YARA-X version 1.22.0 was released on October 25, 2026, introducing 11 improvements and 9 bug fixes. Among the enhancements is the addition of built-in functions to read 64-bit integers in various formats. There is no indication of security vulnerabilities or threats associated with this release.
CVE-2026-115627 is an incorrect authorization vulnerability in the ash-project's ash_postgres library affecting versions from 0.38.0 up to but not including 2.15.2. The flaw allows a user to access destination records linked to a source record through another tenant's join rows due to improper enforcement of attribute multitenancy during lateral join queries. This results in unauthorized data exposure across tenants. The issue is fixed in version 2.15.2.
CVE-2026-115635 is an incorrect authorization vulnerability in ash-project's ash_postgres component. It allows a user to read another tenant's record due to a skipped upsert operation that does not enforce multitenancy attribute checks. This affects versions from 2.6.22 up to but not including 2.15.2. The issue is fixed in version 2.15.2.
CVE-2026-114214 is an incorrect authorization vulnerability in the ash-project ash framework affecting versions from 3.24.0 up to but not including 3.37.1. The flaw allows a client to read destination records unrelated to the source record when querying certain has_many or has_one through relationships with a limit of 1. This occurs because the code path reads destination records without properly filtering them by the source, potentially exposing records that should be inaccessible through that relationship. The issue is fixed in version 3.37.1.
CVE-2026-116063 is a code injection vulnerability in DedeCMS version 5.7.118. The flaw exists in the require_once function within the dede/update_guide.php file, where manipulation of the 'vtime' argument allows injection of arbitrary code. This vulnerability can be exploited remotely without user interaction but requires high privileges. The CVSS 4.0 score rates it as medium severity. Public exploit code is available, but no known active exploitation has been reported. No patch or remediation details are provided in the source data.
CVE-2026-116062 is a SQL injection vulnerability in SourceCodester Performance Indicator System version 1.0. The flaw exists in the processing of the Contact argument in the /opils/staff/save_profile.php file, allowing remote attackers to inject SQL commands. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. Public exploit code is available, but no known active exploitation in the wild has been reported. No patch or official remediation has been documented yet.
CVE-2026-116061 is a SQL injection vulnerability in SourceCodester Performance Indicator System version 1.0. The flaw exists in the /opils/staff/edit_dealer.php file, where manipulation of the 'Contact' parameter allows remote attackers to inject SQL commands. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. Exploit code is publicly available, but there are no confirmed reports of active exploitation in the wild. No official patch or remediation guidance is currently provided.
HTTP::Server::PSGI versions before 1.0056 for Perl contain a vulnerability where a remote attacker can crash the server by sending a request with a large Content-Length header. The server attempts to allocate memory based on the declared Content-Length before reading the body, leading to an out-of-memory error and server crash. Since HTTP::Server::PSGI runs as a single process, the server remains down until manually restarted.
CVE-2026-115824 affects Starman versions before 0.4019 for Perl and allows a remote attacker to exhaust worker memory by sending specially crafted chunked HTTP request bodies. The vulnerability arises because the chunked body decoder buffers each chunk in memory without limiting the length of the chunk-size line, enabling unbounded memory consumption.
Starman versions before 0.4019 for Perl improperly handle HTTP HEAD requests by sending response bodies, causing desynchronization of responses on keep-alive connections. This leads to clients potentially reading response bytes as part of subsequent responses, which can cause front-end proxies to mismatch responses with requests.
CVE-2026-115822 is a vulnerability in Starman for Perl versions before 0.4019 that allows remote attackers to cause CPU exhaustion via inefficient regular expression processing. The issue arises from quadratic regex backtracking when parsing chunked request bodies, specifically due to a regex that fails to match certain malformed chunk-size lines, leading to excessive CPU usage. This can be triggered by sending crafted requests to any route handled by the server.
Starman versions before 0.4019 for Perl have a vulnerability where stalled request bodies can indefinitely occupy worker processes because read_timeout only applies to headers, not the body. This allows a remote attacker to exhaust all available workers by sending incomplete or slow request bodies, causing denial of service. Version 0.4019 introduces read_timeout for body reads and a body_timeout limit of 300 seconds to mitigate this issue.
SourceCodester Performance Indicator System version 1.0 contains a SQL injection vulnerability in the /opils/staff/adddealer.php file. The vulnerability arises from improper handling of the 'Contact' argument, allowing remote attackers to manipulate SQL queries. The vulnerability has a CVSS 4.0 base score of 6.9, indicating a medium severity. Exploit code has been publicly disclosed, but there are no confirmed reports of exploitation in the wild. No official patch or remediation guidance is currently available.
CVE-2026-116058 is a medium severity code injection vulnerability in Alfresco Activiti affecting version 7.21.0-rc.692. The flaw exists in the JuelScriptEngine.eval function, allowing remote attackers to perform code injection by manipulating input. The vendor was contacted but did not respond, and no patch or remediation information is currently available.
CVE-2026-116057 is a medium severity vulnerability in KodCloud KodExplorer up to version 4.19. It involves an unrestricted file upload issue in the Online Editor Save Endpoint component, specifically in the file app/controller/editor.class.php. This vulnerability allows remote attackers to upload files without proper restrictions by manipulating the path/filestr argument. The exploit has been publicly disclosed, but the vendor has not responded or provided a fix.
CVE-2026-116056 is a server-side request forgery (SSRF) vulnerability in KodCloud KodExplorer affecting versions 4.0 through 4.19. The flaw exists in the request_url_safe function within the Remote Download component, allowing remote attackers to manipulate server requests. The vendor has not responded to disclosure, and no patch or fix information is available. The vulnerability has a medium severity rating with a CVSS score of 5.3.
This report analyzes Hermes, an active malware-as-a-service platform operating in the Russian cybercrime market, along with its PyMapper distribution chain. The analysis is based on a detailed technical report authored by a researcher and publicly available. The platform facilitates malware distribution and service offerings typical of malware-as-a-service ecosystems. No specific software vulnerabilities or exploits are detailed in the provided information.
CVE-2026-116055 is a medium severity SQL injection vulnerability in SourceCodester Performance Indicator System version 1.0. It affects the /opils/admin/deleteproduct.php file, where manipulation of the ID argument allows remote attackers to perform SQL injection. Exploit code is publicly available, but no official patch or remediation guidance has been provided.
CVE-2026-116054 is a vulnerability in the SH3 product affecting an unspecified function within the Módulo de Gestão/Módulo de Arrecadação component. The issue involves password hashing that uses insufficient computational effort, which could weaken password security. The vulnerability can be exploited remotely but requires a high degree of complexity and is considered difficult to exploit. A publicly disclosed exploit exists. Upgrading to version 2026.0.2.0 mitigates the vulnerability.
CVE-2026-116053 is an OS command injection vulnerability in the dbcli mycli tool affecting versions 2.29.0 through 2.30.1. The flaw exists in the function source_special_command_is_safe within the source.py file of the Whitelist component. An attacker with local access can exploit this weakness to execute arbitrary OS commands. Public exploit code is available, but no vendor response or patch has been provided. The vulnerability has a medium severity rating with a CVSS score of 4.8.