CVE-2026-77239: Improper Authorization

WACRM is a self-hostable CRM template for WhatsApp. In version 0.7.0 and earlier, WACRM flow and automation write routes authenticate account viewers but do not enforce the agent role before using a service-role database client that bypasses row-level security. In src/app/api/flows/id/route.ts,...

ROS-20260918-73-0088

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20260918-73-0086

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20260918-73-0070

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20260918-73-0054

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20260918-73-0051

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20260918-73-0050

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-77386: URL Redirection to Untrusted Site

Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, an unauthenticated attacker could initiate the OIDC login flow with an attacker-controlled redirectUrl. The login handling in auth/oidc.go stored that URL with the opaque login state, and...

ROS-20260918-73-0098

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20260918-73-0074

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20260918-73-0091

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20260918-73-0089

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20260918-73-0065

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20260918-73-0084

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20260918-73-0078

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

Chamilo LMS CStudio upload flow allows unauthenticated remote code execution

Impact Ability to run arbitrary code on the server without authentication...

GHSA-G4C3-4G96-6G4M Chamilo LMS CStudio upload flow allows unauthenticated remote code execution

Impact Ability to run arbitrary code on the server without authentication...

CVE-2026-45140

Chamilo LMS (open-source learning management system) versions prior to 2.0.1 are vulnerable to unauthenticated remote code execution via the CStudio upload flow . An attacker can execute arbitrary code on the server without prior authentication, resulting in full compromise of confidentiality, in...

CVE-2026-45140 Chamilo LMS CStudio upload flow allows unauthenticated remote code execution

Chamilo LMS is an open-source learning management system. Prior to 2.0.1, Chamilo LMS allows an unauthenticated remote attacker to execute arbitrary code on the server. The authoritative advisory does not identify the affected endpoint, component, input, or exploitation mechanism. This issue is...

CVE-2026-45140 Chamilo LMS CStudio upload flow allows unauthenticated remote code execution

Chamilo LMS is an open-source learning management system. Prior to 2.0.1, Chamilo LMS allows an unauthenticated remote attacker to execute arbitrary code on the server. The authoritative advisory does not identify the affected endpoint, component, input, or exploitation mechanism. This issue is...