Threats affecting pkg:bitnami/varnish

A vulnerability was found in Alfresco Activiti up to 7.21.0-rc.692. Affected by this issue is the function JuelScriptEngine.eval of the file JuelScriptEngine.java. Performing a manipulation results in code injection. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.

The w-mousekey npm package versions 1.0.41 and 1.0.42 contain malicious code that compromises any computer on which it is installed or running. This compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, secure device. Removal of the package alone does not guarantee elimination of all malicious software introduced by it.

A vulnerability has been found in KodCloud KodExplorer up to 4.55. Affected by this vulnerability is an unknown functionality of the file app/controller/editor.class.php of the component Online Editor Save Endpoint. Such manipulation of the argument path/filestr leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

A flaw has been found in KodCloud KodExplorer up to 4.56. Affected is the function request_url_safe of the file app/function/web.function.php of the component Remote Download. This manipulation causes server-side request forgery. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.

This report analyzes Hermes, an active malware-as-a-service platform operating in the Russian cybercrime market, along with its PyMapper distribution chain. The analysis is based on a detailed technical report authored by a researcher and publicly available. The platform facilitates malware distribution and service offerings typical of malware-as-a-service ecosystems. No specific software vulnerabilities or exploits are detailed in the provided information.

CVE-2026-116055 is a medium severity SQL injection vulnerability in SourceCodester Performance Indicator System version 1.0. It affects the /opils/admin/deleteproduct.php file, where manipulation of the ID argument allows remote attackers to perform SQL injection. Exploit code is publicly available, but no official patch or remediation guidance has been provided.

CVE-2026-116054 is a vulnerability in the SH3 product affecting an unspecified function within the Módulo de Gestão/Módulo de Arrecadação component. The issue involves password hashing that uses insufficient computational effort, which could weaken password security. The vulnerability can be exploited remotely but requires a high degree of complexity and is considered difficult to exploit. A publicly disclosed exploit exists. Upgrading to version 2026.0.2.0 mitigates the vulnerability.

CVE-2026-116053 is an OS command injection vulnerability in the dbcli mycli tool affecting versions 2.29.0 through 2.30.1. The flaw exists in the function source_special_command_is_safe within the source.py file of the Whitelist component. An attacker with local access can exploit this weakness to execute arbitrary OS commands. Public exploit code is available, but no vendor response or patch has been provided. The vulnerability has a medium severity rating with a CVSS score of 4.8.

OpenRemote core versions before 1.31.0 have an authorization bypass vulnerability where inbound edge gateway events do not undergo proper realm or gateway-descendant authorization. This allows an attacker controlling a registered gateway to manipulate event asset IDs to overwrite or delete assets across different realms, breaking tenant isolation.

OpenRemote core versions before 1.31.0 have an authorization bypass vulnerability that allows authenticated users to access gateway tunnel information from other realms. This can expose internal target hosts, ports, and routing data by exploiting the getGatewayActiveTunnelInfos endpoint with manipulated parameters.

OpenRemote core versions before 1.31.0 have an authorization bypass vulnerability that allows realm administrators to impersonate gateways in other realms. This occurs because the GatewayService only verifies the gateway ID without validating the associated realm. Attackers with WRITE:ADMIN privileges in one realm can create a service user named after another realm's gateway ID, enabling them to overwrite assets and establish SSH tunnels into the target realm's local network. The vulnerability has a low CVSS 4.0 base score of 2.1 and does not have known exploits in the wild.

YesWiki versions 4.5.0 through 4.6.x contain an SQL injection vulnerability in the PageManager::save() function. This flaw arises because the date_maj_fiche field is concatenated directly into an SQL INSERT statement without proper escaping. Unauthenticated attackers on default installations can exploit this to perform sub-SELECT queries against the wiki_users table, potentially exfiltrating password hashes. The vulnerability is fixed in version 4.7.0.

YesWiki versions from 4.6.2 up to but not including 4.7.0 have a missing authorization vulnerability in the ActivityPubService::syncActorPosts function. This flaw allows malicious ActivityPub servers to manipulate mirrored entries of other actors by serving a poisoned outbox during admin-initiated synchronization. The vulnerability can lead to unauthorized deletion, overwriting, forging, or mass deletion of entries.

YesWiki versions 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 have an unauthenticated SQL injection vulnerability in the SearchManager::prepareSearchRequest() function. The vulnerability arises because field names from the query and searchfields parameters in the public Bazar entries search API are improperly sanitized, allowing injection of SQL subqueries. This can lead to unauthorized data access such as reading user password hashes or causing denial of service by exhausting database threads.

YesWiki versions from 4.2.0 up to but not including 4.7.0 contain a stored cross-site scripting (XSS) vulnerability. Authenticated users can inject malicious scripts into comment bodies using the wakka raw-HTML syntax. These scripts execute in the browsers of administrators and visitors when comments are rendered via the /api/comments endpoint. The vulnerability is fixed in version 4.7.0.

YesWiki versions prior to 4.7.0 have an unauthenticated server-side request forgery (SSRF) vulnerability. This flaw allows remote attackers to supply specially crafted wiki syntax in the content parameter of the page render handler to fetch arbitrary URLs, including internal hosts and ports, and read their responses. The vulnerability is fixed in version 4.7.0.

YesWiki versions prior to 4.7.0 have a cross-site request forgery (CSRF) vulnerability in the despam action that allows unauthenticated attackers to delete or restore pages by exploiting an administrator's session. Attackers can embed an auto-submitting HTML form on a wiki page that triggers destructive actions when viewed by an administrator. This vulnerability was fixed in version 4.7.0.