hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 contains an arbitrary module import vulnerability via the ray_pkg_version OmegaConf resolver passing input to importlib.import_module(). Attackers controlling configuration values or command-line overrides can supply a ray_pkg_version interpolation to import any installed module, triggering its import-time side effects in the application process.
CVE-2026-112848 is a critical deserialization of untrusted data vulnerability in AivahThemes Hostme v2. This flaw allows object injection, potentially leading to full compromise of confidentiality, integrity, and availability. It affects Hostme v2 versions from 0 up to and including 7.0. The vulnerability has a CVSS 3.1 base score of 9.8, indicating critical severity. No patch or remediation information is provided in the available data.
A Cross-site Scripting (XSS) vulnerability exists in AivahThemes Hostme v2, identified as CVE-2026-112849. This vulnerability involves improper neutralization of input during web page generation, allowing DOM-based XSS attacks. It affects Hostme v2 versions up to and including 7.0. The vulnerability has a high severity rating with a CVSS score of 7.1. No patch or remediation information is currently provided.
CVE-2026-112850 is a high-severity vulnerability in AncoraThemes Your Dress (versions up to 1.4.1) involving improper control of filenames used in PHP include/require statements, leading to PHP Local File Inclusion. This flaw allows an attacker to include unauthorized files on the server, potentially resulting in full compromise of confidentiality, integrity, and availability of the affected system.
CVE-2026-112854 is a critical deserialization of untrusted data vulnerability in axiomthemes Holistic Center up to version 1.2.6. It allows object injection, which can lead to full compromise of confidentiality, integrity, and availability. The vulnerability has a CVSS score of 9.8, indicating high severity. No patch or remediation details are currently provided.
A critical deserialization of untrusted data vulnerability (CVE-2026-112847) exists in ThemeREX ZenSoul up to version 1.13. This flaw allows object injection, potentially leading to full compromise of confidentiality, integrity, and availability. The vulnerability has a CVSS score of 9.8, indicating a high severity with network attack vector and no required privileges or user interaction.
A critical deserialization of untrusted data vulnerability (CVE-2026-112846) exists in ThemeREX Group Save Life save-life, allowing object injection. This affects versions up to and including 1.2.14. The vulnerability has a CVSS score of 9.8, indicating high severity with network attack vector, no privileges or user interaction required, and impacts confidentiality, integrity, and availability.
CVE-2026-112851 is a critical vulnerability in ThemeREX Group HotLock up to version 1.3.9 that allows deserialization of untrusted data leading to object injection. This flaw can be exploited remotely without authentication and results in full confidentiality, integrity, and availability compromise of the affected system.
CVE-2026-112852 is a high-severity vulnerability in ThemeREX Group Helion up to version 1.1.12. It involves deserialization of untrusted data, which allows object injection. This flaw can lead to complete compromise of confidentiality, integrity, and availability of the affected system. The vulnerability has a CVSS 3.1 score of 8.1, indicating a network attack vector with high impact but requiring high attack complexity and no privileges or user interaction.
A critical deserialization of untrusted data vulnerability (CVE-2026-112853) exists in axiomthemes Hallelujah theme versions up to 1.1.1. This flaw allows object injection, potentially leading to full compromise of confidentiality, integrity, and availability. The vulnerability has a CVSS score of 9.8, indicating a high severity with network attack vector, no privileges or user interaction required. No patch or remediation details are currently provided.
CVE-2026-112856 is a critical deserialization of untrusted data vulnerability in ThemeREX Group Vagabonds up to version 1.3.10. It allows object injection, potentially leading to full compromise of confidentiality, integrity, and availability. The vulnerability has a CVSS score of 9.8, indicating high severity. No patch or remediation details are provided in the available data.
A critical deserialization of untrusted data vulnerability (CVE-2026-112857) exists in axiomthemes Reprizo plugin versions up to 1.0.8. This flaw allows object injection, potentially leading to full compromise of confidentiality, integrity, and availability. The vulnerability has a CVSS score of 9.8, indicating severe impact. No patch or remediation details are provided in the available data.
A critical deserialization of untrusted data vulnerability (CVE-2026-112858) exists in axiomthemes Rhodos theme versions up to 1.3.3. This flaw allows object injection, potentially leading to full compromise of confidentiality, integrity, and availability. The vulnerability has a CVSS 3.1 score of 9.8, indicating high severity and ease of remote exploitation without privileges or user interaction.
CVE-2026-112859 is a critical deserialization of untrusted data vulnerability in ThemeREX Group's Little Birdies product, affecting versions from 0 up to and including 1.3.16. This vulnerability allows object injection, potentially leading to full compromise of confidentiality, integrity, and availability. The CVSS 3.1 base score is 9.8, indicating a highly severe issue exploitable remotely without privileges or user interaction.
A critical deserialization of untrusted data vulnerability (CVE-2026-112855) exists in axiomthemes Redy up to version 1.3.5. This flaw allows object injection, potentially leading to full compromise of confidentiality, integrity, and availability. The vulnerability has a CVSS score of 9.8, indicating high severity. No patch or remediation information is currently provided.
CVE-2026-112863 is a reflected cross-site scripting (XSS) vulnerability in Hogash KALLYAS affecting versions up to and including 4.25.0. The vulnerability arises from improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts. This can lead to partial compromise of confidentiality, integrity, and availability. The vulnerability has a high severity score of 7.1 (CVSS 3.1). No patch or remediation information is currently provided.
Aokigahara is a newly observed infostealer malware that targets a wide range of sensitive data on Windows systems. It steals traditional credentials such as browser passwords, cookies, cryptocurrency wallets, VPN and FTP client data, email profiles, and password manager files. Uniquely, it also targets AI applications and developer tools including Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, and Gemini CLI, collecting authentication files, session tokens, and configuration data. The malware additionally targets cloud environment credentials for AWS, Azure, and Google Cloud, as well as developer environment secrets like Git credentials and SSH private keys. Stolen AI and cloud credentials could enable unauthorized access to paid AI services, cloud resources, and source code repositories. The malware includes capabilities such as screenshot capture, clipboard theft, and a clipper component for cryptocurrency manipulation. There is no confirmed information on how the stolen data is monetized. No patch or remediation guidance is provided.
CVE-2026-115730 is a low-severity vulnerability in i18next-http-backend versions 4.0.2 up to but not including 4.0.3. It involves an incomplete fix in the interpolateUrl() function that allows attackers controlling the namespace (ns) value to redirect translation requests by supplying a namespace starting with a slash. This can lead to loading attacker-hosted translations, enabling UI content injection and cross-site scripting (XSS).
CVE-2026-115729 is a server-side request forgery (SSRF) vulnerability in the pdfme common library versions from 5.5.10 up to but not including 6.2.6. The flaw allows attackers to bypass the isUrlSafeToFetch denylist in the getB64BasePdf function by using specially crafted basePdf URLs with IPv4-mapped IPv6, [::], NAT64, or localhost alias hostnames. This enables reading of loopback, internal, or cloud metadata responses through generated PDF documents.
@hapi/content versions 6.0.1 through before 6.0.3 contain a regular expression denial of service (ReDoS) vulnerability in the Content.disposition() function. This issue arises from an incomplete fix for a previous vulnerability (CVE-2026-35213). An unauthenticated remote attacker can exploit this by sending multipart uploads with a long Content-Disposition parameter that lacks an equals sign, causing quadratic backtracking that blocks the event loop.