The sshole vulnerability (CVE-2026-123158) has recently emerged, leading to increased scanning and exploitation attempts observed by honeypots using Cowrie. Starting November 1st, there has been a notable rise in SSH login attempts using unusually long passwords, some containing shell commands. Initial exploit attempts began on November 5th with repeated password patterns. Multiple IP addresses from various autonomous systems worldwide have been identified as sources of these scans. The honeypot data suggests some of these attempts may have succeeded, but detailed exploitation impact is not yet fully analyzed.
BabelDOC versions from 0.3.61 up to but not including 0.7.0 contain a resource exhaustion vulnerability. This flaw allows remote attackers to cause excessive CPU and memory consumption by submitting a crafted PDF with an embedded ToUnicode CMap that declares extremely large bfrange and cidrange spans. This triggers billions of loop iterations in the translation worker, effectively stalling it. The vulnerability is fixed in version 0.7.0.
CVE-2026-124552 is a stored cross-site scripting (XSS) vulnerability in Webmin versions up to 2.670, specifically affecting the Shorewall and Shorewall6 modules' list.cgi. Authenticated users with table edit permissions can inject JavaScript code via savecmt.cgi or table entries, which executes when other users, including root, view the affected list page. This vulnerability has a medium severity rating with a CVSS 4.8 score.
ClassroomIO versions up to 1.0.0 have an authorization bypass vulnerability allowing authenticated users from any organization to clone courses belonging to other tenants. By exploiting the POST /course/:courseId/clone endpoint with a known course ID, attackers can copy sections, lessons, exercises, and quiz answer keys into their own organization, exposing private course content.
MRBS (Meeting Room Booking System) versions before 1.12.3 contain a reflected cross-site scripting (XSS) vulnerability in the view_entry.php script via the error parameter. This flaw allows unauthenticated attackers to craft malicious links that, when visited by logged-in users, can lead to theft of CSRF tokens and unauthorized modification or deletion of bookings, including administrative actions. The vulnerability is fixed in version 1.12.3.
CVE-2026-124465 is a denial of service vulnerability in Trendyol kafka-konsumer versions 2.3.3 up to but not including 2.6.18. The flaw occurs in batch_consumer.go where the consumer panics if a single record exceeds the MessageGroupByteSizeLimit. An attacker able to produce messages to the consumed Kafka topic can send an oversized record that causes the consumer to crash before committing offsets, resulting in a persistent crash loop.
---
_-= Per source details. Do not edit below this line.=-_
## Source: kam193 (fe5cc784eb96a4025bcd45731fcb19c3826a122a02ec4fed1cbee875fa2ca98b)
Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.
---
Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.
Campaign: GENERIC-standard-pypi-install-pentest
Reasons (based on the campaign):
- The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.
- The package overrides the install command in setup.py to execute malicious code during installation.
CVE-2026-124331 is a medium severity SQL injection vulnerability in Jinher OA C6. It affects the ProjectAfficheManage.aspx file, specifically the ProjID argument, allowing remote attackers to manipulate SQL queries. Public exploit code is available, but no vendor response or patch has been provided.
SunEditor versions before 3.4.0 have a stored cross-site scripting (XSS) vulnerability due to improper input neutralization in the html.clean() sanitizer's _normalizeURL() function. This function decodes named entities like : to an empty string, allowing attackers to inject malicious href values such as javascript: that bypass safety checks but execute JavaScript in victims' browsers when clicked. The vulnerability is fixed in version 3.4.0.
SunEditor versions prior to 3.4.0 contain a stored cross-site scripting (XSS) vulnerability in the DocumentType constructor. This flaw arises because header textContent is injected into innerHTML without proper HTML escaping, allowing attackers to store entity-encoded HTML in header tags (h1-h6). When editors using document:header mode initialize, this malicious content executes JavaScript, potentially enabling session cookie theft.
SunEditor versions before 3.4.0 have a stored cross-site scripting (XSS) vulnerability in the ModalAnchorEditor's #createBookmarkList function. This flaw arises because entity-decoded header text (h1-h6) is inserted into the bookmark list using innerHTML without proper escaping. An attacker can store malicious HTML-encoded payloads in editor headers that execute JavaScript when a user opens the link modal and types # in the URL input. The vulnerability is fixed in version 3.4.0.
SunEditor versions before 3.4.0 have a stored cross-site scripting (XSS) vulnerability in the FileUpload plugin's create() method. This flaw occurs because server-returned file names are assigned to innerHTML without proper escaping, allowing attackers to upload files with malicious HTML content. When such content or gallery items are loaded, the embedded JavaScript executes in victims' browsers, potentially leading to session theft. The vulnerability is fixed in version 3.4.0.
OpenEMR versions prior to 8.3.0 contain a critical path traversal vulnerability in the RingCentral RCFaxClient disposeDocument() method within the oe-module-faxsms. Authenticated attackers can exploit the file_path parameter to read arbitrary files using the action=download option or write web-executable files via action=setup with base64 content, potentially leading to remote code execution. This vulnerability is fixed in OpenEMR 8.3.0.
OpenEMR versions before 8.3.0 have an authorization bypass vulnerability in portal/portal_payment.php. Low-privilege authenticated users can manipulate patient identifier parameters (pid and form_pid) to bypass billing access controls. This allows unauthorized viewing of payment pages and recording of fraudulent payment receipts for arbitrary patients, potentially corrupting billing records.
OpenEMR versions prior to 8.3.0 have an authorization bypass vulnerability allowing authenticated clinicians without high-sensitivity permissions to read and modify encounter-bound forms. This occurs via load_form.php, enabling access to restricted clinical notes or care plans and tampering with clinical records through save.php. The issue is fixed in version 8.3.0.
OpenEMR versions prior to 8.4.0 have an improper authorization vulnerability in the non-patient POST /fhir/DocumentReference/$docref route. This flaw allows users with limited permissions (demographics and documents) to specify a victim patient parameter and download that patient's full-chart CCDA clinical data without proper authorization. The vulnerability is fixed in version 8.4.0.
OpenEMR versions before 8.3.0 have a missing authorization vulnerability in the classic document controller. This flaw allows low-privilege authenticated users to recategorize documents belonging to other patients. Exploiting this, an attacker can move documents into a patients|demo category and retrieve them with an empty patient_id, enabling unauthorized access to protected health information (PHI) and potential tampering with patient charts.
OpenEMR versions prior to 8.3.0 have an authorization bypass vulnerability in the patient portal's onsitedocuments API. Authenticated patients can exploit this flaw by manipulating query parameters to access documents belonging to other patients. This bypass allows exposure of sensitive data including consent bodies, signatures, file paths, and template data. The vulnerability is fixed in version 8.3.0.
OpenEMR versions before 8.4.0 have a missing authorization vulnerability in the portal onsite-document APIs. This flaw allows any authenticated core user to access, list, read, and overwrite documents belonging to other patients by omitting the patientId parameter and supplying arbitrary record IDs. The vulnerability is fixed in version 8.4.0.
OpenEMR versions prior to 8.4.0 have an incorrect authorization vulnerability in the prescription REST API. The API incorrectly checks the patients.med ACL instead of the more restrictive patients.rx ACL and does not require a specific permission bit. This allows authenticated staff users with read-only Medical/History access to enumerate prescription UUIDs, forge prescriptions for arbitrary patients, and deactivate existing prescriptions across the tenant by reusing the UI-exposed APICSRFTOKEN.