CVE Vulnerabilities - 27 September 2026

The Krayin Laravel-CRM software versions up to 2.2.5 contain a mistake in a configuration file that can let a remote attacker change who can see or change information. This could give people who shoul...

In StarTraining versions up to 3.8.1, a check that decides whether a user is an administrator can be fooled by sending specially crafted user or role information. This means someone on the network cou...

The loginlinkstudent.php page in the CloudClassroom-PHP project does not properly verify a user’s email address, allowing anyone to log in as a student without a password. This can be triggered from a...

The Edimax BR-6428nC Wi‑Fi router (firmware version 1.16) has a flaw in its Wireless Wizard function that can be triggered over the network. An attacker could exploit this to run their own code on the...

Versions of utcp-gql and utcp-websocket older than 1.1.1 may let a malicious user supply specially crafted URLs that cause the server to make its own requests. This can expose internal services, cloud...

Versions of Krayin Laravel-CRM up to 2.2.5 let a remote user trick the system into sending files they should not see by changing a request parameter. This could expose sensitive documents stored on th...

StarTraining version 3.8.1 and earlier fails to properly verify a user's role when accessing certain data functions, letting an unauthenticated attacker perform actions they shouldn't be able to. This...

The registration form in the CloudClassroom-PHP-Project does not properly clean the first name, last name and address fields that users submit. Because of that, a remote attacker could supply speciall...

The CloudClassroom PHP Project can be tricked into performing actions on behalf of a user without their consent. An attacker can remotely send specially crafted requests that the application accepts a...

The Fleet management software (versions before 4.89.0) lets a logged‑in user who can view activity logs change the column used for sorting the results. By choosing a column that isn’t normally shown, ...

The Bookly scheduling plugin for WordPress does not check that a staff member’s request matches their own appointments or payments. A staff‑level user can see, edit, or delete other staff members’ boo...

The upload function in StarTraining (versions up to 3.8.1) does not properly check file information, letting attackers embed malicious scripts. If exploited, these scripts can run in a user's web brow...

Flatpak on Canonical, Debian, and Red Hat Enterprise Linux lets one user cancel another user's download, but the cancellation only hides it from tracking, so the original user cannot stop the download...

Flatpak extensions on affected Linux systems can be tricked into checking for the presence of any file or directory on the host computer and reporting back what it finds. This lets sandboxed apps lear...

The Nezha monitoring tool (versions before 2.2.7) returns the encrypted password of logged‑in users when the /api/v1/profile URL is called. This lets anyone who can reach the API copy those password s...

The MCP plugin used by python-utcp may connect to a server URL that is not forced to use HTTPS or a local address. If a plain HTTP address is configured, the handshake can be intercepted or seen on th...

In Cloudreve versions before 4.16.1, a logged‑in user can cause the system to place files in directories other than the one they chose. This can let an attacker put unwanted files in parts of the syst...

The StarTraining application (versions up to 3.8.1) processes a configuration file called application.yml. If the setting xss.enabled is changed, an attacker could inject malicious code that runs in a...

Flatpak on Canonical, Debian and Red Hat Enterprise Linux (versions 7, 8, and 10) may let a malicious user read files that belong to the system helper when an OCI repository is set up. The problem occ...

The admin settings screen in Krayin Laravel-CRM (versions up to 2.2.5) lets an attacker inject harmful script code by changing a footer label setting. This could let a remote user display unwanted con...