CVE WATCH / VULNERABILITY DETAIL
CVE-2026-45145
HIGHCVSS 7.5NVD feed
Published 30 October 2026 · tracked since 31 October 2026
Description
Chamilo LMS is an open-source learning management system. Prior to 2.0.1, `public/main/inc/lib/career.lib.php` and `public/main/cron/import_csv.php` call PHP's native `unserialize()` on `user_career.extra_data` retrieved from the database without the `allowed_classes: false` safety option. An attack
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-16760 HIGH 8.8
- CVE-2026-118938 HIGH 8.8
- CVE-2026-111578 HIGH 7.5
- CVE-2026-62990 HIGH 8.7
- CVE-2026-62989 HIGH 8.1
- CVE-2026-62864 HIGH 7.5
- CVE-2026-62958 HIGH 7.9
- CVE-2026-62297 HIGH 7.5
- CVE-2026-62847 HIGH 8.2
- CVE-2026-58412 HIGH 8.2