CSA

Latest CVEs · RSS

• CVE-2026-89191 2026-10-08 · CVSS 6.8
  Unsanitised input in the "template name" field of SQLView KRIS's Workflow Template feature is rendered in "onclick" attributes on the main dashboard without pro
• CVE-2026-78237 2026-08-26 · CVSS 7.8
  Insufficient input validation in ABR allows a low-privileged user to inject malicious entries into the sudoers file, resulting in persistent root access that re
• CVE-2026-78236 2026-08-26 · CVSS 8.8
  An insecure PIN derivation mechanism in ABR allows a low-privileged user to escalate privileges to administrator by communicating over Cross-Process Communicati
• CVE-2026-55980 2026-08-06 · CVSS 5.5
  A denial-of-service vulnerability in CatchPulse could allow an attacker to conduct a stack buffer overrun attack, leading to a denial-of-service condition.
• CVE-2026-55979 2026-08-06 · CVSS 5.2
  An improper access control check in CatchPulse's named pipe communication interface could allow an attacker to invoke CatchPulse functions. This is limited to o
• CVE-2026-55978 2026-08-06 · CVSS 8.4
  An improper access control vulnerability in CatchPulse could allow a non-administrative local attacker to connect to an unrestricted kernel filter communication
• CVE-2026-43833 2026-07-31
  Full details and mitigation steps are currently restricted and will be published at a later date.
• CVE-2026-43832 2026-07-31
  Full details and mitigation steps are currently restricted and will be published at a later date.
• CVE-2026-43831 2026-07-31
  Full details and mitigation steps are currently restricted and will be published at a later date.
• CVE-2026-43830 2026-07-31
  Full details and mitigation steps are currently restricted and will be published at a later date.
• CVE-2026-43829 2026-07-31
  Full details and mitigation steps are currently restricted and will be published at a later date.
• CVE-2026-63242 2026-07-29 · CVSS 4.3
  A business logic vulnerability in Koollab LMS allowed an authenticated learner to set their lesson completion status to completed via the SCORM commit endpoint
• CVE-2026-63241 2026-07-29 · CVSS 3.1
  An insecure direct object reference vulnerability in Koollab LMS allowed an authenticated user to query the course completion progress of any other user without
• CVE-2026-63240 2026-07-29 · CVSS 4.3
  An information disclosure vulnerability in Koollab LMS allowed an authenticated learner to obtain correct quiz answers from the course status endpoint without c
• CVE-2026-63239 2026-07-29 · CVSS 5.4
  A hard-coded AWS IAM credentials vulnerability in Koollab LMS allowed an attacker to access shared multi-tenant S3 buckets and SQS queues, exposing sensitive da
• CVE-2026-63238 2026-07-29 · CVSS 6.5
  An authentication bypass vulnerability in Koollab LMS allowed an unauthenticated attacker to take over any account, including administrator accounts, by supplyi
• CVE-2026-63237 2026-07-29 · CVSS 4.8
  A TOTP two-factor authentication bypass vulnerability in Koollab LMS allowed an attacker to supply a client-controlled seed to generate a matching one-time pass
• CVE-2026-63236 2026-07-29 · CVSS 3.7
  An improper access control vulnerability in Koollab LMS allowed an unauthenticated attacker to read another user's name, internal identifier, scores, lesson sta
• CVE-2026-63235 2026-07-29 · CVSS 3.7
  An improper access control vulnerability in Koollab LMS allowed an unauthenticated attacker to forcibly terminate the session of any user given their email addr
• CVE-2026-63234 2026-07-29 · CVSS 9.9
  A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the manual mark assessment endpoint,
• CVE-2026-63233 2026-07-29 · CVSS 9.9
  A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment overall answer endpoi
• CVE-2026-63232 2026-07-29 · CVSS 9.9
  A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment reinforcement endpoin
• CVE-2026-63231 2026-07-29 · CVSS 8.1
  A post-authentication SQL injection vulnerability in Koollab LMS allowed an authenticated attacker to use an error-based SQL oracle via the face-to-face runs up
• CVE-2026-63230 2026-07-29 · CVSS 9.1
  A pre-authentication error-based SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to read sensitive database contents, including p
• CVE-2026-63229 2026-07-29 · CVSS 9.1
  A pre-authentication blind SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to use a time-based SQL oracle via the SSO OAuth endpo