CVE-2026-116063 is a code injection vulnerability in DedeCMS version 5.7.118. The flaw exists in the require_once function within the dede/update_guide.php file, where manipulation of the 'vtime' argument allows injection of arbitrary code. This vulnerability can be exploited remotely without user interaction but requires high privileges. The CVSS 4.0 score rates it as medium severity. Public exploit code is available, but no known active exploitation has been reported. No patch or remediation details are provided in the source data.
CVE-2026-116062 is a SQL injection vulnerability in SourceCodester Performance Indicator System version 1.0. The flaw exists in the processing of the Contact argument in the /opils/staff/save_profile.php file, allowing remote attackers to inject SQL commands. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. Public exploit code is available, but no known active exploitation in the wild has been reported. No patch or official remediation has been documented yet.
CVE-2026-116061 is a SQL injection vulnerability in SourceCodester Performance Indicator System version 1.0. The flaw exists in the /opils/staff/edit_dealer.php file, where manipulation of the 'Contact' parameter allows remote attackers to inject SQL commands. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. Exploit code is publicly available, but there are no confirmed reports of active exploitation in the wild. No official patch or remediation guidance is currently provided.
HTTP::Server::PSGI versions before 1.0056 for Perl contain a vulnerability where a remote attacker can crash the server by sending a request with a large Content-Length header. The server attempts to allocate memory based on the declared Content-Length before reading the body, leading to an out-of-memory error and server crash. Since HTTP::Server::PSGI runs as a single process, the server remains down until manually restarted.
CVE-2026-115824 affects Starman versions before 0.4019 for Perl and allows a remote attacker to exhaust worker memory by sending specially crafted chunked HTTP request bodies. The vulnerability arises because the chunked body decoder buffers each chunk in memory without limiting the length of the chunk-size line, enabling unbounded memory consumption.
Starman versions before 0.4019 for Perl improperly handle HTTP HEAD requests by sending response bodies, causing desynchronization of responses on keep-alive connections. This leads to clients potentially reading response bytes as part of subsequent responses, which can cause front-end proxies to mismatch responses with requests.
CVE-2026-115822 is a vulnerability in Starman for Perl versions before 0.4019 that allows remote attackers to cause CPU exhaustion via inefficient regular expression processing. The issue arises from quadratic regex backtracking when parsing chunked request bodies, specifically due to a regex that fails to match certain malformed chunk-size lines, leading to excessive CPU usage. This can be triggered by sending crafted requests to any route handled by the server.
Starman versions before 0.4019 for Perl have a vulnerability where stalled request bodies can indefinitely occupy worker processes because read_timeout only applies to headers, not the body. This allows a remote attacker to exhaust all available workers by sending incomplete or slow request bodies, causing denial of service. Version 0.4019 introduces read_timeout for body reads and a body_timeout limit of 300 seconds to mitigate this issue.
SourceCodester Performance Indicator System version 1.0 contains a SQL injection vulnerability in the /opils/staff/adddealer.php file. The vulnerability arises from improper handling of the 'Contact' argument, allowing remote attackers to manipulate SQL queries. The vulnerability has a CVSS 4.0 base score of 6.9, indicating a medium severity. Exploit code has been publicly disclosed, but there are no confirmed reports of exploitation in the wild. No official patch or remediation guidance is currently available.
CVE-2026-116058 is a medium severity code injection vulnerability in Alfresco Activiti affecting version 7.21.0-rc.692. The flaw exists in the JuelScriptEngine.eval function, allowing remote attackers to perform code injection by manipulating input. The vendor was contacted but did not respond, and no patch or remediation information is currently available.
CVE-2026-116057 is a medium severity vulnerability in KodCloud KodExplorer up to version 4.19. It involves an unrestricted file upload issue in the Online Editor Save Endpoint component, specifically in the file app/controller/editor.class.php. This vulnerability allows remote attackers to upload files without proper restrictions by manipulating the path/filestr argument. The exploit has been publicly disclosed, but the vendor has not responded or provided a fix.
CVE-2026-116056 is a server-side request forgery (SSRF) vulnerability in KodCloud KodExplorer affecting versions 4.0 through 4.19. The flaw exists in the request_url_safe function within the Remote Download component, allowing remote attackers to manipulate server requests. The vendor has not responded to disclosure, and no patch or fix information is available. The vulnerability has a medium severity rating with a CVSS score of 5.3.
This report analyzes Hermes, an active malware-as-a-service platform operating in the Russian cybercrime market, along with its PyMapper distribution chain. The analysis is based on a detailed technical report authored by a researcher and publicly available. The platform facilitates malware distribution and service offerings typical of malware-as-a-service ecosystems. No specific software vulnerabilities or exploits are detailed in the provided information.
CVE-2026-116055 is a medium severity SQL injection vulnerability in SourceCodester Performance Indicator System version 1.0. It affects the /opils/admin/deleteproduct.php file, where manipulation of the ID argument allows remote attackers to perform SQL injection. Exploit code is publicly available, but no official patch or remediation guidance has been provided.
CVE-2026-116054 is a vulnerability in the SH3 product affecting an unspecified function within the Módulo de Gestão/Módulo de Arrecadação component. The issue involves password hashing that uses insufficient computational effort, which could weaken password security. The vulnerability can be exploited remotely but requires a high degree of complexity and is considered difficult to exploit. A publicly disclosed exploit exists. Upgrading to version 2026.0.2.0 mitigates the vulnerability.
CVE-2026-116053 is an OS command injection vulnerability in the dbcli mycli tool affecting versions 2.29.0 through 2.30.1. The flaw exists in the function source_special_command_is_safe within the source.py file of the Whitelist component. An attacker with local access can exploit this weakness to execute arbitrary OS commands. Public exploit code is available, but no vendor response or patch has been provided. The vulnerability has a medium severity rating with a CVSS score of 4.8.
OpenRemote core versions before 1.31.0 have an authorization bypass vulnerability where inbound edge gateway events do not undergo proper realm or gateway-descendant authorization. This allows an attacker controlling a registered gateway to manipulate event asset IDs to overwrite or delete assets across different realms, breaking tenant isolation.
OpenRemote core versions before 1.31.0 have an authorization bypass vulnerability that allows authenticated users to access gateway tunnel information from other realms. This can expose internal target hosts, ports, and routing data by exploiting the getGatewayActiveTunnelInfos endpoint with manipulated parameters.
OpenRemote core versions before 1.31.0 have an authorization bypass vulnerability that allows realm administrators to impersonate gateways in other realms. This occurs because the GatewayService only verifies the gateway ID without validating the associated realm. Attackers with WRITE:ADMIN privileges in one realm can create a service user named after another realm's gateway ID, enabling them to overwrite assets and establish SSH tunnels into the target realm's local network. The vulnerability has a low CVSS 4.0 base score of 2.1 and does not have known exploits in the wild.
Snipe-IT versions before 8.5.0 have a SAML assertion replay vulnerability that allows attackers to reuse captured assertions due to a non-atomic nonce check in the SAML ACS handler. This flaw enables attackers to send concurrent POST requests with a single captured assertion to create multiple authenticated sessions, bypassing identity provider revocation mechanisms.