CVE-2026-111871 is a SQL injection vulnerability in the itsmeravitejak Online-Examination-System affecting an unknown function in the file qsdb/usersdb/brandb/topicsdb/subjectsdb.php. The vulnerability arises from manipulation of the query, qtype, sortname, or sortorder parameters, allowing remote attackers to execute SQL injection attacks. The product does not use versioning, so specific affected versions are not available. The vulnerability has a CVSS 4.0 score of 6.9 (medium severity). The issue was reported to the project early, but no response or patch has been provided yet. Exploit code is publicly available, but there are no known active exploits in the wild at this time.
CVE-2026-111870 is a security vulnerability in the itsmeravitejak Online-Examination-System affecting the isAdmin function in admin/admin.php. The flaw allows missing authentication due to manipulation, enabling remote attackers to potentially bypass admin authentication. The product uses continuous delivery with rolling releases, so no specific affected or fixed versions are identified. The vendor has been informed but has not yet responded or issued a fix. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity).
Online Robust Mahalanobis is a statistical method for anomaly detection in robotic joint residuals. It measures how far a new sample deviates from a healthy baseline distribution using a robust Mahalanobis distance metric that is resistant to outliers. The method updates estimates of location and scatter online using averaged stochastic gradient descent, enabling real-time anomaly scoring. It is designed to detect faults such as payload changes in robotic arms by flagging samples that fall outside a learned healthy range. The approach improves on classical Mahalanobis distance by using robust estimators (geometric median and median covariation matrix) to avoid masking effects caused by outliers. This technique is presented as a research and utility module rather than a vulnerability or active threat.
A new JavaScript obfuscation technique has been demonstrated where formatting changes to a script can transform it into a completely different program. This technique leverages 186 different methods to alter script behavior through formatting, which can be tested via provided online tools and demos. The technique is primarily a research and development insight into JavaScript code manipulation rather than a direct vulnerability or exploit in existing software.
Discover-Tech, an Israeli advertising company, operated as a covert channel for Candiru spyware, enabling zero-click infections via malicious ads. These ads allowed threat actors to fingerprint, track, and de-anonymize millions of devices worldwide, including targeted attacks on Al Jazeera. The operation, named AdFection, exploited the online advertising ecosystem to deliver spyware without user interaction. Major platforms like Google and IAB Europe have removed Discover-Tech from their ad vendor registries and blocked its access to ad exchanges. Citizen Lab recommends blocking targeted ads at the gateway as the primary defense until industry-wide mitigations are effective.
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses versions up to and including 4.4.10 are vulnerable to stored cross-site scripting (XSS) via the 'quantity (REST)' and 'order_comments (checkout)' parameters. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when users access affected pages. The attack can be performed without authentication if guest checkout is enabled; otherwise, a Subscriber-level user can exploit it through their own checkout process.
Candiru spyware was delivered to devices at Al Jazeera Media Network through zero-click attacks using targeted online advertisements. These malicious ads executed code upon rendering without requiring user interaction, a technique termed AdFection by Citizen Lab researchers. The attacks targeted at least 45 devices between 2024 and 2025 and involved infrastructure linked to the Israeli spyware vendor Candiru. The advertising operation placed billions of bids and appeared across tens of thousands of apps and websites, potentially exposing millions of users to malicious domains. Major advertising companies have taken action to remove offending accounts and block malicious domains following disclosure.
Sudocrypt v16.0 is an international Capture The Flag (CTF) and cryptic challenge event organized by Exun Clan, a student-run tech club. The event is scheduled for October 27–28, 2026, and is open globally. It features cryptography, code-breaking, and cybersecurity challenges with a prize pool of approximately $900 USD and additional rewards. The competition is online and team-based, encouraging participants to solve puzzles and demonstrate cybersecurity skills.
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via the 'redirect_url' parameter in versions up to, and including, 4.0.8 This is due to insufficient input validation in the Topbar component's back button handler. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in the victim's browser whenever the victim accesses a page that includes the malicious payload.
