🚨 CVE-2026-39385
Frappe LMS is an open source learning management system. In version 2.51.0 and earlier, a user could bypass payment validation for courses by using unrelated batch. This has been patched in 2.52.0 with enrollment now validating that the batch is linked to course.
🎖@cveNotify
Frappe LMS is an open source learning management system. In version 2.51.0 and earlier, a user could bypass payment validation for courses by using unrelated batch. This has been patched in 2.52.0 with enrollment now validating that the batch is linked to course.
🎖@cveNotify
GitHub
Enrollment bypass in paid courses via unrelated batch
### Impact
- A user could bypass payment validation for courses by using unrelated batch.
### Patches
- Enrollment now validates that the batch is linked to course.
### Acknowledgement
- R...
- A user could bypass payment validation for courses by using unrelated batch.
### Patches
- Enrollment now validates that the batch is linked to course.
### Acknowledgement
- R...
🚨 CVE-2026-34239
Chamilo version 1.11.40 and earlier are vulnerable to authenticated remote code execution in the main/inc/ajax/lang.ajax.php path. This endpoint is protected only by `api_protect_course_script(true)`, which means any authenticated user enrolled in a course (student, teacher, DRH) can reach it.
🎖@cveNotify
Chamilo version 1.11.40 and earlier are vulnerable to authenticated remote code execution in the main/inc/ajax/lang.ajax.php path. This endpoint is protected only by `api_protect_course_script(true)`, which means any authenticated user enrolled in a course (student, teacher, DRH) can reach it.
🎖@cveNotify
GitHub
Authenticated Remote Code Execution (< 1.11.40)
The vulnerable path: main/inc/ajax/lang.ajax.php — translate_portfolio_category
Access control: This endpoint is protected only by api_protect_course_script(true) (line 9), which means any authe...
Access control: This endpoint is protected only by api_protect_course_script(true) (line 9), which means any authe...
🚨 CVE-2026-39878
Chamilo LMS versions 1.11.38 and earlier contain a stored cross-site scripting vulnerability in the user registration form that allows any unauthenticated attacker to execute arbitrary JavaScript in an administrator's browser session, leading to full platform admin account takeover. This has been patched in 1.11.40.
🎖@cveNotify
Chamilo LMS versions 1.11.38 and earlier contain a stored cross-site scripting vulnerability in the user registration form that allows any unauthenticated attacker to execute arbitrary JavaScript in an administrator's browser session, leading to full platform admin account takeover. This has been patched in 1.11.40.
🎖@cveNotify
GitHub
Stored XSS via user registration leads to admin account takeover (< 1.11.40)
### Summary
A stored cross-site scripting vulnerability in the user registration form allows any unauthenticated attacker to execute arbitrary JavaScript in an administrator's browser sessio...
A stored cross-site scripting vulnerability in the user registration form allows any unauthenticated attacker to execute arbitrary JavaScript in an administrator's browser sessio...
🚨 CVE-2026-47130
NextCRM is open-source customer relationship management (CRM) software. Versions prior to 0.12.0 have a Broken Object Level Authorization (BOLA/IDOR) vulnerability exists in the CRM contact and target update endpoints. The application fails to verify if the authenticated user has ownership of the specific resource being modified. This allows any authenticated user (even with a standard `member` role) to arbitrarily modify sensitive CRM contacts and targets belonging to other users or organizations (cross-tenant data tampering). Version 0.12.0 fixes the issue.
🎖@cveNotify
NextCRM is open-source customer relationship management (CRM) software. Versions prior to 0.12.0 have a Broken Object Level Authorization (BOLA/IDOR) vulnerability exists in the CRM contact and target update endpoints. The application fails to verify if the authenticated user has ownership of the specific resource being modified. This allows any authenticated user (even with a standard `member` role) to arbitrarily modify sensitive CRM contacts and targets belonging to other users or organizations (cross-tenant data tampering). Version 0.12.0 fixes the issue.
🎖@cveNotify
GitHub
BOLA/IDOR in PATCH /api/crm/contacts/[id] allowing Cross-Tenant CRM Data Tampering
### Summary
A critical Broken Object Level Authorization (BOLA/IDOR) vulnerability exists in the CRM contact and target update endpoints. The application fails to verify if the authenticated user ...
