PULSEUnderground Intel

LIVE12signals / 24h

FEED

ransomakira reclama a Northwood Country Club · Hospitalityransomsection9 reclama a ****.com.pa · PA · Not Foundransomspacebears reclama a StellarRAD Systems · US · Technologyransomaurora reclama a Bretford Manufacturing · US · Manufacturingransomgunra reclama a Weilhotel · MY · Hospitalityransomdeadlock reclama a AHENK lab · TR · Technologyransomqilin reclama a Hoc · GB · Not Foundransomblacknevas reclama a Speed Group · Transportationransomthegentlemen reclama a Buck Knives · US · Manufacturingransomcoinbasecartel reclama a Accesso · GB · Technologyransomchaos reclama a thecranewaregroup.com · GB · Technologyransomcmdorganization reclama a B-K Tool & Design · US · Manufacturingransomdeadlock reclama a DIATER · ES · Manufacturingransomdeadlock reclama a Pasello · Technologyransomakira reclama a Northwood Country Club · Hospitalityransomsection9 reclama a ****.com.pa · PA · Not Foundransomspacebears reclama a StellarRAD Systems · US · Technologyransomaurora reclama a Bretford Manufacturing · US · Manufacturingransomgunra reclama a Weilhotel · MY · Hospitalityransomdeadlock reclama a AHENK lab · TR · Technologyransomqilin reclama a Hoc · GB · Not Foundransomblacknevas reclama a Speed Group · Transportationransomthegentlemen reclama a Buck Knives · US · Manufacturingransomcoinbasecartel reclama a Accesso · GB · Technologyransomchaos reclama a thecranewaregroup.com · GB · Technologyransomcmdorganization reclama a B-K Tool & Design · US · Manufacturingransomdeadlock reclama a DIATER · ES · Manufacturingransomdeadlock reclama a Pasello · Technology

CVE WatchJul 29, 2026

CVE-2026-63238

An authentication bypass vulnerability in Koollab LMS allowed an unauthenticated attacker to take over any account, including administrator

CVSS

6.5

Medium

EPSS

—

KEV

—

Exploit Today

0

0-100

Published: Jul 29, 2026 · Last modified: Jul 29, 2026

EPSS · 30d

Not enough EPSS history yet.

Technical description

An authentication bypass vulnerability in Koollab LMS allowed an unauthenticated attacker to take over any account, including administrator accounts, by supplying a valid user UUID without providing primary credentials via the 2FA validation endpoint.

Official references

www.csa.gov.sghttps://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-094/

Related CVEs

No related CVEs by CWE or product.