Helium is a free online student planner for classes, homework, grades, and notes. Prior to 2.2.60, any authenticated user can submit an arbitrary URL to POST /feed/externalcalendars/, where helium/feed/services/icalexternalcalendarservice.py uses validate_url to check only URL syntax before passing the value to urllib.request.urlopen, and fetch_ical_conditional periodically refetches the stored URL. The server can therefore issue requests to attacker-selected external or internal hosts, while distinct responses, including an uncaught http.client.RemoteDisconnected condition for non-HTTP services, reveal internal host and port reachability. The supported impact is forced outbound requests and internal service reconnaissance; the advisory does not demonstrate secret retrieval because the relevant ECS credentials path is task-specific and unpredictable. This issue is fixed in version 2.2.60.
The saeka package on PyPI is identified as malicious software designed to perform mass credit card checking by abusing legitimate online retail services. It is part of a campaign with clear malicious intent, involving the unauthorized use of third-party APIs to validate stolen credit card data.
CVE-2026-110696 is an information disclosure vulnerability in the itsmeravitejak Online-Examination-System affecting an unknown function in the dbtables.sql file. The vulnerability can be exploited remotely without authentication and has a medium severity score of 6.9. The product uses a rolling release model, so no specific affected or fixed versions are identified. The issue was reported early to the project, but no response or patch has been provided yet. Public exploit code is available, increasing the risk of exploitation.
CVE-2026-14851 is a critical vulnerability in Copart’s online billing service that exposes sensitive customer information such as names, addresses, invoice numbers, payment details, and tax information. The flaw arises from missing authorization checks on the endpoint serving PDF invoice files, allowing unauthorized access. Additionally, some invoice document URLs are publicly indexed by search engines, further exposing confidential data. Exploiting this vulnerability enables attackers to access and potentially enumerate sensitive financial and personal data.
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress versions up to and including 10.3.1 is vulnerable to Local File Inclusion (LFI) via the [lifterlms_checkout] shortcode. Authenticated users with Instructor-level access or higher can exploit this vulnerability by manipulating shortcode attributes to control the file path included by the plugin, potentially leading to arbitrary file inclusion and code execution.
Tutor LMS – eLearning and online course solution plugin for WordPress versions up to and including 4.1.0 is vulnerable to reflected Cross-Site Scripting (XSS) via the 'tab' parameter. The vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts. Exploitation requires a specific condition where a lesson page has an empty nav-items array, which can occur naturally under certain content and comment settings. This vulnerability has a medium severity rating with a CVSS score of 4.7.
Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected.
A credential phishing campaign targeted WatchGuard Mobile VPN users via a fake download site watchguard-vpn.net. The attackers used SEO poisoning to appear in search results and collected credentials through repeated browser pop-ups, deliberately rejecting the first submission to capture multiple passwords. After credential theft, the campaign downloaded the genuine WatchGuard VPN client from the official CDN, bypassing detection by security tools. The stolen credentials included server addresses, usernames, and passwords, potentially granting attackers network access. The phishing domain watchguard-ssl.online was re-registered and fully operational by September after being inactive earlier in the year.
CVE-2026-109620 is a medium severity SQL injection vulnerability in SourceCodester Online Reviewer System version 1.0. The flaw exists in the PDO::prepare function within the login/index.php file, allowing remote attackers to manipulate username or password parameters to execute SQL injection attacks. The vulnerability has been publicly disclosed, but no known exploits are currently reported in the wild. No official patch or remediation guidance is provided in the available data.
CVE-2026-109607 is a SQL injection vulnerability in SourceCodester Online Exam System version 1.0. The flaw exists in the login endpoint script adminpanel/admin/query/loginExe.php, where manipulation of the username or password parameters allows remote attackers to perform SQL injection. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. Exploit code has been published, but no known active exploitation in the wild is reported. No patch or official remediation information is currently available.