https://vulnogram.org/ Most recent CVEs assigned by Cyber Security Agency of Singapore (csa). https://vulnogram.org/seaview/icons/csa.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-43858 https://vulnogram.org/CVE-2026-43858 A stack-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution. High Tue, 20 Oct 2026 09:19:17 GMT https://vulnogram.org/CVE-2026-43857 https://vulnogram.org/CVE-2026-43857 A vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution with privileges on the service. High Tue, 20 Oct 2026 09:17:49 GMT https://vulnogram.org/CVE-2026-43856 https://vulnogram.org/CVE-2026-43856 A stack-based buffer overflow vulnerability in the FileProcess::CheckDir function could allow a remote authenticated attacker to achieve arbitrary code execution via a path longer than 1024 bytes. High Tue, 20 Oct 2026 09:16:28 GMT https://vulnogram.org/CVE-2026-43855 https://vulnogram.org/CVE-2026-43855 A heap-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution. High Tue, 20 Oct 2026 09:14:17 GMT https://vulnogram.org/CVE-2026-43854 https://vulnogram.org/CVE-2026-43854 A vulnerability could allow an attacker with access to an encrypted project file to retrieve administrator credentials for EdgeLink-enabled devices. Medium Tue, 20 Oct 2026 09:12:47 GMT https://vulnogram.org/CVE-2026-43853 https://vulnogram.org/CVE-2026-43853 A vulnerability could allow an attacker to send a crafted message to trigger an assertion fault, causing the service to crash. High Network Exploitable Tue, 20 Oct 2026 09:10:59 GMT https://vulnogram.org/CVE-2026-43852 https://vulnogram.org/CVE-2026-43852 A vulnerability could allow an authenticated attacker to write files to arbitrary locations on the system. High Tue, 20 Oct 2026 09:06:53 GMT https://vulnogram.org/CVE-2026-43851 https://vulnogram.org/CVE-2026-43851 A path traversal vulnerability could allow an authenticated attacker to read arbitrary files on the system. High Tue, 20 Oct 2026 09:04:34 GMT https://vulnogram.org/CVE-2026-43850 https://vulnogram.org/CVE-2026-43850 A command injection vulnerability could allow an authenticated attacker to achieve root-level code execution on the system. High Tue, 20 Oct 2026 09:02:10 GMT https://vulnogram.org/CVE-2026-43849 https://vulnogram.org/CVE-2026-43849 A heap memory read vulnerability could allow an attacker to exfiltrate sensitive data. Medium Network Exploitable Tue, 20 Oct 2026 09:00:17 GMT https://vulnogram.org/CVE-2026-43848 https://vulnogram.org/CVE-2026-43848 A vulnerability in the bulk port configuration functionality could allow an unauthenticated attacker to crash the service. Medium Network Exploitable Tue, 20 Oct 2026 08:58:02 GMT https://vulnogram.org/CVE-2026-43847 https://vulnogram.org/CVE-2026-43847 A vulnerability in the proprietary protocol could allow an attacker to brute force the administrator password without restrictions, even when the SafeEnhancement feature is enabled. High Network Exploitable Tue, 20 Oct 2026 08:55:32 GMT https://vulnogram.org/CVE-2026-43846 https://vulnogram.org/CVE-2026-43846 A stack-based buffer overflow vulnerability in a non-functional feature could allow an authenticated attacker to achieve code execution. High Tue, 20 Oct 2026 08:53:19 GMT https://vulnogram.org/CVE-2026-43845 https://vulnogram.org/CVE-2026-43845 A vulnerability in the password reset mechanism could allow an attacker to bypass the authentication mechanism. Critical Network Exploitable Tue, 20 Oct 2026 08:48:28 GMT https://vulnogram.org/CVE-2026-43844 https://vulnogram.org/CVE-2026-43844 A vulnerability in the proprietary protocol could allow an attacker to bypass the authentication mechanism. Critical Network Exploitable Tue, 20 Oct 2026 08:45:47 GMT https://vulnogram.org/CVE-2026-43843 https://vulnogram.org/CVE-2026-43843 An integer overflow vulnerability in the license manager service could allow an unauthenticated attacker to crash the service. Medium Network Exploitable Tue, 20 Oct 2026 08:43:10 GMT https://vulnogram.org/CVE-2026-43842 https://vulnogram.org/CVE-2026-43842 A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via the rpc_rx_fsm function when msglen is set to 0. Medium Network Exploitable Tue, 20 Oct 2026 08:37:35 GMT https://vulnogram.org/CVE-2026-43841 https://vulnogram.org/CVE-2026-43841 A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via the rpc_rx_fsm function. Medium Network Exploitable Tue, 20 Oct 2026 08:32:31 GMT https://vulnogram.org/CVE-2026-43840 https://vulnogram.org/CVE-2026-43840 A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via the on_disconnected callback function. Medium Network Exploitable Tue, 20 Oct 2026 08:28:32 GMT https://vulnogram.org/CVE-2026-43839 https://vulnogram.org/CVE-2026-43839 A NULL pointer dereference vulnerability in the logs management functionality could