CVE-2026-108829 is a medium severity SQL injection vulnerability in Zen Cart affecting versions 2.2.0, 2.2.1, and 2.2.2. The flaw exists in the admin/modules.php file within the Module Configuration component, where manipulation of the configuration argument allows remote SQL injection. A patch identified by commit 08f572654edee1db8f9db091c9949825c6c69339 is available to address this issue.
Oleg Korniev, a dual Ukrainian-Russian citizen, pleaded guilty in a US court for leading YMCO, a large international money mule network that laundered stolen funds from US companies. YMCO recruited over 15,000 US residents as money mules to transfer stolen money abroad, primarily to Eastern Europe, laundering at least $7 million and causing over $14.7 million in losses. Korniev admitted to managing the organization, creating policies, and securing illegal services. He faces significant prison time and restitution obligations. Other YMCO members have also been arrested and sentenced. This case highlights the scale and sophistication of cybercrime laundering networks but does not describe a software vulnerability or exploit.
CVE-2026-105283 is a vulnerability in ash-project's ash_typescript component that allows unauthenticated attackers to obtain sensitive internal Elixir terms from RPC error responses. This occurs because certain error cases are rendered without redaction, exposing internal data in client-facing error messages. The issue affects versions from 0.1.0 up to but not including 0.19.1.
CVE-2026-108828 is a SQL injection vulnerability in Zen Cart version 2.2.2 affecting the eval function in admin/configuration.php within the Admin Panel component. The vulnerability arises from manipulation of the gID argument. Exploitation requires high complexity and is considered difficult. The vendor notes that the related functions set_function and use_function are not editable through the normal admin UI, limiting attack vectors. The CVSS 4.0 score is low (2.1).
iRhythm experienced a data breach impacting at least 360,000 individuals. Hackers accessed and exfiltrated patient personal information including names, addresses, email addresses, dates of birth, phone numbers, and certain account and device data. The breach was identified on June 8, 2026, involving third-party-hosted business applications. The attackers threatened to leak the stolen data unless a ransom was paid. iRhythm reported no evidence of identity theft or impact to its products or operations and stated the incident is unlikely to materially affect its financial condition.
CVE-2026-85499 is an improper authorization vulnerability in Apache SkyWalking BanyanDB versions 0.11.0 up to but not including 0.11.1. Under a non-default configuration involving a readonly Canopy user and a reachable monitoring target, this user can send non-read requests through the monitoring proxy, bypassing intended access controls. The issue is fixed in version 0.11.1.
CVE-2026-108827 is a low-severity code injection vulnerability in Zen Cart versions 2.2.0, 2.2.1, and 2.2.2. It affects the zen_call_function in admin/includes/functions/general.php, where manipulation of the use_function argument could lead to code injection. However, exploitation is complex and requires prior control over the configuration table via SQL Patch tool or an existing SQL injection vulnerability. The vendor does not consider this independently exploitable. No patch information is provided.
CVE-2026-105412 is an SQL Injection vulnerability in Dassault Systèmes Tuleap Enterprise Edition versions 17.5-1 through 17.5-35. This flaw could allow an attacker with limited privileges to read the Tuleap database. The vulnerability has a high severity rating with a CVSS score of 7.1. No official patch or remediation details are provided in the available data.
CVE-2026-105411 is a high-severity authorization bypass vulnerability in Dassault Systèmes Tuleap Enterprise Edition versions 17.0-1 through 17.0-41 and 17.5-1 through 17.5-32. It allows an attacker with tracker administration rights on one tracker to update or delete fields of all trackers on the instance without proper authorization.
CVE-2026-108826 is a medium severity SQL injection vulnerability in Zen Cart versions 2.2.0, 2.2.1, and 2.2.2. It affects the function zen_db_perform in the PayPal IPN Handler component, specifically in includes/modules/payment/paypaldp.php. The vulnerability allows remote attackers to manipulate the txn_id argument to perform SQL injection. A patch identified by commit 557154f4fa025f51553094f47b06aa024220c48f is available to address this issue.
CVE-2026-105410 is a stored Cross-site Scripting (XSS) vulnerability in Dassault Systèmes Tuleap Enterprise Edition versions 17.0-1 through 17.0-41 and 17.5-1 through 17.5-32. This flaw allows an attacker to inject and execute arbitrary script code in the browser session of users. The vulnerability is classified as high severity with a CVSS score of 8.7, indicating significant impact on confidentiality and integrity. No information about available patches or vendor advisories is provided.
