CVE-2026-107426 is a missing authorization vulnerability in VideoWhisper.com Paid Videochat Turnkey Site (ppv-live-webcams) that affects versions from 0 up to 7.5.12. The flaw involves incorrectly configured access control security levels, allowing unauthorized access. The vulnerability has a CVSS 3.1 score of 7.3, indicating high severity with network attack vector, no privileges required, no user interaction, and impacts confidentiality, integrity, and availability. No patch or remediation information is provided in the source data.
Microsoft uncovered a Chinese-language cybercriminal ecosystem involving phishing kit developers, an illicit marketplace called YAM Store, and downstream threat actors. This ecosystem enables large-scale phishing campaigns targeting organizations worldwide, including in Japan, the US, Australia, and India. The phishing kits impersonate legitimate brands and facilitate credential theft. YAM Store sells fraudulently acquired Microsoft and Google cloud environments to support these operations. Microsoft and partners disrupted the primary developers and infrastructure behind this ecosystem.
Microsoft and Health-ISAC disrupted a Chinese-language phishing marketplace comprising YAM Store, CoGUI, and Iron Man, which sent over one billion malicious messages since January 2026. These services supplied stolen accounts, phishing kits, and infrastructure to criminals worldwide, targeting consumers and more than 75,000 organizations in over 150 countries. The phishing kits allowed real-time credential harvesting with interactive platforms and included thousands of templates tailored to many countries. The disruption was enabled by a US federal court order and involved multiple cybersecurity and law enforcement partners. Microsoft disabled over 20,000 accounts and blocked more than 100,000 domains related to this operation. The phishing infrastructure depended on vendor licensing servers, making it vulnerable to takedown efforts.
CISA has issued an urgent warning to patch a critical authentication bypass vulnerability (CVE-2026-104935) in Ivanti Connect Secure (ICS) appliances. This flaw has been actively exploited in zero-day attacks since at least October 1, 2026, allowing unauthenticated remote attackers to execute arbitrary commands. Ivanti has released multiple patched versions addressing this issue and urges immediate updates. The vulnerability has been used in complex exploit chains leading to root-level code execution and credential theft. CISA mandates federal agencies to patch and recommends all organizations to check for compromise and remediate accordingly.
CVE-2026-109968 is a vulnerability in Red Hat Enterprise Linux 10 where the clevis-pkcs11-afunix-socket-unlock daemon logs LUKS disk encryption passphrases in plaintext to a log file. The log file is created with permissions that make it world-readable under the default process umask. This allows a local attacker to read the log file and obtain the LUKS passphrase, potentially compromising disk encryption.
CVE-2026-16740 is a critical vulnerability in TR7 Cyber Defense Inc.'s TR7 ASP product on both virtual and physical appliances. It involves missing authentication for a critical function, which allows an attacker to perform OS command injection. The affected versions are from 1.0.40.236 up to but not including 1.0.1554.2331, and from 1.6.42.239 up to but not including 1.6.1554.2331. The vulnerability has a CVSS 3.1 score of 9.8, indicating a high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. No patch or remediation information is provided in the input data.
CVE-2026-16741 is a critical OS command injection vulnerability in TR7 Cyber Defense Inc.'s TR7 ASP product on both virtual and physical appliances. It affects versions from 1.0.40.236 up to but not including 1.0.1554.2331, and from 1.6.42.239 up to but not including 1.6.1554.2331. The vulnerability allows an attacker to execute arbitrary operating system commands due to improper neutralization of special elements in OS commands.
Bisheng, an open-source LLM application DevOps platform, contains three vulnerabilities: a legacy SSO endpoint that allows unauthenticated account takeover and administrative access; an IDOR vulnerability exposing cross-user workflow data to authenticated users; and a missing access control in the assistant service enabling credential abuse and data disclosure prior to version 2.5.0. Two of these vulnerabilities have been patched in versions 2.5.0 and 3.0.0 respectively, while the legacy SSO bypass remains unpatched. Manual mitigations are recommended until an official fix is available.
