CVE-2026-115635 is an incorrect authorization vulnerability in ash-project's ash_postgres component. It allows a user to read another tenant's record due to a skipped upsert operation that does not enforce multitenancy attribute checks. This affects versions from 2.6.22 up to but not including 2.15.2. The issue is fixed in version 2.15.2.
CVE-2026-114214 is an incorrect authorization vulnerability in the ash-project ash framework affecting versions from 3.24.0 up to but not including 3.37.1. The flaw allows a client to read destination records unrelated to the source record when querying certain has_many or has_one through relationships with a limit of 1. This occurs because the code path reads destination records without properly filtering them by the source, potentially exposing records that should be inaccessible through that relationship. The issue is fixed in version 3.37.1.
The PyPI package 'zagents-message-bus' contains malicious code that exfiltrates basic host information such as IP address and username upon installation or import. The package overrides the install command in its setup.py to execute this malicious behavior. It serves no legitimate purpose beyond this data exfiltration.
The npm package '@capsense/core-ui' version 99.99.100 has been identified as malicious by the OpenSSF Package Analysis project. The package is flagged because it communicates with a domain associated with malicious activity. There is no CVSS score available, and no known exploits in the wild have been reported. No patch or remediation information is provided.
The npm package '@capsense/ccx-welcome-page' version 99.99.100 has been identified as malicious due to its communication with a domain linked to malicious activity. This behavior classifies the package as a security threat.
CVE-2026-116063 is a code injection vulnerability in DedeCMS version 5.7.118. The flaw exists in the require_once function within the dede/update_guide.php file, where manipulation of the 'vtime' argument allows injection of arbitrary code. This vulnerability can be exploited remotely without user interaction but requires high privileges. The CVSS 4.0 score rates it as medium severity. Public exploit code is available, but no known active exploitation has been reported. No patch or remediation details are provided in the source data.
CVE-2026-116062 is a SQL injection vulnerability in SourceCodester Performance Indicator System version 1.0. The flaw exists in the processing of the Contact argument in the /opils/staff/save_profile.php file, allowing remote attackers to inject SQL commands. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. Public exploit code is available, but no known active exploitation in the wild has been reported. No patch or official remediation has been documented yet.
CVE-2026-116061 is a SQL injection vulnerability in SourceCodester Performance Indicator System version 1.0. The flaw exists in the /opils/staff/edit_dealer.php file, where manipulation of the 'Contact' parameter allows remote attackers to inject SQL commands. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. Exploit code is publicly available, but there are no confirmed reports of active exploitation in the wild. No official patch or remediation guidance is currently provided.
HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length.
The request body is read with sysread() calls sized by the remaining Content-Length. Perl grows the read buffer to the requested length before any data arrives, so the server tries to allocate as much memory as the client declares.
A remote attacker can send one request with a large Content-Length and a few body bytes, and perl exits with an out-of-memory error before the application is called. HTTP::Server::PSGI runs as a single process, so the server stays down until restarted.
Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies.
The chunked body decoder keeps each chunk in memory until the whole chunk and its CRLF have arrived, and sets no limit on the length of a chunk-size line. A client that declares a huge chunk size and streams data, or sends a chunk-size line that never ends, grows the buffer for as long as it keeps sending.
A remote attacker can exhaust worker memory with a single connection.
Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections.
For a HEAD request Starman omits chunked framing but still writes the body returned by the application, on both the array and streaming response paths. Responses with a 1xx, 204 or 304 status also carry the body.
On a keep-alive or pipelined connection the client reads those bytes as the start of the next response. A front-end proxy that reuses upstream connections may then pair responses with the wrong requests.
Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies.
Starman decodes chunked request bodies before calling the application, matching each chunk-size line with `s/^(([0-9a-fA-F]+).*\015\012)//`. A line of hex digits followed by a bare LF and then CRLF never matches, because `.` does not match LF, and each failed attempt backtracks in time quadratic in the length of the hex run. Nothing limits the length of the line.
A remote attacker can exhaust worker CPU by sending such requests to any route.
Starman versions before 0.4019 for Perl allow a stalled request body to hold a worker indefinitely, as read_timeout covers only the headers.
Content-Length and chunked request bodies are read with blocking reads and no deadline. A client that sends complete headers and then stalls or trickles the body keeps the worker waiting until it disconnects.
A remote attacker can take every worker with a few such connections, five with the default worker count, so the server stops answering requests.
Version 0.4019 applies read_timeout to each wait for body data and adds a body_timeout limit, 300 seconds by default, on the total time to read a body.
SourceCodester Performance Indicator System version 1.0 contains a SQL injection vulnerability in the /opils/staff/adddealer.php file. The vulnerability arises from improper handling of the 'Contact' argument, allowing remote attackers to manipulate SQL queries. The vulnerability has a CVSS 4.0 base score of 6.9, indicating a medium severity. Exploit code has been publicly disclosed, but there are no confirmed reports of exploitation in the wild. No official patch or remediation guidance is currently available.
CVE-2026-116058 is a medium severity code injection vulnerability in Alfresco Activiti affecting version 7.21.0-rc.692. The flaw exists in the JuelScriptEngine.eval function, allowing remote attackers to perform code injection by manipulating input. The vendor was contacted but did not respond, and no patch or remediation information is currently available.
The w-mousekey npm package versions 1.0.41 and 1.0.42 contain malicious code that compromises any computer on which it is installed or running. This compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, secure device. Removal of the package alone does not guarantee elimination of all malicious software introduced by it.
A vulnerability has been found in KodCloud KodExplorer up to 4.55. Affected by this vulnerability is an unknown functionality of the file app/controller/editor.class.php of the component Online Editor Save Endpoint. Such manipulation of the argument path/filestr leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-116056 is a server-side request forgery (SSRF) vulnerability in KodCloud KodExplorer affecting versions 4.0 through 4.19. The flaw exists in the request_url_safe function within the Remote Download component, allowing remote attackers to manipulate server requests. The vendor has not responded to disclosure, and no patch or fix information is available. The vulnerability has a medium severity rating with a CVSS score of 5.3.
This report analyzes Hermes, an active malware-as-a-service platform operating in the Russian cybercrime market, along with its PyMapper distribution chain. The analysis is based on a detailed technical report authored by a researcher and publicly available. The platform facilitates malware distribution and service offerings typical of malware-as-a-service ecosystems. No specific software vulnerabilities or exploits are detailed in the provided information.
CVE-2026-116055 is a medium severity SQL injection vulnerability in SourceCodester Performance Indicator System version 1.0. It affects the /opils/admin/deleteproduct.php file, where manipulation of the ID argument allows remote attackers to perform SQL injection. Exploit code is publicly available, but no official patch or remediation guidance has been provided.