CVE-2026-105409 is a stored Cross-site Scripting (XSS) vulnerability in Dassault Systèmes Tuleap Enterprise Edition versions 17.0-1 through 17.0-41 and 17.5-1 through 17.5-32. This vulnerability allows an attacker to inject and execute arbitrary script code within the browser session of a user. The vulnerability is classified as CWE-79, indicating improper neutralization of input during web page generation. It has a high severity with a CVSS score of 8.7, reflecting its potential impact on confidentiality and integrity. No information about available patches or vendor advisories is provided. No known exploits in the wild have been reported.
CVE-2026-105408 is a stored Cross-site Scripting (XSS) vulnerability in Dassault Systèmes Tuleap Enterprise Edition versions from 17.0-1 through 17.0-41 and 17.5-1 through 17.5-32. This vulnerability allows an attacker to inject and execute arbitrary script code in the browser session of a user. It has a high severity rating with a CVSS score of 8.7, indicating significant impact on confidentiality and integrity if exploited.
CVE-2026-105407 is an OS Command Injection vulnerability in Dassault Systèmes Tuleap Enterprise Edition versions 17.0-1 through 17.0-40 and 17.5-1 through 17.5-31. This flaw allows an attacker with limited privileges to execute arbitrary commands on the affected server without user interaction. The vulnerability has a high severity with a CVSS score of 8.8, indicating significant potential impact on confidentiality, integrity, and availability.
CVE-2026-103903 is an incorrect authorization vulnerability in MikroTik RouterOS affecting versions 7.0.0 up to but not including 7.24.5. It allows a remote authenticated attacker with low-privilege credentials to escalate privileges by exploiting the WinBox authentication flow. The attacker can impersonate a higher-privilege account, such as admin, without knowing that account's password, gaining full administrative access and the ability to elevate their own privileges.
Edward Dubrovsky, a Canadian cybersecurity executive specializing in ransomware response, was arrested in the United States on suspicion of involvement with the ShinyHunters hacking group. The group recently targeted FBI systems, including the FBI jobs website, allegedly obtaining sensitive information. The FBI attributes the breach to a contractor's failure to patch vulnerable Oracle PeopleSoft software. This arrest is part of an ongoing FBI effort to dismantle the ShinyHunters network, with other key suspects arrested in the Netherlands and Jordan. Dubrovsky faces charges related to conspiracy to extort and interference with commerce by threats. The ShinyHunters group had claimed responsibility for the FBI hack and appeared defiant before their Tor-based site became inaccessible.
CVE-2026-108825 is a medium severity vulnerability in yangzongzhuan RuoYi versions 4.8.0 through 4.8.3. It involves improper privilege management in the checkRoleAllowed function within the /system/role/authDataScope file. The vulnerability allows remote attackers to manipulate the roleKey argument to escalate privileges. Public exploit code has been disclosed, but no vendor response or patch is currently available.
CVE-2026-103902 is a high-severity vulnerability in DigiDoc's libdigidocpp and related DigiDoc applications for Android and iOS. It involves improper verification of cryptographic signatures, allowing attackers to forge digital signatures that affected DigiDoc software incorrectly validates as legitimate. This flaw affects multiple versions of libdigidocpp, DigiDoc4, DigiDoc Android, and DigiDoc iOS.
CVE-2026-108824 is a medium severity SQL injection vulnerability in DataEase up to version 3.0.0. The flaw exists in the Utils.buildCalcField function within the file io/dataease/engine/utils/Utils.java. This vulnerability allows remote attackers to manipulate a calculated field argument to execute SQL injection attacks. An exploit has been published, and a patch is recommended to remediate the issue.
CVE-2026-108822 is a buffer overflow vulnerability in Kamailio versions 6.0.0 through 6.0.7 and 6.1.0 through 6.1.3. It occurs in the isup_get_calling_party function within the sipt module's ss7_parser.c file due to improper handling of an argument length. This vulnerability can be exploited remotely. Upgrading to Kamailio versions 6.0.8 or 6.1.4 resolves the issue.