TVN ID	TVN-202608007
CVE ID	CVE-2026-78685, CVE-2026-82181
CVSS	【CVE-2026-78685】 8.8 (High) CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H 【CVE-2026-82181】 5.5 (Medium) CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected Products	Le-yan versions from 2.4.2.8 to 2.5.1.9
Description	【CVE-2026-78685(Remote Code Execution)】 Unauthenticated remote attackers can execute arbitrary OS commamnds via a crafted HTML page. 【CVE-2026-82181(Sensitive Data in URL)】 Unauthenticated remote attackers can obtain sensitive information via victim's browser history or log files.
Solution	Update to version 2.5.2.0 or later
Public Date	2026-08-25