CVE-2026-63241 is an insecure direct object reference vulnerability in Koollab LMS version 5.3.2. It allows an authenticated user to access the course completion progress of other users without proper authorization, exposing private learning progress information. The vulnerability has a low severity rating with a CVSS score of 3.1. No official patch or remediation guidance is currently available from the vendor.
CVE-2026-63240 is an information disclosure vulnerability in Three Learning's Koollab LMS version 5.3.2. It allows an authenticated learner to retrieve correct quiz answers from the course status endpoint without legitimately completing the assessment. This compromises the integrity of assessments by exposing answers prematurely. The vulnerability has a medium severity rating with a CVSS score of 4.3.
CVE-2026-63239 is a medium severity vulnerability in Three Learning's Koollab LMS version 5.3.2 involving hard-coded AWS IAM credentials. This flaw allows attackers to access shared multi-tenant S3 buckets and SQS queues, potentially exposing sensitive data and enabling malicious content injection, job manipulation, or email interception. The product is a cloud service, and a patch is available.
CVE-2026-63238 is an authentication bypass vulnerability in Koollab LMS version 5.3.2. It allows an unauthenticated attacker to take over any user account, including administrator accounts, by supplying a valid user UUID to the 2FA validation endpoint without providing primary credentials.
CVE-2026-63237 is a medium severity vulnerability in Three Learning's Koollab LMS version 5.3.2. It involves a bypass of the TOTP two-factor authentication mechanism by allowing an attacker to supply a client-controlled seed, which generates a matching one-time password and bypasses the second authentication factor. This could potentially enable unauthorized access to administrator accounts.
CVE-2026-63236 is an improper access control vulnerability in Three Learning's Koollab LMS version 5.3.2. It allows an unauthenticated attacker to read sensitive user information such as names, internal identifiers, scores, lesson status, lesson position, and cached lesson state via the SCORM API endpoint. The vulnerability has a low severity score of 3.7 and does not impact integrity or availability. No official patch or remediation guidance is currently available.
CVE-2026-63235 is an improper access control vulnerability in Koollab LMS version 5.3.2. It allows an unauthenticated attacker to forcibly terminate the session of any user by using their email address via the login kickout endpoint, causing a denial of service. The vulnerability has a low severity rating with a CVSS score of 3.7.
CVE-2026-63234 is a critical vulnerability in Three Learning's Koollab LMS version 5.3.2. It involves a SQL injection and unsafe deserialization flaw in the manual mark assessment endpoint. An authenticated attacker can exploit this to inject malicious input, control data passed to the unserialize() function, write a webshell to a publicly accessible location, and execute arbitrary code on the server.
CVE-2026-63233 is a critical vulnerability in Three Learning's Koollab LMS version 5.3.2. It involves a SQL injection combined with unsafe deserialization that allows an authenticated attacker to inject malicious input through the assessment overall answer endpoint. This can lead to control over data passed to the unserialize() function, enabling the attacker to write a webshell to a publicly accessible location and execute arbitrary code on the server.
CVE-2026-63232 is a critical vulnerability in Three Learning's Koollab LMS version 5.3.2. It involves SQL injection and unsafe deserialization that allows an authenticated attacker to inject malicious input through the assessment reinforcement endpoint. This can lead to arbitrary code execution on the server by writing a webshell to a publicly accessible location.
CVE-2026-63231 is a high-severity post-authentication SQL injection vulnerability in Koollab LMS version 5.3.2. It allows an authenticated attacker to exploit an error-based SQL oracle via the face-to-face runs update endpoint. Successful exploitation can lead to reading the entire application database and obtaining valid JWT tokens, enabling account takeover.
CVE-2026-63230 is a critical pre-authentication error-based SQL injection vulnerability in Three Learning's Koollab LMS version 5.3.2. It allows unauthenticated attackers to access sensitive database information, including personally identifiable information, credentials, and valid JWT tokens via the SCORM report endpoint. This exposure could lead to account takeover. The vulnerability has a high CVSS score of 9.1, indicating severe confidentiality and integrity impacts without requiring user interaction or privileges.
CVE-2026-63229 is a critical pre-authentication blind SQL injection vulnerability in Three Learning's Koollab LMS version 5.3.2. It allows an unauthenticated attacker to exploit a time-based SQL oracle via the SSO OAuth endpoint to extract sensitive database information, including personally identifiable information, credentials, and valid JWT tokens that could enable account takeover.
