CVE-2026-91972

Vikunja versions before 2.6.0 fail to apply rate limiting to the /api/v2 public authentication endpoints (login, register, password-reset, and OAuth token routes). Remote unauthenticated attackers can perform unbounded credential guessing , account enumeration , and password-reset flooding withou...

CVE-2026-91972 Vikunja before 2.6.0 Authentication Bypass via Unthrottled API

Vikunja versions before 2.6.0 fail to apply rate limiting to /api/v2 public authentication endpoints including login, register, password-reset, and OAuth token routes. Remote unauthenticated attackers can perform unbounded credential guessing, account enumeration, and password-reset flooding...

CVE-2026-91969

vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the POST /api/v2/migration/csv/migrate endpoint that fails to limit parsed row cardinality. Authenticated attackers can upload multipart CSV files with millions of tiny records to exhaust process memory and terminate the...

CVE-2026-91981: Exposure of Sensitive Information to an Unauthorized Actor

Vikunja versions before 2.6.0 fail to properly validate link-share tokens in the v2 API user search endpoints. Attackers with a read-only share link can enumerate project users via the projects endpoint and confirm arbitrary usernames exist via the global search endpoint...

PT-2026-92095

Name of the Vulnerable Software and Affected Versions Vikunja versions prior to 2.6.0 Description Improper validation of link-share tokens in the v2 API user search endpoints allows attackers possessing a read-only share link to enumerate project users through the 'projects' endpoint and verify t...

CVE-2026-91969: Uncontrolled Resource Consumption

vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the POST /api/v2/migration/csv/migrate endpoint that fails to limit parsed row cardinality. Authenticated attackers can upload multipart CSV files with millions of tiny records to exhaust process memory and terminate the...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Firmware: csdsp: Prevent buffer overflows when processing V2 algorithm headers. It is necessary to ensure that all fields of a V2 algorithm header fit within the available firmware data buffer. The wmfw V2 format introduced...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerabilities have been resolved: inetdiag: The pad field in struct inetdiagreqv2 should be initialized. KMSAN reported an uninitialized access to uninitvalue in rawlookup. The diagnostic function for raw sockets uses the pad field in struct inetdiagreqv2 for...

Astra Linux – Vulnerability in freerdp3, freerdp2

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.22.0, there was a NULL pointer dereference vulnerability in rdpwritelogoninfov2. This vulnerability allowed a malicious RDP server to crash the FreeRDP proxy by sending a specially crafted LogonInfoV2 PDU with...

Astra Linux – Vulnerability in Linux, Linux 5.10

LFENCE/JMP mitigation V2-2 may not be sufficient in mitigating CVE-2017-5715 on some AMD CPUs...

Linux Distros Unpatched Vulnerability : CVE-2026-89090

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allow an unauthenticated remote actor to...

CVE-2026-90568

A vulnerability was detected in moxi624 Mogu Blog v2 up to 5.2. This affects the function BlogSortServiceImpl.addBlogSort of the file moguweb/src/main/resources/templates/info.ftl of the component blogSort Endpoint. The manipulation of the argument sortName results in cross site scripting. The...

CVE-2026-90568

A cross-site scripting (XSS) vulnerability exists in moxi624 Mogu Blog v2 (versions up to 5.2). The flaw is in the function BlogSortServiceImpl.addBlogSort within the file mogu_web/src/main/resources/templates/info.ftl , specifically in the blogSort endpoint. Manipulating the sortName argument al...

EUVD-2026-76916

ASE/Kalkitech ASE2000 V2 Communication Test Set 2.35 through 2.37 on Windows contains an improper certificate validation vulnerability in the IEC 60870-5-104 TLS client Task Mode. This allows a network-positioned attacker to bypass certificate validation via a certificate with multiple simultaneo...

PT-2026-90873

A vulnerability was detected in moxi624 Mogu Blog v2 up to 5.2. This affects the function BlogSortServiceImpl.addBlogSort of the file mogu web/src/main/resources/templates/info.ftl of the component blogSort Endpoint. The manipulation of the argument sortName results in cross site scripting. The...

CVE-2026-90647

ASE/Kalkitech ASE2000 V2 Communication Test Set 2.35 through 2.37 on Windows contains an improper certificate validation vulnerability in the IEC 60870-5-104 TLS client Task Mode. This allows a network-positioned attacker to bypass certificate validation via a certificate with multiple simultaneo...

CVE-2026-90647

ASE/Kalkitech ASE2000 V2 Communication Test Set versions 2.35 through 2.37 (Windows) contains an improper certificate validation vulnerability in its IEC 60870-5-104 TLS client (Task Mode). A network-positioned attacker can bypass certificate validation by presenting a certificate with multiple s...

CVE-2026-90647

ASE/Kalkitech ASE2000 V2 Communication Test Set 2.35 through 2.37 on Windows contains an improper certificate validation vulnerability in the IEC 60870-5-104 TLS client Task Mode. This allows a network-positioned attacker to bypass certificate validation via a certificate with multiple simultaneo...

PT-2026-90725

Name of the Vulnerable Software and Affected Versions ASE/Kalkitech ASE2000 V2 Communication Test Set versions 2.35 through 2.37 Description The IEC 60870-5-104 TLS client Task Mode on Windows contains an improper certificate validation issue. A network-positioned attacker can bypass certificate...

CVE-2026-90647: Improper Certificate Validation

ASE/Kalkitech ASE2000 V2 Communication Test Set 2.35 through 2.37 on Windows contains an improper certificate validation vulnerability in the IEC 60870-5-104 TLS client Task Mode. This allows a network-positioned attacker to bypass certificate validation via a certificate with multiple simultaneo...