Loading story…
CERT Polska disclosed CVE-2026-16270, a denial-of-service vulnerability in Open Mercato caused by inefficient regular expression complexity (CWE-1333). The flaw affects all versions before 0.6.4 and allows a privileged user to add an unsafe regular expression rule to a field, which can then consume excessive resources and disrupt service availability.
The issue was reported responsibly by Pawel Scibiorski and coordinated through CERT Polska. Open Mercato addressed the vulnerability in version 0.6.4, making the update the primary remediation for organizations running affected deployments.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
The vulnerability was fixed in Open Mercato version 0.6.4 after coordinated disclosure. The flaw allowed a privileged user to introduce an unsafe regex rule into a field, leading to denial of service.
CERT Polska disclosed CVE-2026-16270, a denial-of-service vulnerability in Open Mercato caused by inefficient regular expression complexity. The issue affects all versions before 0.6.4 and was reported responsibly by Pawel Scibiorski.
MITRE published CWE-1333, documenting the weakness category 'Inefficient Regular Expression Complexity' that underlies regex-based denial-of-service issues.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A newly recorded vulnerability, **CVE-2026-32968**, affects the `com_mb24sysapi` module and allows **unauthenticated remote code execution** through an OS command injection flaw. The weakness is classified as **CWE-78** and stems from improper neutralization of special elements in OS commands, enabling a remote attacker to execute arbitrary commands and potentially take full control of an affected system. The CVE is described as a variant of `CVE-2020-10383`, carries a **CVSS v3.1** vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`, and is referenced by CERT VDE advisories **VDE-2026-024** and **VDE-2026-025**. A separate high-severity issue, **CVE-2026-29839**, was recorded for **DedeCMS v5.7.118** in the `/sys_task_add.php` component. The flaw is a **Cross-Site Request Forgery** vulnerability classified as **CWE-352**, and its updated **CVSS v3.1** vector is `AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`, indicating that successful exploitation could significantly affect confidentiality, integrity, and availability. The record includes references to a public gist and the DedeCMS website, highlighting another internet-exposed web application weakness with potentially serious impact.
Jun 29, 2026
Two high-severity vulnerabilities in **Dolibarr ERP/CRM** allow authenticated administrators to achieve remote code execution through separate application paths. `CVE-2026-22666` affects versions before **23.0.2** and stems from the `dol_eval_standard()` function, which can be abused through computed extrafields and other evaluation paths because forbidden string checks are not properly enforced in whitelist mode and PHP dynamic callable syntax is not detected. The flaw enables arbitrary command execution via `eval()` and is classified as **CWE-95**. A second issue, `CVE-2026-23500`, affects versions before **23.0.0** and exposes an OS command injection bug in the ODT-to-PDF conversion workflow in `odf.php`. The `MAIN_ODT_AS_PDF` configuration constant is concatenated into a shell command passed to `exec()` without sanitization, allowing an authenticated administrator to inject shell separators and run arbitrary commands as the web server user when generating an ODT template. The vulnerabilities were addressed in **Dolibarr 23.0.0** and **23.0.2**, underscoring the need for organizations running Dolibarr to upgrade promptly.
Jun 29, 2026
CERT Polska disclosed **CVE-2026-85520**, an external control of file name or path vulnerability in MyPresta Google Merchant Center Feed software. The flaw could permit unsafe handling of attacker-influenced file names or paths, creating a potential path-traversal risk. The available disclosure does not identify affected versions, a CVSS severity score, exploitation in the wild, technical proof-of-concept details, or a vendor-provided remediation. Organizations using the MyPresta module should identify deployed instances, monitor CERT Polska and the vendor for patch guidance, and restrict access to administrative and file-handling functionality pending further details.
Sep 29, 2026