CVE-2026-63228 is an unrestricted image upload vulnerability in Three Learning's Koollab LMS version 5.3.2. An authenticated attacker can upload malicious content disguised as an image via the feedback mail registration endpoint. This vulnerability has a low CVSS score of 2.6 and does not impact confidentiality or availability but may allow limited integrity impact. No official patch or remediation guidance is currently available.
CVE-2026-63227 is a critical vulnerability in Koollab LMS version 5.3.2 that allows an authenticated module designer to upload a SCORM package containing a PHP webshell to a publicly accessible directory. This unrestricted file upload vulnerability enables arbitrary code execution on the server without user interaction.
The Advanced Responsive Video Embedder plugin for WordPress version 10.8.7 contains a critical authentication bypass vulnerability due to a hardcoded backdoor token. This backdoor allows unauthenticated attackers to gain administrator privileges by supplying a known token that matches a hardcoded SHA-256 hash in the plugin source. The vulnerability arises because the authentication bypass occurs before any normal authentication checks, with no nonce or capability verification. This flaw was likely introduced maliciously by an attacker with commit access to the plugin's codebase.
Missing authentication for critical function vulnerability in Universal Software Inc. UKBS allows Accessing Functionality Not Properly Constrained by ACLs.
This issue affects UKBS: through 28072026.
NOTE: The vendor was contacted and it was learned that the product is not supported.
Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows an unauthenticated remote attacker to exhaust connection process memory over HTTP/1.1.
The HTTP/1.1 handler in cowboy_http enforces the max_headers limit by counting the number of distinct header names in a map (maps:size(Headers)). When a request contains multiple header lines with the same name, the values are concatenated into a single ever-growing binary stored under that one map key (", " for regular headers, "; " for cookies), so the map size stays at one and the max_headers cap (default 100) is never reached. Because no accumulator bounds the total number of header lines or the total byte size of the header block (only per-line max_header_name_length and max_header_value_length apply), an unauthenticated client can send an arbitrary number of header lines with the same name and grow the connection process's binary memory to arbitrary size within the request window.
The impact per connection is bounded by request_timeout (default 5 seconds, not reset by header data), and by max_heap_size when set (the offending connection process is killed once its heap grows past the limit). When max_heap_size is left at the default (unset), sustained abuse can drive the Erlang VM into out-of-memory conditions.
This issue affects cowboy from 2.0.0-pre.4 before 2.18.0.
Allocation of resources without limits vulnerability in ninenines cowlib allows an unauthenticated remote HTTP/2 or HTTP/3 peer to exhaust memory on the vulnerable server (or client) and cause a denial of service.
The HPACK and QPACK prefixed-integer decoder cow_hpack_common:dec_big_int/3 in src/cow_hpack_common.hrl (invoked from cow_hpack:decode/2 in src/cow_hpack.erl and from cow_qpack:decode_field_section/3 in src/cow_qpack.erl) reads continuation octets until it sees one whose high bit is clear, evaluating Int + (Value bsl M) at each step with the shift M growing by seven per octet. No limit is enforced on the number of continuation octets, on the resulting bit width, or on the value; the decoder consumes whatever encoded length the peer supplies.
Because Erlang integers are immutable, each intermediate Value bsl M and each accumulator update allocates a fresh bignum whose digit width grows linearly with the number of octets processed so far. Summed across the whole decode, the transient bignum digit materialization is on the order of the square of the encoded length. A single maximal HPACK indexed representation carried inside one HTTP/2 HEADERS plus one CONTINUATION frame at Cowboy's default max_frame_size_received can force hundreds of megabytes of transient allocation and garbage-collection churn before the resulting header-table index is rejected as invalid. Repeated or concurrent connections multiply the pressure and can drive the Erlang VM to memory exhaustion.
Cowlib is the HTTP parser used by Cowboy, RabbitMQ's management plugin, and other Erlang and Elixir HTTP/2 and HTTP/3 servers and clients, so any exposed endpoint that accepts HPACK or QPACK from an untrusted peer is reachable.
This issue affects cowlib: from 2.0.0 before 2.19.0.