct, very long
language codes, which are retained as keys in an in-memory cache and
consume process memory.
Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.
Django would like to thank Gleb Lizunov for reporting this issue.
CVE-2026-82924 is an improper control of interaction frequency vulnerability in Expert Mail by Pusula Communication, IT, and Internet Industry and Trade Co. Ltd. This flaw allows brute force attacks due to insufficient rate limiting or interaction controls. The vulnerability affects versions of Expert Mail up to and including 2026-09-18. It has a medium severity with a CVSS score of 5.3, indicating limited confidentiality impact and no integrity or availability impact.
CVE-2026-105920 is a SQL injection vulnerability in the Kusalkasilva Learning-Management-System affecting the student_signup.php file in the Student Registration Endpoint. The vulnerability allows remote attackers to manipulate SQL queries, potentially compromising the database. The product uses a rolling release model, so specific affected versions are not identified. The issue was reported early but has not yet been addressed by the vendor. The vulnerability has a medium severity with a CVSS score of 6.9 and public exploit details are available.
CVE-2025-15591 is a medium severity cross-site scripting (XSS) vulnerability in the Forums feature of OpenText Content Management Content Server. It allows an attacker to inject malicious code into a Forums web page. The vulnerability affects versions from 20.3 up to but not including 25.3. There is no information about an available patch or vendor advisory specifying remediation status. No known exploits in the wild have been reported.
Threat actors are abusing legitimate Remote Management & Monitoring (RMM) tools, specifically the Action1 RMM tool, by distributing malicious phishing emails with PDF attachments that redirect to malicious VBS scripts. These scripts download and install the Action1 RMM tool as a persistence mechanism, leveraging the tool's legitimate cloud infrastructure likely via free or test accounts. The tool installs as a service on the victim's machine and connects to the vendor's infrastructure. This abuse allows attackers to maintain remote access under the guise of legitimate software.
Smarty versions before 4.5.8 and 5.x before 5.8.5 contain a code injection vulnerability due to improper handling of the nocache_hash during multi-component template inheritance. This flaw allows attackers to inject arbitrary PHP code via crafted assigned data, leading to remote code execution when the PHP cache file is included.