polarlearn records

6 published records for vendor polarlearn.

Researcher profile

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

6 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
40Plan	CVE-2026-25885No exploit	PolarLearn allows Unauthenticated WebSocket access allows subscribing to and posting in arbitrary group chatspolarlearn · polarlearn · CWE-285 Pre-auth Broken access control (IDOR)	Critical10.0	—	0.3%	Feb 9, 2026
36Monitor	CVE-2026-39322No exploit	PolarLearn: Any password authenticates banned accounts and grants API accesspolarlearn · polarlearn · CWE-287 Pre-auth Auth bypass	Critical9.2	—	0.2%	Apr 7, 2026
35Monitor	CVE-2026-35610No exploit	PolarLearn has a Server Action Admin Bypass in Account Management Actionspolarlearn · polarlearn · CWE-285 Broken access control (IDOR)	High8.8	—	0.3%	Apr 7, 2026
28Monitor	CVE-2026-25126Proof of concept	PolarLearn's unvalidated vote direction allows vote count manipulationpolarlearn · polarlearn · CWE-20	High7.1	—	0.3%	Jan 29, 2026
25Monitor	CVE-2026-25222No exploit	PolarLearn Affected by User Enumeration via Argon2 Timing Attack on Sign-In Endpointpolarlearn · polarlearn · CWE-200 Pre-auth Info leak	Medium6.3	—	0.4%	Feb 2, 2026
9Monitor	CVE-2026-25221No exploit	PolarLearn has Multiple Login CSRFs via Missing OAuth state Parameter (GitHub & Google)polarlearn · polarlearn · CWE-352 Pre-auth CSRF	Low2.3	—	0.2%	Feb 2, 2026

CVE-2026-25885
40Plan
PolarLearn allows Unauthenticated WebSocket access allows subscribing to and posting in arbitrary group chats
CriticalCVSS 10.0No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
polarlearn · polarlearnFeb 9, 2026
CVE-2026-39322
36Monitor
PolarLearn: Any password authenticates banned accounts and grants API access
CriticalCVSS 9.2No exploitEPSS 0%
- Pre-auth
- Auth bypass
polarlearn · polarlearnApr 7, 2026
CVE-2026-35610
35Monitor
PolarLearn has a Server Action Admin Bypass in Account Management Actions
HighCVSS 8.8No exploitEPSS 0%
- Broken access control (IDOR)
polarlearn · polarlearnApr 7, 2026
CVE-2026-25126
28Monitor
PolarLearn's unvalidated vote direction allows vote count manipulation
HighCVSS 7.1Proof of conceptEPSS 0%
polarlearn · polarlearnJan 29, 2026
CVE-2026-25222
25Monitor
PolarLearn Affected by User Enumeration via Argon2 Timing Attack on Sign-In Endpoint
MediumCVSS 6.3No exploitEPSS 0%
- Pre-auth
- Info leak
polarlearn · polarlearnFeb 2, 2026
CVE-2026-25221
9Monitor
PolarLearn has Multiple Login CSRFs via Missing OAuth state Parameter (GitHub & Google)
LowCVSS 2.3No exploitEPSS 0%
- Pre-auth
- CSRF
polarlearn · polarlearnFeb 2, 2026