allow an unauthenticated attacker to crash the service. High Network Exploitable Tue, 20 Oct 2026 08:24:51 GMT https://vulnogram.org/CVE-2026-43838 https://vulnogram.org/CVE-2026-43838 A stack-based buffer overflow vulnerability in the login functionality could allow an attacker to achieve code execution. Critical Network Exploitable Tue, 20 Oct 2026 08:18:13 GMT https://vulnogram.org/CVE-2026-43837 https://vulnogram.org/CVE-2026-43837 A buffer overflow vulnerability in the password verification functionality could allow an attacker with guest authentication to achieve code execution. High Tue, 20 Oct 2026 08:14:44 GMT https://vulnogram.org/CVE-2026-43836 https://vulnogram.org/CVE-2026-43836 A vulnerability could allow an attacker to forge a packet to execute arbitrary commands with maximum privileges. Critical Network Exploitable Tue, 20 Oct 2026 08:08:19 GMT https://vulnogram.org/CVE-2026-43835 https://vulnogram.org/CVE-2026-43835 A vulnerability in the firmware upgrade functionality could allow an authenticated attacker to upload a forged firmware upgrade file, potentially compromising the device permanently. High Tue, 20 Oct 2026 08:02:58 GMT https://vulnogram.org/CVE-2026-43834 https://vulnogram.org/CVE-2026-43834 A stack-based buffer overflow vulnerability in the logs settings functionality could allow an authenticated attacker to achieve code execution. High Tue, 20 Oct 2026 07:58:24 GMT https://vulnogram.org/CVE-2026-89191 https://vulnogram.org/CVE-2026-89191 Unsanitised input in the "template name" field of SQLView KRIS's Workflow Template feature is rendered in "onclick" attributes on the main dashboard without proper server-side sanitisation, allowing an attacker with administrative access to inject an… Medium Thu, 08 Oct 2026 08:15:14 GMT https://vulnogram.org/CVE-2026-78237 https://vulnogram.org/CVE-2026-78237 Insufficient input validation in ABR allows a low-privileged user to inject malicious entries into the sudoers file, resulting in persistent root access that remained effective after the ABR session ended. High Wed, 26 Aug 2026 07:24:32 GMT https://vulnogram.org/CVE-2026-78236 https://vulnogram.org/CVE-2026-78236 An insecure PIN derivation mechanism in ABR allows a low-privileged user to escalate privileges to administrator by communicating over Cross-Process Communication (XPC) while masquerading as an Apple-signed process. High Wed, 26 Aug 2026 07:20:58 GMT https://vulnogram.org/CVE-2026-55980 https://vulnogram.org/CVE-2026-55980 A denial-of-service vulnerability in CatchPulse could allow an attacker to conduct a stack buffer overrun attack, leading to a denial-of-service condition. Medium Thu, 06 Aug 2026 09:23:50 GMT https://vulnogram.org/CVE-2026-55979 https://vulnogram.org/CVE-2026-55979 An improper access control check in CatchPulse's named pipe communication interface could allow an attacker to invoke CatchPulse functions. This is limited to operations that enforce more restrictive security policies. Medium Thu, 06 Aug 2026 09:20:55 GMT https://vulnogram.org/CVE-2026-55978 https://vulnogram.org/CVE-2026-55978 An improper access control vulnerability in CatchPulse could allow a non-administrative local attacker to connect to an unrestricted kernel filter communication port and bypass CatchPulse's security policy enforcement. High Thu, 06 Aug 2026 09:18:32 GMT https://vulnogram.org/CVE-2026-43833 https://vulnogram.org/CVE-2026-43833 A stack-based buffer overflow vulnerability in the upload functionality could allow an authenticated attacker to achieve code execution. High Network Exploitable Fri, 31 Jul 2026 03:04:02 GMT https://vulnogram.org/CVE-2026-43832 https://vulnogram.org/CVE-2026-43832 A stack-based buffer overflow vulnerability in the Cookie parsing methods could allow an unauthenticated attacker to achieve code execution when the SafeEnhancement feature is enabled. Critical Network Exploitable Fri, 31 Jul 2026 03:00:49 GMT https://vulnogram.org/CVE-2026-43831 https://vulnogram.org/CVE-2026-43831 A stack-based buffer overflow vulnerability in the log message functionality could allow an unauthenticated attacker to achieve code execution. Critical Network Exploitable Fri, 31 Jul 2026 02:57:11 GMT https://vulnogram.org/CVE-2026-43830 https://vulnogram.org/CVE-2026-43830 A command injection vulnerability in the firmware upgrade file verification process could allow an attacker to execute arbitrary commands. Critical Network Exploitable Fri, 31 Jul 2026 02:53:27 GMT https://vulnogram.org/CVE-2026-43829 https://vulnogram.org/CVE-2026-43829 A stack-based buffer overflow vulnerability in the password functionality could allow an unauthenticated attacker to achieve code execution when the SafeEnhancement feature is enabled. Critical Network Exploitable Fri, 31 Jul 2026 02:48:23 GMT