GitLab CE/EE permits an authenticated developer-role user who has been removed from a project to continue committing code changes by exploiting improper authorization checks on merge request collaboration settings (CWE-863). The flaw spans a massive version range from 10.6 through 19.2.0, affecting both Community and Enterprise editions. No active exploitation is confirmed via CISA KEV, but a publicly available proof-of-concept exists on HackerOne, and the issue has been patched in 19.0.5, 19.1.3, and 19.2.1.
HTTP request smuggling exposure in Node.js 26.x arises because the HTTP server failed to reject incoming requests that exceed the configured maximum header count, creating an inconsistent parsing boundary exploitable by adversaries. Rated Low severity (CVSS 3.7) by the Node.js security team and fixed in v26.5.1 released 2026-07-29, the flaw is classified under CWE-444 and is most dangerous in reverse-proxy deployments where header-count enforcement differs between the frontend proxy and the Node.js backend. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Forced session termination via the login kickout endpoint in Koollab LMS allows unauthenticated attackers to deny service to any user by knowing their email address. The vulnerability, assigned a low CVSS score of 3.7, does not compromise data but can disrupt user sessions. No active exploitation or public proof-of-concept has been reported at the time of analysis.
Information disclosure in Koollab LMS 5.3.2 allows unauthenticated remote attackers to access sensitive user data (name, internal identifier, scores, lesson status, position, and cached state) via the SCORM API due to improper access controls. No exploit code or active exploitation is known, and the base CVSS score of 3.7 reflects low impact.
The Node.js permission model fails to validate the final resolved output path when generating diagnostic reports via process.report, allowing a local low-privileged attacker to write report files to filesystem locations outside the paths explicitly permitted by the --allow-fs-write flag. Affected are Node.js 26.x through 26.5.0, 24.x through 24.18.0, and 22.x through 22.23.1 (confirmed via EUVD-2026-51369). No public exploit code exists and no active exploitation has been confirmed; the fix is available in Node.js 26.5.1 released 2026-07-29.
Information disclosure in Koollab LMS allows authenticated users to access other users' course completion data without authorization. The vulnerability
Out-of-bounds read in Zephyr RTOS 4.2.0 through 4.4.0 allows a high-privileged local shell user to disclose device memory contents or crash the system via the coredump print shell command. The 16-bit tgt_code field from a stored coredump header is used as an unbounded index into a static 7-element string pointer array in print_coredump_hdr(), enabling reads up to ~64K entries past the array boundary that are then dereferenced and printed as a C string. No public exploit has been identified and no CISA KEV listing exists; the CVSS 3.0 base score accurately reflects that exploitation is constrained by local high-privilege access and deliberate coredump storage manipulation.
File upload restriction bypass in Ko
JWT malleability in joserfc versions 1.7.1 and prior allows a low-privileged user holding a valid token to craft alternate byte-distinct representations by exploiting the library's acceptance of non-conforming trailing Base64 padding (==), which violates the JOSE specification. Applications using deny-list-based token revocation or anti-replay protection are at risk of bypass, since a padding-modified token hashes to a different value that will not match the stored revoked-token record. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; the vendor-released fix is joserfc 1.7.2.
Incorrect SUID/SGID bit preservation in fuse-overlayfs before version 1.17 allows a low-privileged process inside a rootless container to leave an upper-layer file with mode 4777 (setuid plus world-writable) by triggering a copy-up via open(O_TRUNC) or truncate. The vulnerability is confined to local container contexts and carries a CVSS 4.0 score of 2.0, reflecting narrow exploitation conditions and limited integrity-only impact. No active exploitation (KEV) or public exploit code has been identified at time of analysis.