PT-2026-65713

A business logic vulnerability in Koollab LMS allowed an authenticated learner to set their lesson completion status to completed via the SCORM commit endpoint without viewing the lesson material, compromising training and completion records...

PT-2026-65784

The Extra Checkout Options addon for Extra Product Options & Add-Ons for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.3.2. This is due to missing authorization and nonce validation in the eco save settings function, which allows...

Linux Distros Unpatched Vulnerability : CVE-2026-67194

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Courier IMAP before 6.0.1 and Courier Mail Server before 2.0.2 allow authenticated IMAP users to crash the imapd process via deeply nested parenthesized SEARCH...

PT-2026-65887

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 10.1.0 through 19.0.4 GitLab CE/EE versions 19.1 through 19.1.2 GitLab CE/EE versions 19.2 through 19.2.0 Description An issue in the internal request handling of GitLab Workhorse, the HTTP request handler for the GitLab...

PT-2026-65712

An insecure direct object reference vulnerability in Koollab LMS allowed an authenticated user to query the course completion progress of any other user without authorisation, disclosing private learning progress information...

PT-2026-65711

An information disclosure vulnerability in Koollab LMS allowed an authenticated learner to obtain correct quiz answers from the course status endpoint without completing the assessment legitimately, compromising the integrity of assessments...

PT-2026-65703

A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment reinforcement endpoint, control data passed to unserialize, write a webshell to a publicly accessible location, and execute arbitrary code on the server...

PT-2026-65871

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 10.6 through 19.0.4 GitLab CE/EE versions 19.1 through 19.1.2 GitLab CE/EE versions 19.2 through 19.2.0 Description An improper authorization check on merge request collaboration settings allows an authenticated user with...

PT-2026-65873

Name of the Vulnerable Software and Affected Versions GitLab EE versions 17.0 through 19.0.4 GitLab EE versions 19.1 through 19.1.2 GitLab EE versions 19.2 through 19.2.0 Description A race condition in approval rule processing may allow an authenticated user to merge code into a protected branch...

PT-2026-65699

An unrestricted image upload vulnerability in Koollab LMS allowed an authenticated attacker to upload malicious content disguised as an image file via the feedback mail registration endpoint, potentially enabling further attacks on the server...

PT-2026-65886

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 18.4 through 19.0.4 GitLab CE/EE versions 19.1 through 19.1.2 GitLab CE/EE versions 19.2 through 19.2.0 Description An improper access control enforcement in the Pipeline Test Report API allows an authenticated user with...

PT-2026-65790

Joomla Extension - joomlacontenteditor.net - Creation of hidden files and unintended file overwrite via rename function in Joomla Content Editor JCE 2.20.2 - Improper input validation in the file rename functionality allowed an authenticated user with file management permissions to rename files t...

Check Point Gaia Operating System (sk185153)

The remote host is missing a hotfix for the Gaia Operating System. It is, therefore, affected by a vulnerability as referenced in the sk185153 advisory. - A vulnerability in Check Point Gaia Portal allows an authenticated attacker with read-only Gaia Portal privileges to execute commands with roo...

libXfont2: computeProps Property Buffer Heap Buffer Overflow

A heap buffer overflow due to missing size checking in the property buffer when parsing PCF files in libXfont2 ComputeScaledProperties before libXfont2 before 2.0.8 could be used by attackers using authenticated X clients to execute code within the X server...

CVE-2026-14958

IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to unquoted shell interpolation...

CVE-2026-14958

IBM Aspera Faspex 5 (versions 5.0.0 through 5.0.15.4) is affected by a vulnerability that allows a remote authenticated attacker to execute arbitrary code due to unquoted shell interpolation. The issue is a root cause in shell command handling that enables code execution with high impact (confide...

CVE-2026-14958 OS command injection in IBM Aspera Faspex

IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to unquoted shell interpolation...

CVE-2026-14959

CVE-2026-14959 affects IBM Aspera Faspex 5, versioned 5.0.0 through 5.0.15.4. The vulnerability allows a remote authenticated attacker to execute arbitrary code via a shell command injection in Faspex components. Root cause: improper input handling enabling shell command execution. Impact: high w...

CVE-2026-6881 Authenticated SQL Injection Enables Unauthorized Access to Sensitive Information in Ellucian Advance Web and Legacy Advance

A SQL Injection in the Giving Reports functionality in Ellucian Advance Web and Legacy Advance allows an authenticated attacker to extract sensitive information from databases via a crafted SQL query in the class credit field. This issue affects Advance Web: all versions; Legacy Advance: all...

CVE-2026-6881 Authenticated SQL Injection Enables Unauthorized Access to Sensitive Information in Ellucian Advance Web and Legacy Advance

A SQL Injection in the Giving Reports functionality in Ellucian Advance Web and Legacy Advance allows an authenticated attacker to extract sensitive information from databases via a crafted SQL query in the class credit field. This issue affects Advance Web: all versions; Legacy Advance: all...