https://vulnogram.org/CVE-2026-63242 https://vulnogram.org/CVE-2026-63242 A business logic vulnerability in Koollab LMS allowed an authenticated learner to set their lesson completion status to completed via the SCORM commit endpoint without viewing the lesson material, compromising training and completion records. Medium Wed, 29 Jul 2026 06:32:03 GMT https://vulnogram.org/CVE-2026-63241 https://vulnogram.org/CVE-2026-63241 An insecure direct object reference vulnerability in Koollab LMS allowed an authenticated user to query the course completion progress of any other user without authorisation, disclosing private learning progress information. Low Wed, 29 Jul 2026 06:30:57 GMT https://vulnogram.org/CVE-2026-63240 https://vulnogram.org/CVE-2026-63240 An information disclosure vulnerability in Koollab LMS allowed an authenticated learner to obtain correct quiz answers from the course status endpoint without completing the assessment legitimately, compromising the integrity of assessments. Medium Wed, 29 Jul 2026 06:29:53 GMT https://vulnogram.org/CVE-2026-63239 https://vulnogram.org/CVE-2026-63239 A hard-coded AWS IAM credentials vulnerability in Koollab LMS allowed an attacker to access shared multi-tenant S3 buckets and SQS queues, exposing sensitive data and enabling malicious content injection, job manipulation, or email interception. Medium Wed, 29 Jul 2026 06:28:44 GMT https://vulnogram.org/CVE-2026-63238 https://vulnogram.org/CVE-2026-63238 An authentication bypass vulnerability in Koollab LMS allowed an unauthenticated attacker to take over any account, including administrator accounts, by supplying a valid user UUID without providing primary credentials via the 2FA validation endpoint… Medium Network Exploitable Wed, 29 Jul 2026 06:27:03 GMT https://vulnogram.org/CVE-2026-63237 https://vulnogram.org/CVE-2026-63237 A TOTP two-factor authentication bypass vulnerability in Koollab LMS allowed an attacker to supply a client-controlled seed to generate a matching one-time password and bypass the second authentication factor, potentially enabling unauthorised access… Medium Network Exploitable Wed, 29 Jul 2026 06:25:52 GMT https://vulnogram.org/CVE-2026-63236 https://vulnogram.org/CVE-2026-63236 An improper access control vulnerability in Koollab LMS allowed an unauthenticated attacker to read another user's name, internal identifier, scores, lesson status, lesson position, and cached lesson state via the SCORM API endpoint. Low Network Exploitable Wed, 29 Jul 2026 06:24:45 GMT https://vulnogram.org/CVE-2026-63235 https://vulnogram.org/CVE-2026-63235 An improper access control vulnerability in Koollab LMS allowed an unauthenticated attacker to forcibly terminate the session of any user given their email address via the login kickout endpoint, resulting in a denial of service. Low Network Exploitable Wed, 29 Jul 2026 06:23:33 GMT https://vulnogram.org/CVE-2026-63234 https://vulnogram.org/CVE-2026-63234 A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the manual mark assessment endpoint, control data passed to unserialize(), write a webshell to a publicly accessible location,… Critical Wed, 29 Jul 2026 06:22:01 GMT https://vulnogram.org/CVE-2026-63233 https://vulnogram.org/CVE-2026-63233 A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment overall answer endpoint, control data passed to unserialize(), write a webshell to a publicly accessible locati… Critical Wed, 29 Jul 2026 06:19:14 GMT https://vulnogram.org/CVE-2026-63232 https://vulnogram.org/CVE-2026-63232 A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment reinforcement endpoint, control data passed to unserialize(), write a webshell to a publicly accessible locatio… Critical Wed, 29 Jul 2026 06:16:25 GMT https://vulnogram.org/CVE-2026-63231 https://vulnogram.org/CVE-2026-63231 A post-authentication SQL injection vulnerability in Koollab LMS allowed an authenticated attacker to use an error-based SQL oracle via the face-to-face runs update endpoint to read the entire application database and obtain valid JWT tokens for acco… High Wed, 29 Jul 2026 06:13:49 GMT https://vulnogram.org/CVE-2026-63230 https://vulnogram.org/CVE-2026-63230 A pre-authentication error-based SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to read sensitive database contents, including personally identifiable information, credentials, and valid JWT tokens that may enable acco… Critical Network Exploitable Wed, 29 Jul 2026 06:11:58 GMT https://vulnogram.org/CVE-2026-63229 https://vulnogram.org/CVE-2026-63229 A pre-authentication blind SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to use a time-based SQL oracle via the SSO OAuth endpoint to read sensitive database contents, including personally identifiable information, cr… Critical Network Exploitable Wed, 29 Jul 2026 06:09:59 GMT