OpenCATS version 0.10.0 contains a vulnerability in the processLogin function of the Career Portal component that improperly restricts excessive authentication attempts. This flaw allows remote attackers to attempt multiple authentications with a high degree of complexity and difficulty. The project maintainer has released a patch that changes authentication to require CAPTCHA completion and maintains authenticated sessions server-side, removing reliance on client-side cookies. Rate limiting is recommended to be implemented outside the application at the network or proxy layer.
CVE-2026-111873 is a SQL Injection vulnerability in the itsmeravitejak Online-Examination-System affecting the MySQLDB::topicslist function in the exammanger.php file's AJAX Endpoint. The vulnerability allows remote attackers to manipulate the 'subject' argument to execute SQL injection attacks. The product uses a rolling release model, so no specific affected or fixed versions are identified. The issue was reported early to the project, but no response or fix has been provided yet. The CVSS 4.0 score is 6.9, indicating medium severity.
CVE-2026-111872 is a SQL injection vulnerability in the itsmeravitejak Online-Examination-System affecting multiple database-related functions in results.php/include/database.php. The vulnerability arises from manipulation of the id, user, or topic arguments, allowing remote attackers to inject SQL commands. The product uses a rolling release model, so specific affected versions are not clearly identified. The vulnerability has a medium severity score of 6.9 and has been publicly disclosed, but no patch or vendor response is currently available.
CVE-2026-111871 is a SQL injection vulnerability in the itsmeravitejak Online-Examination-System affecting an unknown function in the file qsdb/usersdb/brandb/topicsdb/subjectsdb.php. The vulnerability arises from manipulation of the query, qtype, sortname, or sortorder parameters, allowing remote attackers to execute SQL injection attacks. The product does not use versioning, so specific affected versions are not available. The vulnerability has a CVSS 4.0 score of 6.9 (medium severity). The issue was reported to the project early, but no response or patch has been provided yet. Exploit code is publicly available, but there are no known active exploits in the wild at this time.
CVE-2026-111870 is a security vulnerability in the itsmeravitejak Online-Examination-System affecting the isAdmin function in admin/admin.php. The flaw allows missing authentication due to manipulation, enabling remote attackers to potentially bypass admin authentication. The product uses continuous delivery with rolling releases, so no specific affected or fixed versions are identified. The vendor has been informed but has not yet responded or issued a fix. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity).
CVE-2026-111869 is a medium severity vulnerability in makeplane plane versions 1.4.0, 1.4.1, and 1.4.2. It involves reliance on untrusted inputs in a security decision due to manipulation of the X-Forwarded-For HTTP header in an API endpoint. The vulnerability can be exploited remotely without authentication. Public exploit code is available, but there are no reports of active exploitation in the wild. No patch or remediation information is provided.
The leakdeep package on PyPI masquerades as an OSINT and credential-leak intelligence tool but contains malicious code that acts as an infostealer on Windows systems. When executed, it starts a background process that steals browser credentials, cookies, autofill data, Discord authentication tokens, clipboard contents, screenshots, and webcam frames. The stolen data is exfiltrated to a hardcoded Discord webhook URL, which is obfuscated and reconstructed at runtime. The advertised search functionality is non-functional, serving as a cover for the malicious activities.
CVE-2026-111868 is a medium severity vulnerability in datastax pulsar-jms versions 9.0.0 through 9.0.3. It involves a deserialization issue in the decode function of PulsarObjectMessage.java, which can be triggered remotely without user interaction. The vulnerability has been publicly disclosed, but no patch or vendor response is currently available.
A vulnerability in the beaugunderson ip-address library before version 10.7.4 allows denial of service via inefficient regular expression complexity. Specifically, input containing many '%' characters can cause excessive CPU consumption and application stalls when processed by the Address6 constructor.
The WP User Manager WordPress plugin versions before 2.9.20 have a vulnerability where accounts created during payment-gated registration are not rolled back if the payment step fails. This allows unauthenticated users to create functional accounts without completing payment.
The Contact Form 7 Signature Addon WordPress plugin up to version 4.2.2 does not properly sanitize the signature field value before using it to build an email attachment path. This allows unauthenticated users to perform path traversal attacks to attach arbitrary files within the wp-content directory to outgoing emails. If the form is configured to send a copy to an attacker-controlled email address, the attacker can read the contents of the targeted file.
This entry reports on ThreatFox Indicators of Compromise (IOCs) dated 2026-10-17. It relates to malware activity involving payload delivery and network activity. No specific technical details, affected software versions, or exploits in the wild are provided. The severity is assessed as medium based on the available information.
This is a security update for Wireshark provided by the SUSE Product Security Team, corresponding functionally to Red Hat advisory RHSA-2026:83546. The update addresses multiple vulnerabilities identified by CVE identifiers including CVE-2026-76880 and others. No specific affected versions or detailed technical vulnerability descriptions are provided in the available data. The update is classified as high severity but lacks a CVSS score. No known exploits in the wild are reported at this time.
Gitea's web attachment handler has a vulnerability where it skips cross-repository ownership checks for attachments created before 16 January 2026. This allows an unauthenticated attacker who knows the UUID of a private attachment to access it via a public repository's attachment path, potentially exposing sensitive attachments such as issue and pull request files or release assets. The attacker must already know the random UUID of the attachment to exploit this issue.