180225 matches found
SUSE CVE-2026-84357
Improper input validation in Omnibox in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. Chromium security severity: High...
Important: Red Hat Security Advisory: go-fdo-client security update
An update for go-fdo-client is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...
EUVD-2026-69920
Kimai versions before 2.65.0 contain an authorization bypass vulnerability in the REST API timesheet collection endpoint that fails to enforce activity-team access controls. Users with viewothertimesheet permission can list timesheets using activities restricted to teams they do not belong to,...
CVE-2026-84808
Kimai (a self-hosted time-tracking application) versions before 2.65.0 are affected by an authorization bypass in the REST API timesheet collection endpoint. The vulnerability stems from a failure to enforce activity-team access controls : a user holding the view_other_timesheet permission can li...
CVE-2026-84808 Kimai before 2.65.0 Authorization Bypass via API Timesheet
Kimai versions before 2.65.0 contain an authorization bypass vulnerability in the REST API timesheet collection endpoint that fails to enforce activity-team access controls. Users with viewothertimesheet permission can list timesheets using activities restricted to teams they do not belong to,...
CVE-2026-84808 Kimai before 2.65.0 Authorization Bypass via API Timesheet
Kimai versions before 2.65.0 contain an authorization bypass vulnerability in the REST API timesheet collection endpoint that fails to enforce activity-team access controls. Users with viewothertimesheet permission can list timesheets using activities restricted to teams they do not belong to,...
CVE-2026-84806 Kimai before 2.63.0 Authorization Bypass via Team Access Endpoints
Kimai before 2.63.0 contains an improper authorization vulnerability in team access endpoints that allows authenticated users with team edit permissions and read-only access to grant team access to customers, projects, or activities. Attackers can exploit insufficient permission checks by sending...
CVE-2026-84807 Kimai before 2.65.0 Authentication Bypass via Team Creation
Kimai kimai/kimai through 2.65.0 contains a business logic / improper authorization vulnerability in the default team creation endpoints. An authenticated user with project permission-management privileges can create or use a customer, project, or activity whose name matches an existing team;...
CVE-2026-84806 Kimai before 2.63.0 Authorization Bypass via Team Access Endpoints
Kimai before 2.63.0 contains an improper authorization vulnerability in team access endpoints that allows authenticated users with team edit permissions and read-only access to grant team access to customers, projects, or activities. Attackers can exploit insufficient permission checks by sending...
CVE-2026-84807
Kimai (kimai/kimai) versions prior to 2.65.0 contain an improper authorization flaw in its default team-creation endpoints (POST /api/customers/{id}/team, POST /api/projects/{id}/team, POST /api/activities/{id}/team). An authenticated user holding project permission-management privileges can crea...
CVE-2026-84806
Kimai versions before 2.63.0 contain an improper authorization flaw in team access endpoints. Authenticated users holding team edit permissions combined with read-only access can send POST requests to team access endpoints to modify access control lists for customers, projects, or activities beyo...
CVE-2026-84807 Kimai before 2.65.0 Authentication Bypass via Team Creation
Kimai kimai/kimai through 2.65.0 contains a business logic / improper authorization vulnerability in the default team creation endpoints. An authenticated user with project permission-management privileges can create or use a customer, project, or activity whose name matches an existing team;...
CVE-2026-84805 Kimai 2.61.0 before 2.63.0 Authentication Bypass via API
Kimai versions from 2.61.0 before 2.63.0 fail to disable admin-only work-contract preferences for low-privilege users in the PATCH /api/users/id/preferences endpoint. Although the web interface gates these employment-contract fields behind the contractotherprofile admin permission, the...
CVE-2026-84805
Kimai versions 2.61.0 through 2.62.x contain an authorization bypass in the PATCH /api/users/{id}/preferences API endpoint. The WorkContractPreferenceSubscriber, introduced in 2.61.0, registers admin-only work-contract preferences as enabled without verifying the contract_other_profile permission...
CVE-2026-84805 Kimai 2.61.0 before 2.63.0 Authentication Bypass via API
Kimai versions from 2.61.0 before 2.63.0 fail to disable admin-only work-contract preferences for low-privilege users in the PATCH /api/users/id/preferences endpoint. Although the web interface gates these employment-contract fields behind the contractotherprofile admin permission, the...
CVE-2026-84804
Kimai before version 2.65.0 contains an authorization bypass in its Team Activity API endpoints. The root cause is a missing permissions_activity check when removing team access to activities, projects, and customers: authenticated users holding only the edit_team permission can revoke team acces...
CVE-2026-84803 SiYuan before v3.8.2 Stored XSS via incomplete asset blocklist
SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in asset serving due to an incomplete extension blocklist that misses script-capable file types. Attackers can upload files with extensions like .xht, .ehtml, .xsl, .xbl, or .rdf that resolve to executable media types and...
EUVD-2026-69916
Kimai before 2.65.0 fails to properly validate permissions when removing team access to activities, projects, and customers via API endpoints. Authenticated users with editteam permission can revoke team access without the required permissionsactivity check, bypassing authorization controls...
CVE-2026-84804 Kimai before 2.65.0 Authorization Bypass via Team Activity API
Kimai before 2.65.0 fails to properly validate permissions when removing team access to activities, projects, and customers via API endpoints. Authenticated users with editteam permission can revoke team access without the required permissionsactivity check, bypassing authorization controls...
CVE-2026-84804 Kimai before 2.65.0 Authorization Bypass via Team Activity API
Kimai before 2.65.0 fails to properly validate permissions when removing team access to activities, projects, and customers via API endpoints. Authenticated users with editteam permission can revoke team access without the required permissionsactivity check, bypassing authorization controls...