CVE-2026-107421 is a session fixation vulnerability in VideoWhisper.com Broadcast Live Video software versions prior to 7.3.3. This flaw allows an attacker to hijack user sessions, potentially leading to unauthorized access. The vulnerability affects versions from initial releases up to 7.3.2. It has a CVSS 3.1 score of 7.3, indicating high severity with network attack vector and no required privileges or user interaction.
Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.
This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.19.51. See the following advisory for the container images for this release:
https://access.redhat.com/errata/RHSA-2026:79169
Security Fix(es):
* net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame (CVE-2026-33814)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
All OpenShift Container Platform 4.19 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html-single/updating_clusters/index#updating-cluster-cli.
A security advisory from Red Hat addresses multiple vulnerabilities affecting Red Hat AI Base Images 3.2.5 (Spyre), including CVE-2026-8461 and several others. One notable flaw is an integer overflow in FFmpeg's processing of Common Encryption (CENC) subsample data, which can lead to out-of-bounds writes causing information disclosure, data corruption, or denial of service. This vulnerability requires local processing of specially crafted media files and is rated moderate by Red Hat. No fixes are currently available for these issues in the Red Hat AI Base Images 3.2.5. Red Hat OpenShift AI and related products that bundle FFmpeg are affected, but the cloud.redhat.com ffmpeg component is not vulnerable. Red Hat is pursuing fixes through product streams.
CVE-2026-109143 is a medium severity vulnerability in calcom cal.com and cal.diy up to version 6.2.0. It involves improper privilege management in the credentials.delete function of the Credentials Handler component, specifically in the /api/trpc/credentials/delete endpoint. The vulnerability arises from manipulation of the teamId argument, allowing remote attackers to potentially misuse privileges. The vendor has not responded to the disclosure, and no patch or fix information is currently available. Exploit details have been publicly disclosed but no known exploits are reported in the wild.
CVE-2026-109106 is a path traversal vulnerability in Polaris Office App version 9.9.19 on Android. The flaw exists in the Document Intake component's function com.infraware.service.m.n.a, where manipulation of the _display_name argument allows an attacker with local access to perform path traversal. The vendor has released version 9.9.22 which includes a fix by adding path validation logic to restrict file creation to a designated temporary directory. The vulnerability has a medium severity with a CVSS score of 4.8. Exploit code is publicly available, but no known active exploitation in the wild has been reported.
FreeRDP versions before 3.32.0 contain a vulnerability in the freerdp_http_request() function where TLS handshakes are completed without proper server certificate chain validation. This flaw allows on-path attackers to impersonate login.microsoftonline.com during the Azure AD authentication process, potentially capturing OAuth authorization codes and substituting the OpenID discovery document. The vulnerability has a CVSS score of 6.8, indicating a high severity level.
CVE-2026-108475 is a missing authorization vulnerability in VideoWhisper.com's Broadcast Live Video product, affecting versions from initial release up to 7.3.6. The flaw allows exploitation due to incorrectly configured access control security levels, potentially enabling unauthorized actions. The vulnerability has a CVSS 3.1 base score of 4.3, indicating medium severity. No known exploits are reported in the wild, and no official patch or remediation details are provided in the available data.
CVE-2026-108476 is a missing authorization vulnerability in VideoWhisper.com Paid Videochat Turnkey Site affecting versions from initial through 7.5.13. The flaw involves incorrectly configured access control security levels, allowing unauthorized actions. The vulnerability has a medium severity with a CVSS score of 5. No official patch or vendor advisory is provided in the data, and no known exploits are reported in the wild.
VulcanRAT207.A is a sophisticated multi-stage malware intrusion chain initiated via a WhatsApp-delivered financial document lure. The malware uses compression and extensive host screening before escalating privileges to SYSTEM level through COM-based techniques and PoolParty Variant 7 injection. It deploys a signed driver to disable security processes, establishes persistence via DLL side-loading with a legitimate Intel-signed executable, and launches a WebSocket-based remote access trojan. The final payload provides extensive surveillance capabilities including shell access, keystroke logging, desktop control, network filtering, and process injection.
