CVE-2026-109143 is a medium severity vulnerability in calcom cal.com and cal.diy up to version 6.2.0. It involves improper privilege management in the credentials.delete function of the Credentials Handler component, specifically in the /api/trpc/credentials/delete endpoint. The vulnerability arises from manipulation of the teamId argument, allowing remote attackers to potentially misuse privileges. The vendor has not responded to the disclosure, and no patch or fix information is currently available. Exploit details have been publicly disclosed but no known exploits are reported in the wild.
CVE-2026-109106 is a path traversal vulnerability in Polaris Office App version 9.9.19 on Android. The flaw exists in the Document Intake component's function com.infraware.service.m.n.a, where manipulation of the _display_name argument allows an attacker with local access to perform path traversal. The vendor has released version 9.9.22 which includes a fix by adding path validation logic to restrict file creation to a designated temporary directory. The vulnerability has a medium severity with a CVSS score of 4.8. Exploit code is publicly available, but no known active exploitation in the wild has been reported.
FreeRDP versions before 3.32.0 contain a vulnerability in the freerdp_http_request() function where TLS handshakes are completed without proper server certificate chain validation. This flaw allows on-path attackers to impersonate login.microsoftonline.com during the Azure AD authentication process, potentially capturing OAuth authorization codes and substituting the OpenID discovery document. The vulnerability has a CVSS score of 6.8, indicating a high severity level.
CVE-2026-108475 is a missing authorization vulnerability in VideoWhisper.com's Broadcast Live Video product, affecting versions from initial release up to 7.3.6. The flaw allows exploitation due to incorrectly configured access control security levels, potentially enabling unauthorized actions. The vulnerability has a CVSS 3.1 base score of 4.3, indicating medium severity. No known exploits are reported in the wild, and no official patch or remediation details are provided in the available data.
CVE-2026-108476 is a missing authorization vulnerability in VideoWhisper.com Paid Videochat Turnkey Site affecting versions from initial through 7.5.13. The flaw involves incorrectly configured access control security levels, allowing unauthorized actions. The vulnerability has a medium severity with a CVSS score of 5. No official patch or vendor advisory is provided in the data, and no known exploits are reported in the wild.
RT-Thread versions through 5.3.0 have a memory corruption vulnerability in the legacy USB CDC virtual COM port driver. This flaw occurs because the rx_ringbuffer is aliased as a Serial V2 rt_serial_rx_fifo in the _function_enable() function. When a connected USB host configures the CDC device, it can cause writes beyond the ring buffer into adjacent memory structures and trigger an invalid rt_free() call upon device close. This results in a denial of service condition.
VulcanRAT207.A is a sophisticated multi-stage malware intrusion chain initiated via a WhatsApp-delivered financial document lure. The malware uses compression and extensive host screening before escalating privileges to SYSTEM level through COM-based techniques and PoolParty Variant 7 injection. It deploys a signed driver to disable security processes, establishes persistence via DLL side-loading with a legitimate Intel-signed executable, and launches a WebSocket-based remote access trojan. The final payload provides extensive surveillance capabilities including shell access, keystroke logging, desktop control, network filtering, and process injection.
GitLab has disclosed a critical remote code execution vulnerability (CVE-2026-97229) in its CI/CD Regular Expression Compiler. This flaw arises from an integer overflow that allows unauthenticated attackers to execute arbitrary code on affected GitLab servers by submitting specially crafted regular expressions in pipeline configuration files. The issue affects GitLab Community Edition and Enterprise Edition versions prior to 19.2.8, 19.3.4, and 19.4.2. GitLab has released patches for these versions and urges immediate upgrading. GitLab.com and GitLab Dedicated customers are already protected. No exploit details or active attacks have been reported yet.
Canonical's primary websites, including ubuntu.com, canonical.com, the Ubuntu blog, and developer portal, were disrupted by a distributed denial-of-service (DDoS) attack in October 2026. This incident follows a previous, more disruptive DDoS attack in April 2026 that also affected additional services such as Launchpad and the Snap Store. The October attack caused downtime of approximately four hours, with most affected services restored shortly after. No detailed information on the attack's size or origin has been publicly disclosed, and no group has claimed responsibility for the recent incident. Developer-facing services like Launchpad and the Snap Store were not impacted in the October attack. The April attack was attributed to a hacktivist group, but it is unclear if the two incidents are related.