A critical Broken Object Level Authorization (BOLA/IDOR) vulnerability exists in the CRM contact and target update endpoints. The application fails to verify if the authenticated user ...
🚨 CVE-2026-8593
Improper permission enforcement in Checkmk versions 2.5.0 before 2.5.0p9, 2.4.0 before 2.4.0p34, 2.3.0 before 2.3.0p49, and 2.2.0 (EOL) allows users without permissions to view and modify BI packs and rules
🎖@cveNotify
Improper permission enforcement in Checkmk versions 2.5.0 before 2.5.0p9, 2.4.0 before 2.4.0p34, 2.3.0 before 2.3.0p49, and 2.2.0 (EOL) allows users without permissions to view and modify BI packs and rules
🎖@cveNotify
Checkmk
Werk #16918: Fix Business Intelligence API Pack permission not respected in API requests
Previously, BI rules could be deleted via REST API even as user without permissions to modify or even see the BI pack the affected BI rule is part of.
🚨 CVE-2026-30632
Directory traversal vulnerability in knowns-dev/knowns 0.11.4 via crafted folder name value to the create_doc tool.
🎖@cveNotify
Directory traversal vulnerability in knowns-dev/knowns 0.11.4 via crafted folder name value to the create_doc tool.
🎖@cveNotify
Gist
knowns_create_doc_poc.md
GitHub Gist: instantly share code, notes, and snippets.
🚨 CVE-2026-50759
An issue in exo-explore exo 1.0.69 allows a remote attacker to escalate privileges via the GET /state and DELETE /instance/{instance_id} endpoints with no authentication.
🎖@cveNotify
An issue in exo-explore exo 1.0.69 allows a remote attacker to escalate privileges via the GET /state and DELETE /instance/{instance_id} endpoints with no authentication.
🎖@cveNotify
GitHub
Yu/CVE-2026-50759.md at main · August829/Yu
Contribute to August829/Yu development by creating an account on GitHub.
🚨 CVE-2026-30631
An issue was discovered in bytebot-ai in commit 3d37894ce07ef8d8b40adc7fd309ad96c2a71313 (2025-09-11) allowing attackers to execute arbitrary code via crafted path to `computer_write_file`.
🎖@cveNotify
An issue was discovered in bytebot-ai in commit 3d37894ce07ef8d8b40adc7fd309ad96c2a71313 (2025-09-11) allowing attackers to execute arbitrary code via crafted path to `computer_write_file`.
🎖@cveNotify
Gist
bytebot RCE description
bytebot RCE description. GitHub Gist: instantly share code, notes, and snippets.
🚨 CVE-2026-30633
Directory traversal vulnerability in knowns-dev/knowns 0.11.4 via crafted path value to the get_doc and update_doc tools.
🎖@cveNotify
Directory traversal vulnerability in knowns-dev/knowns 0.11.4 via crafted path value to the get_doc and update_doc tools.
🎖@cveNotify
Gist
knowns_get_update_doc_poc.md
GitHub Gist: instantly share code, notes, and snippets.
🚨 CVE-2026-52469
SQL injection vulnerability in Crocus v.1.3.44 allows a remote attacker to escalate privileges via the DeviceInfoMapper.xml file
🎖@cveNotify
SQL injection vulnerability in Crocus v.1.3.44 allows a remote attacker to escalate privileges via the DeviceInfoMapper.xml file
🎖@cveNotify
GitHub
CVE/Crocus/SQL Injection-1.md at main · Y4y17/CVE
Contribute to Y4y17/CVE development by creating an account on GitHub.
🚨 CVE-2026-52470
SQL injection vulnerability in Crocus v.1.3.44 allows a remote attacker to escalate privileges via the RecordStateMapper.xml file
🎖@cveNotify
SQL injection vulnerability in Crocus v.1.3.44 allows a remote attacker to escalate privileges via the RecordStateMapper.xml file
🎖@cveNotify
GitHub
CVE/Crocus/SQL Injection-2.md at main · Y4y17/CVE
Contribute to Y4y17/CVE development by creating an account on GitHub.
