CVE-2026-110810 is a low-severity vulnerability in ggml-org whisper.cpp up to version 1.9.4. It involves an out-of-bounds read in the whisper_model_load function triggered by manipulating the argument ttype. The vulnerability requires local access and low privileges to exploit. A public exploit exists. Upgrading to version 1.9.5 mitigates the issue.
ELADMIN version 2.7 and earlier has an improper access control vulnerability in the user-management endpoint PUT /api/users/resetPwd. This endpoint lacks proper authorization checks, allowing any authenticated user to reset passwords of arbitrary users, including the built-in administrator account. The vulnerability arises because the method does not enforce role-level or ownership validation.
XXL-JOB versions 3.5.0-SNAPSHOT and earlier have a Cross-Site Request Forgery (CSRF) vulnerability in the user management controller. The affected endpoints /user/insert, /user/update, and /user/delete lack CSRF protection and do not restrict HTTP methods, allowing unauthorized actions via CSRF attacks.
Trisolutions BRPerfX version 1.4.4.0 contains a vulnerability where LDAP credentials are exposed in plaintext within the administrative configuration interface. An authenticated administrator can view these credentials by inspecting client-side code. This exposure can lead to credential compromise without requiring privilege escalation or user interaction.
ELADMIN version 2.7 and earlier contains a Cross Site Scripting (XSS) vulnerability in the WebSocketServer, SpringSecurityConfig, and deploy.vue components. This vulnerability allows an attacker to execute malicious scripts in the context of the affected application. The vulnerability has a medium severity with a CVSS score of 6.1.
XXL-JOB <=3.5.0-SNAPSHOT contains a stored Cross-Site Scripting (XSS) vulnerability in the job log list page (/joblog). An authenticated user who holds permission on a target executor job group can inject arbitrary JavaScript via the executorParam argument of the manual-trigger endpoint POST /jobinfo/trigger.
XXL-JOB versions prior to 3.5.0 are affected by a stored cross-site scripting (XSS) vulnerability in the GLUE code editor. The vulnerability arises because the JobCodeController.save() method stores user input from the glueSource parameter without proper output encoding, and the FreeMarker template job.code.ftl renders this stored input unescaped. This can lead to persistent XSS attacks when the stored data is viewed. The vulnerability has a medium severity with a CVSS score of 5.4.
CVE-2026-78851 is a directory traversal vulnerability affecting Grav CMS versions 2.0.3 through 2.0.6. This flaw allows a remote attacker with low privileges to access sensitive information by exploiting the GravExtension.php file via the mediaDirFunc method. The vulnerability has a medium severity rating with a CVSS score of 6.5.
CVE-2026-78850 is a medium severity vulnerability in Matomo version 5.11.2 that allows a remote attacker with low privileges to obtain sensitive information via the SiteContentDetector / SitesManager component. The vulnerability does not require user interaction and impacts confidentiality without affecting integrity or availability.
CVE-2026-88753 is a Regular-Expression Denial of Service (ReDoS) vulnerability in the extract_metadata() function of the markdown2 library up to version 2.5.5. An attacker can exploit this flaw by submitting a crafted Markdown document that triggers excessive processing, leading to a denial of service condition. The vulnerability has a high severity rating with a CVSS score of 7.5.
A denial of service vulnerability exists in FasterXML Jackson 1.x, specifically in jackson-mapper-asl versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13. The vulnerability is triggered by supplying deeply nested JSON input to an application that deserializes untrusted JSON using ObjectMapper.readValue. This can cause the application to become unresponsive or crash.
A stack overflow vulnerability exists in the gensub_ParsePsb() function of AOC LC32D1320 version 2.05. This vulnerability can be triggered by a specially crafted .PSB subtitle file, causing a Denial of Service (DoS) condition.
CVE-2026-95180 is a vulnerability in Justson agentweb-core version 5.1.6-androidx and earlier that allows a local attacker to access sensitive information and invoke non-exported host application components due to improper access control when handling intent:// URLs in DefaultWebClient.
CVE-2026-95179 is a denial of service vulnerability in lottie-android version 6.7.1 and earlier, including the master branch. It is caused by a crafted Lottie animation JSON that contains a cyclic precomposition reference graph, which triggers uncontrolled recursion in the BaseLayer.forModel and CompositionLayer components.
CVE-2026-104586 is a critical OS Command Injection vulnerability in the AUTOM8N WHM/cPanel plugin, specifically in the borg_restore.cgi component, present through commit 82821f7. It allows unauthenticated remote attackers to execute arbitrary operating system commands. The vulnerability has a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability.
IronCircle, a cybersecurity boot camp provider affiliated with several universities, abruptly shut down in June 2026, leaving many students with unpaid tuition debts and no job placement support. The program, which charged up to $18,900, was criticized for poor course functionality, misleading job prospects, and inadequate student support. Despite partnerships with over 20 universities, IronCircle operated with minimal oversight, was not accredited, and did not comply with many federal regulations protecting students. The sudden closure left students unable to access courses and struggling with private loan repayments. The Department of Education has issued guidance on third-party university partners, but enforcement appears limited.
A coordinated disruption targeted Chinese-speaking cybercriminals operating three major phishing kits—CoGUI, CoAceV, and CoFish_Ws—that distributed hundreds of millions of credential phishing messages primarily against Japanese organizations. These phishing campaigns impersonated 66 well-known consumer and finance brands to steal usernames, passwords, and payment data. The threat actors used sophisticated evasion techniques, including approximately 17,000 unique rotating domains. The disruption involved civil lawsuits and domain seizures against ecosystem enablers YAM Store and Iron Man, conducted collaboratively by Microsoft, Health-ISAC, and security partners. This action is expected to significantly disrupt multiple threat groups involved in financial fraud within the Chinese phishing ecosystem.
A phishing campaign uses fake Calendly booking pages impersonating Meta Careers to steal Facebook and Google login credentials. Victims are tricked into selecting interview times, submitting personal data, and completing fake CAPTCHAs before being prompted to log into their accounts. The phishing kit captures credentials and bypasses two-factor authentication by relaying authentication codes in real-time. The fake pages include convincing replicas of legitimate login screens with fake address bars showing authentic URLs. Eleven domains with recruiting-related names are involved, and the infrastructure operates via Amazon API Gateway in Singapore. Code comments in Vietnamese suggest possible origins of the operation.
Hirudo is an Android banking remote access trojan that combines credential theft with live remote control capabilities. It is distributed via shopping and entertainment apps acting as droppers, which install the trojan behind fake update prompts. The malware replaces legitimate banking apps with patched versions that disable internal security checks. The campaign targets eight Indonesian banking apps covering seven banks, embedding a hooking engine in the replacements. Distribution uses legitimate advertising infrastructure including Amazon CloudFront. Targeting extends beyond Indonesia to China, India, Mexico, Morocco, Thailand, and Malaysia. Backend data from August 2026 revealed thousands of stolen credentials and device records. No CVE or official patch information is available.
The npm package '@flexmr/utils' versions 1.0.0 and 3.0.12 have been identified as malicious. The package executes commands associated with malicious behavior, posing a security risk to users who install or use these versions.