GitLab has disclosed a critical remote code execution vulnerability (CVE-2026-97229) in its CI/CD Regular Expression Compiler. This flaw arises from an integer overflow that allows unauthenticated attackers to execute arbitrary code on affected GitLab servers by submitting specially crafted regular expressions in pipeline configuration files. The issue affects GitLab Community Edition and Enterprise Edition versions prior to 19.2.8, 19.3.4, and 19.4.2. GitLab has released patches for these versions and urges immediate upgrading. GitLab.com and GitLab Dedicated customers are already protected. No exploit details or active attacks have been reported yet.
Canonical's primary websites, including ubuntu.com, canonical.com, the Ubuntu blog, and developer portal, were disrupted by a distributed denial-of-service (DDoS) attack in October 2026. This incident follows a previous, more disruptive DDoS attack in April 2026 that also affected additional services such as Launchpad and the Snap Store. The October attack caused downtime of approximately four hours, with most affected services restored shortly after. No detailed information on the attack's size or origin has been publicly disclosed, and no group has claimed responsibility for the recent incident. Developer-facing services like Launchpad and the Snap Store were not impacted in the October attack. The April attack was attributed to a hacktivist group, but it is unclear if the two incidents are related.
This is a multi-module project that contains Jackson-based JAX-RS providers for following data formats: JSON, Smile (binary JSON), XML, CBOR (another kind of binary JSON), YAML.
Security Fix(es):
* com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing (CVE-2026-68497)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
CVE-2026-108684 is a medium severity SQL injection vulnerability in erzhongxmu Jeewms affecting versions 3.0 through 3.7. The flaw exists in the getTreeData function of the Autocomplete Data Handler component, specifically in the file src/main/java/com/jeecg/demo/controller/JeecgFormDemoController.java. An attacker can remotely manipulate the searchVal argument to execute SQL injection. A patch identified by commit 6e29bd57972a499e9c8a81a2dbe94d0d5cf23af0 is available to fix this issue.
orderly-plugin-liquidity-heatmap poses as a liquidity heatmap plugin for the Orderly Network orderbook widget, but its only export is an empty stub and a postinstall hook runs `node ./scripts/setup.js` on npm install. When the script detects GitHub Actions (CI and GITHUB_WORKSPACE set), it records the runner's host, user, repository, GITHUB_/ACTIONS_/RUNNER_ variable names, GITHUB_TOKEN presence and length and network egress, and requests an OIDC token from ACTIONS_ID_TOKEN_REQUEST_URL. From 1.0.2 it uses the workflow's GITHUB_TOKEN to commit heatmap-setup-report.json to the default branch of the installing repository, and 1.0.4 also force-pushes a `heatmap-setup-<timestamp>` git tag with the credentials actions/checkout persists in .git/config; 1.0.6 ships the same setup.js as 1.0.4. The npm account dumtban published the six versions between 13:12 and 16:05 UTC on 2026-10-11, each extending the previous one's access to the CI runner.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (dc82bf27be560cba6faa5304a85b992a07f453c6f9d3f6965f9462666309a3d1)
orderly-plugin-liquidity-heatmap@1.0.0 ships a non-functional main (dist/index.js exports registerLiquidityHeatmapPlugin returning an empty function) with no overlay/interceptor/rendering code — the advertised purpose exists only in the README. The sole real behavior is a postinstall script (scripts/setup.js) gated by `process.env.CI && process.env.GITHUB_WORKSPACE`, so the payload fires only inside GitHub Actions. On that trigger it collects runner identity (hostname, user, repo, workflow, platform), enumerates all GITHUB_*/ACTIONS_*/RUNNER_* environment variable names, records GITHUB_TOKEN presence and length, captures the OIDC request URL, the npm registry, egress probe results, and tool versions, and writes the JSON to `<GITHUB_WORKSPACE>/heatmap-setup-report.json` inside the installer's checked-out repository. In addition, when ACTIONS_ID_TOKEN_REQUEST_TOKEN and ACTIONS_ID_TOKEN_REQUEST_URL are set, it uses the installer's OIDC bearer token to call the GitHub ID-token endpoint with `audience=api.github.com` and records the mint result in the same report. The combination of a hollow library stub, CI-environment-only activation, enumeration of secrets-adjacent CI metadata, unauthorized exercise of the workflow's OIDC identity, and placement of the output into the repository workspace where subsequent workflow steps may commit it or upload it as an artifact is a CI-poisoning / supply-chain reconnaissance primitive against the installer's build pipeline.
## Source: ghsa-malware (f25fe3de75e25d7bb2dee4e8cf02e39d79d011bc22a4b52cf0071bf8a73ad2f2)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.