CVE-2026-82026 is a high-severity vulnerability in skyhook-io's Radar product before version 1.12.2. It involves a missing authorization check in the handleLocalTerminal WebSocket endpoint (/api/local-terminal), allowing attackers to spawn a privileged shell. This flaw permits execution of /bin/bash -l on the Radar host with injected kubeconfig and process credentials, enabling remote code execution with Radar's privileges, even if the --disable-local-terminal flag is set.
CVE-2026-108291 is a critical deserialization of untrusted data vulnerability in itthinx Affiliates plugin versions before 7.1.0. This flaw allows object injection, potentially leading to full compromise of confidentiality, integrity, and availability. The vulnerability affects all versions from initial releases up to 7.0.1. No patch information is provided in the source data.
CVE-2026-107425 is a missing authorization vulnerability in Magepeople inc.'s Bus Ticket Booking with Seat Reservation software. It affects versions from the initial release up to 5.9.7. The flaw allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized actions that impact integrity and availability. The vulnerability has a CVSS score of 6.5, indicating a medium severity level.
CVE-2026-107867 is a reflected cross-site scripting (XSS) vulnerability in Crocoblock JetProductTables plugin versions up to 1.2.4. This flaw allows improper neutralization of input during web page generation, potentially enabling attackers to execute arbitrary scripts in the context of the affected web application. The vulnerability has a high severity rating with a CVSS score of 7.1.
CVE-2026-107421 is a session fixation vulnerability in VideoWhisper.com Broadcast Live Video software versions prior to 7.3.3. This flaw allows an attacker to hijack user sessions, potentially leading to unauthorized access. The vulnerability affects versions from initial releases up to 7.3.2. It has a CVSS 3.1 score of 7.3, indicating high severity with network attack vector and no required privileges or user interaction.
CVE-2026-107424 is a critical Incorrect Privilege Assignment vulnerability in the M A Vinoth Kumar Frontend Dashboard that allows privilege escalation. It affects versions from initial releases up to 3.0.7. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.
CVE-2026-107422 is a stored cross-site scripting (XSS) vulnerability in the WP w3all phpBB integration plugin for WordPress. It affects versions from initial release up to 3.1.1. The vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers with low privileges to inject malicious scripts that execute in the context of other users. The CVSS 3.1 base score is 6.5, indicating a medium severity level.
CVE-2026-105874 is a high-severity reflected cross-site scripting (XSS) vulnerability in Brainstorm Force SureCart versions prior to 4.9.4. It allows improper neutralization of input during web page generation, potentially enabling attackers to execute arbitrary scripts in the context of the affected web application.
CVE-2026-106599 is a high-severity vulnerability in Brainstorm Force SureCart affecting versions from initial release up to 4.9.3. It involves deserialization of untrusted data, allowing object injection. This can lead to complete compromise of confidentiality, integrity, and availability of the affected system. No specific patch or remediation details are provided in the available data.
CVE-2026-97278 is a deserialization of untrusted data vulnerability in the WP SYNTEX Polylang plugin. It allows object injection, affecting Polylang versions from the initial release up to 3.8.9. The vulnerability has a high severity with a CVSS score of 7.2. No patch or remediation information is provided in the available data.
CVE-2026-107433 is a missing authorization vulnerability in the miniOrange WP OAuth Server plugin for WordPress. It affects versions from initial release up to 6.4.0. The flaw allows exploitation of incorrectly configured access control security levels, potentially leading to limited integrity and availability impacts. The vulnerability has a CVSS 3.1 base score of 6.5 (medium severity). No official patch or remediation information is provided in the available data.
Hirudo is a newly identified Android malware that targets banking applications by replacing legitimate apps with modified versions that disable security checks. This enables the malware to steal bank account credentials from infected devices. The malware specifically focuses on evading security mechanisms by altering the banking apps themselves.