🚨 CVE-2026-52472
SQL injection vulnerability in Wgcloud 3.6.4 allows a remote attacker to escalate privileges via the PortInfoMapper.xml file
🎖@cveNotify
SQL injection vulnerability in Wgcloud 3.6.4 allows a remote attacker to escalate privileges via the PortInfoMapper.xml file
🎖@cveNotify
GitHub
CVE/Wgcloud/SQL-Injection-1.md at main · Y4y17/CVE
Contribute to Y4y17/CVE development by creating an account on GitHub.
🚨 CVE-2026-52474
An issue in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the JobUtil.java file.
🎖@cveNotify
An issue in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the JobUtil.java file.
🎖@cveNotify
GitHub
CVE/AiFlowy/Any SpringBean invocation.md at main · Y4y17/CVE
Contribute to Y4y17/CVE development by creating an account on GitHub.
🚨 CVE-2026-52475
Cross Site Scripting vulnerability in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the UploadController.java file
🎖@cveNotify
Cross Site Scripting vulnerability in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the UploadController.java file
🎖@cveNotify
GitHub
CVE/AiFlowy/Any file upload vulnerability.md at main · Y4y17/CVE
Contribute to Y4y17/CVE development by creating an account on GitHub.
🚨 CVE-2026-52476
SQL Injection vulnerability in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the getPageData method in the DatacenterQuery.java file
🎖@cveNotify
SQL Injection vulnerability in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the getPageData method in the DatacenterQuery.java file
🎖@cveNotify
GitHub
CVE/AiFlowy/SQL Injection.md at main · Y4y17/CVE
Contribute to Y4y17/CVE development by creating an account on GitHub.
🚨 CVE-2026-63047
The Joomla extension Events Booking prior version 5.0-5.8.1 did not properly verify that an actor is allowed to download invoice information.
🎖@cveNotify
The Joomla extension Events Booking prior version 5.0-5.8.1 did not properly verify that an actor is allowed to download invoice information.
🎖@cveNotify
Joomdonation
Events Booking
Events Booking is a Joomla events registration / events manager extension. It allows you to create, display events, handle registration, get paid from registrants via online payment gateways.
🚨 CVE-2026-63048
The Joomla extension Page Builder CK is vulnerable to an authenticated arbitrary file upload, leading to RCE.
🎖@cveNotify
The Joomla extension Page Builder CK is vulnerable to an authenticated arbitrary file upload, leading to RCE.
🎖@cveNotify
JoomlaCK - Extensions et tutoriels Joomla!
Extensions et documentations Joomlack
Téléchargez des extensions pour joomla, modules, plugins, ou composant. Vous pouvez également télécharger des tutoriels et livres pour créer votre template Joom
🚨 CVE-2026-63264
The Joomla extension JoomShopping is vulnerable to an reflected XSS vulnerability in the product frontend controller.
🎖@cveNotify
The Joomla extension JoomShopping is vulnerable to an reflected XSS vulnerability in the product frontend controller.
🎖@cveNotify
🚨 CVE-2026-57599
There is a privilege escalation vulnerability in some Hikvision cameras. Due to incorrect permission allocation in the device program, attackers can escalate privileges and gain full control of the device after authenticating via SSH.
🎖@cveNotify
There is a privilege escalation vulnerability in some Hikvision cameras. Due to incorrect permission allocation in the device program, attackers can escalate privileges and gain full control of the device after authenticating via SSH.
🎖@cveNotify
🚨 CVE-2026-57600
Insufficient validation of input parameters in the firmware of some Hikvision cameras allows unauthenticated attackers to retrieve partial sensitive data.
🎖@cveNotify
Insufficient validation of input parameters in the firmware of some Hikvision cameras allows unauthenticated attackers to retrieve partial sensitive data.
🎖@cveNotify
🚨 CVE-2026-61390
There is a heap buffer overflow vulnerability in some Hikvision cameras, which may allow unauthenticated attackers to cause device malfunction by sending specially crafted packets.
🎖@cveNotify
There is a heap buffer overflow vulnerability in some Hikvision cameras, which may allow unauthenticated attackers to cause device malfunction by sending specially crafted packets.
🎖@cveNotify