Missing Authorization vulnerability in VideoWhisper.com VideoWhisper Site Manager for ChatGPT, Claude, Codex videowhisper-site-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VideoWhisper Site Manager for ChatGPT, Claude, Codex: from n/a through 1.2.10.
Improper Validation of Specified Quantity in Input vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Input Data Manipulation.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.12.
This is a multi-module project that contains Jackson-based JAX-RS providers for following data formats: JSON, Smile (binary JSON), XML, CBOR (another kind of binary JSON), YAML.
Security Fix(es):
* com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing (CVE-2026-68497)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
CVE-2026-108684 is a medium severity SQL injection vulnerability in erzhongxmu Jeewms affecting versions 3.0 through 3.7. The flaw exists in the getTreeData function of the Autocomplete Data Handler component, specifically in the file src/main/java/com/jeecg/demo/controller/JeecgFormDemoController.java. An attacker can remotely manipulate the searchVal argument to execute SQL injection. A patch identified by commit 6e29bd57972a499e9c8a81a2dbe94d0d5cf23af0 is available to fix this issue.
orderly-plugin-liquidity-heatmap poses as a liquidity heatmap plugin for the Orderly Network orderbook widget, but its only export is an empty stub and a postinstall hook runs `node ./scripts/setup.js` on npm install. When the script detects GitHub Actions (CI and GITHUB_WORKSPACE set), it records the runner's host, user, repository, GITHUB_/ACTIONS_/RUNNER_ variable names, GITHUB_TOKEN presence and length and network egress, and requests an OIDC token from ACTIONS_ID_TOKEN_REQUEST_URL. From 1.0.2 it uses the workflow's GITHUB_TOKEN to commit heatmap-setup-report.json to the default branch of the installing repository, and 1.0.4 also force-pushes a `heatmap-setup-<timestamp>` git tag with the credentials actions/checkout persists in .git/config; 1.0.6 ships the same setup.js as 1.0.4. The npm account dumtban published the six versions between 13:12 and 16:05 UTC on 2026-10-11, each extending the previous one's access to the CI runner.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (dc82bf27be560cba6faa5304a85b992a07f453c6f9d3f6965f9462666309a3d1)
orderly-plugin-liquidity-heatmap@1.0.0 ships a non-functional main (dist/index.js exports registerLiquidityHeatmapPlugin returning an empty function) with no overlay/interceptor/rendering code — the advertised purpose exists only in the README. The sole real behavior is a postinstall script (scripts/setup.js) gated by `process.env.CI && process.env.GITHUB_WORKSPACE`, so the payload fires only inside GitHub Actions. On that trigger it collects runner identity (hostname, user, repo, workflow, platform), enumerates all GITHUB_*/ACTIONS_*/RUNNER_* environment variable names, records GITHUB_TOKEN presence and length, captures the OIDC request URL, the npm registry, egress probe results, and tool versions, and writes the JSON to `<GITHUB_WORKSPACE>/heatmap-setup-report.json` inside the installer's checked-out repository. In addition, when ACTIONS_ID_TOKEN_REQUEST_TOKEN and ACTIONS_ID_TOKEN_REQUEST_URL are set, it uses the installer's OIDC bearer token to call the GitHub ID-token endpoint with `audience=api.github.com` and records the mint result in the same report. The combination of a hollow library stub, CI-environment-only activation, enumeration of secrets-adjacent CI metadata, unauthorized exercise of the workflow's OIDC identity, and placement of the output into the repository workspace where subsequent workflow steps may commit it or upload it as an artifact is a CI-poisoning / supply-chain reconnaissance primitive against the installer's build pipeline.
## Source: ghsa-malware (f25fe3de75e25d7bb2dee4e8cf02e39d79d011bc22a4b52cf0071bf8a73ad2f2)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.