Threat Intelligence Database

A flaw has been found in OpenCATS 0.10.0. Affected is the function processLogin of the file modules/careers/CareersUI.php of the component Career Portal. This manipulation of the argument applyToJobSubAction causes improper restriction of excessive authentication attempts. Remote exploitation of the attack is possible. A high degree of complexity is needed for the attack. The exploitability is told to be difficult. The exploit has been published and may be used. Patch name: 1cf4fa3ee9054314b023be79d404078645c22ade. It is suggested to install a patch to address this issue. The project maintainer explains: "Candidates will now need to authenticate each time they access the Career Portal and successfully complete the CAPTCHA as part of that authentication flow. The authenticated candidate identity is now maintained server-side rather than relying on the previous persistent client-side cats…cw cookie mechanism. Application-level rate limiting is deliberately not in scope for this change. In my view, request throttling and brute-force protection of that kind are better applied at the network, reverse-proxy or web-server layer, where they can be configured appropriately for each deployment without OpenCATS having to implement and maintain its own rate-limiting framework. I'll update the online documentation to that effect."

CVE-2026-111873 is a SQL injection vulnerability in the itsmeravitejak Online-Examination-System affecting the MySQLDB::topicslist function in the exammanger.php file's AJAX Endpoint. The vulnerability allows remote attackers to manipulate the 'subject' argument to perform SQL injection. The product uses a rolling release model, so no specific affected or fixed versions are provided. The issue was reported early to the project but no response or fix has been issued yet. The CVSS 4.0 base score is 6.9, indicating a medium severity.

CVE-2026-111872 is a SQL injection vulnerability in the itsmeravitejak Online-Examination-System affecting multiple database-related functions in results.php/include/database.php. The vulnerability arises from manipulation of the id, user, or topic arguments, allowing remote attackers to inject SQL commands. The product uses a rolling release model, so specific affected versions are not clearly defined. The issue was reported early but remains unaddressed by the vendor. The CVSS 4.0 score rates this as medium severity.

CVE-2026-111871 is a SQL injection vulnerability in the itsmeravitejak Online-Examination-System affecting an unknown function in the file qsdb/usersdb/brandb/topicsdb/subjectsdb.php. The vulnerability arises from manipulation of the query, qtype, sortname, or sortorder parameters. The product does not use versioning, so affected versions cannot be precisely identified. The vulnerability can be exploited remotely without authentication. Public exploit code is available, but no vendor response or patch has been issued.

CVE-2026-111870 is a medium-severity vulnerability in the itsmeravitejak Online-Examination-System affecting the isAdmin function in admin/admin.php. The flaw allows remote attackers to bypass authentication due to missing checks. The product uses continuous delivery with rolling releases, so no specific affected or fixed versions are identified. The vendor has not responded to the issue report, and no patch or remediation guidance is currently available. Public exploit code has been released, but no known active exploitation in the wild is reported.

CVE-2026-111869 is a medium severity vulnerability in makeplane plane versions 1.4.0, 1.4.1, and 1.4.2. It involves reliance on untrusted inputs in a security decision due to manipulation of the X-Forwarded-For header in an API endpoint. The vulnerability can be exploited remotely without privileges or user interaction. Public exploit code is available, but no known active exploitation in the wild has been reported.

CVE-2026-111868 is a medium severity vulnerability in datastax pulsar-jms versions 9.0.0 through 9.0.3. It involves a deserialization flaw in the decode function of PulsarObjectMessage.java, which can be triggered remotely without user interaction. The vulnerability has been publicly disclosed, but the vendor has not yet responded or issued a fix.

CVE-2026-111997 is a vulnerability in the beaugunderson ip-address library before version 10.7.4. It involves inefficient regular expression complexity that can lead to denial of service through excessive CPU consumption and application stalls when input containing many '%' characters triggers the Address6 constructor.

CVE-2026-111866 is a medium severity SQL injection vulnerability in the nemoTyrant manong product affecting the function cache/del_cache/arr2sql in func.php. The vulnerability allows remote attackers to manipulate SQL queries, potentially leading to unauthorized data access or modification. The product uses a rolling release model, so specific affected versions are not clearly identified. The issue was reported and closed on GitHub as completed, but no explicit patch or commit reference is available. No known exploits are reported in the wild.

Online Robust Mahalanobis is a statistical method for anomaly detection in robotic joint residuals. It measures how far a new sample deviates from a healthy baseline distribution using a robust Mahalanobis distance metric that is resistant to outliers. The method updates estimates of location and scatter online using averaged stochastic gradient descent, enabling real-time anomaly scoring. It is designed to detect faults such as payload changes in robotic arms by flagging samples that fall outside a learned healthy range. The approach improves on classical Mahalanobis distance by using robust estimators (geometric median and median covariation matrix) to avoid masking effects caused by outliers. This technique is presented as a research and utility module rather than a vulnerability or active threat.