CVE-2026-63230

A pre-authentication error-based SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to read sensitive database contents, including personally identifiable information, credentials, and valid JWT tokens that may enable account takeover, via the SCORM report endpoint...

CVE-2026-63241 Insecure direct object reference vulnerability

An insecure direct object reference vulnerability in Koollab LMS allowed an authenticated user to query the course completion progress of any other user without authorisation, disclosing private learning progress information...

CVE-2026-63239

The CVE-2026-63239 entry describes a vulnerability in Koollab LMS where hard-coded AWS IAM credentials are present. This flaw can allow an attacker to access shared multi-tenant S3 buckets and SQS queues, exposing sensitive data and enabling malicious content injection, job manipulation, or email...

EUVD-2026-50134

A hard-coded AWS IAM credentials vulnerability in Koollab LMS allowed an attacker to access shared multi-tenant S3 buckets and SQS queues, exposing sensitive data and enabling malicious content injection, job manipulation, or email interception...

CVE-2026-63239

A hard-coded AWS IAM credentials vulnerability in Koollab LMS allowed an attacker to access shared multi-tenant S3 buckets and SQS queues, exposing sensitive data and enabling malicious content injection, job manipulation, or email interception...

CVE-2026-63239 Hard-coded AWS IAM credentials vulnerability

A hard-coded AWS IAM credentials vulnerability in Koollab LMS allowed an attacker to access shared multi-tenant S3 buckets and SQS queues, exposing sensitive data and enabling malicious content injection, job manipulation, or email interception...

CVE-2026-63236

An improper access control vulnerability in Koollab LMS allowed an unauthenticated attacker to read another user's name, internal identifier, scores, lesson status, lesson position, and cached lesson state via the SCORM API endpoint...

EUVD-2026-50131

An improper access control vulnerability in Koollab LMS allowed an unauthenticated attacker to read another user's name, internal identifier, scores, lesson status, lesson position, and cached lesson state via the SCORM API endpoint...

CVE-2026-63230 Pre-authentication error-based SQL injection vulnerability

A pre-authentication error-based SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to read sensitive database contents, including personally identifiable information, credentials, and valid JWT tokens that may enable account takeover, via the SCORM report endpoint...

CVE-2026-64553

A flaw was found in the Linux kernel's packet sampling psample network module. This vulnerability, specifically within the PSAMPLEATTRDATA attribute handling, occurs because the nlaput function does not properly clear padding bytes. When the data length is not a multiple of four bytes,...

Eclipse Jetty - Information Disclosure

Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224 is susceptible to improper authorization. The default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. An attacker can access sensitive information regarding...

KubeOperator Foreground `kubeconfig` - File Download

KubeOperator is an open source Kubernetes distribution focused on helping enterprises plan, deploy and operate production-level K8s clusters. In KubeOperator versions 3.16.3 and below, API interfaces with unauthorized entities and can leak sensitive information. This vulnerability could be used t...

ROOT-OS-DEBIAN-12-CVE-2025-37768 CVE-2025-37768 in rootio-linux - Patched by Root

Root has patched CVE-2025-37768 in the rootio-linux package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2025-21634 CVE-2025-21634 in rootio-linux - Patched by Root

Root has patched CVE-2025-21634 in the rootio-linux package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-43308 CVE-2026-43308 in rootio-linux - Patched by Root

Root has patched CVE-2026-43308 in the rootio-linux package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-53185 CVE-2026-53185 in rootio-linux - Patched by Root

Root has patched CVE-2026-53185 in the rootio-linux package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2025-38729 CVE-2025-38729 in rootio-linux - Patched by Root

Root has patched CVE-2025-38729 in the rootio-linux package for Root:Debian:12. Multiple fixed versions available...

CVE-2026-12144

The Wholesale for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.5. This is due to the saverequestsmeta function applying only sanitizetextfield to the userroleset POST parameter before passing it directly to WPUser::addrole, with ...

CVE-2026-12144 Wholesale for WooCommerce <= 2.0.5 - Authenticated (Author+) Privilege Escalation via 'user_role_set' Parameter

The Wholesale for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.5. This is due to the saverequestsmeta function applying only sanitizetextfield to the userroleset POST parameter before passing it directly to WPUser::addrole, with ...

CVE-2026-56822

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the OcspServerCertificateValidator forwards the SslHandshakeCompletionEvent before the asynchronous OCSP validation completes. This allows the client's downstream handlers to se...