EUVD-2026-125238

NocoDB before 2026.08.0 contains an incorrect authorization vulnerability that lets base-scoped API tokens act as account-wide credentials because the token's baseid is never stored or checked. Attackers holding a leaked token can read, write and delete records on every base the token owner belon...

CVE-2026-126283

NocoDB versions before 2026.08.0 are vulnerable to an incorrect authorization flaw involving base-scoped API tokens . The root cause is that the system fails to store or verify the base_id associated with these tokens, allowing them to function as account-wide credentials . An attacker who obtain...

CVE-2026-126291

NocoDB versions prior to 2026.06.2 are vulnerable to an SQL injection flaw in base-user.cte.utils.ts. The root cause is the unsafe concatenation of base members' email addresses into SQL queries used to resolve user , created-by , or last-modified-by fields. Registered users can exploit this by s...

EUVD-2026-125230

NocoDB before 2026.06.2 contains an SQL injection vulnerability in base-user.cte.utils.ts, which concatenates base members' email addresses into the SQL text of queries resolving user, created-by or last-modified-by fields. Registered users can set an email with a quoted local part containing a...

Windmill < 1.603.3 - SQL Injection

Windmill versions 1.276.0 through 1.603.2 contain an authenticated SQL injection vulnerability in the folder owner management endpoint. The addowner API endpoint passes user-supplied input directly into a SQL query without sanitization, enabling JSONB path injection. An authenticated user with...

EvilSlackbot

EvilSlackbot A Slack Attack Framework for conducting Red Team and phishing exercises within Slack workspaces. Disclaimer This tool is intended for Security Professionals only. Do not use this tool against any Slack workspace without explicit permission to test. Use at your own risk. Background...

github-endpoints

github-endpoints Find endpoints on GitHub. Description This Go tool performs searches on GitHub and parses the results to find endpoints of a given domain. Install go install github.com/gwen001/github-endpoints@latest or git clone https://github.com/gwen001/github-endpoints cd github-endpoints go...

CVE-2023-6289

CVE-2023-6289 Swift Performance Lite = 2.3.6.14 - Missing Authorization to Unauthenticated Settings Export Description The Swift Performance Lite plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the on functionality hooked via admininit functi...

CVE-2026-123528

Vikunja before 2.7.1 contains an insufficient session expiration vulnerability that allows holders of revoked access tokens to keep authenticating because SetupTokenMiddleware skips session and account-status checks. Attackers with a stolen token can, after logout, password reset, or account...

CVE-2026-123499

Vikunja veans before 2.7.1 contains a credential exposure vulnerability that allows malicious repository authors to capture API tokens by specifying an attacker-controlled server in .veans.yml. When veans runs in an untrusted checkout, it sends VEANSTOKEN as a Bearer token, or login passwords, TO...

CVE-2026-123493

Vikunja from 2.4.0 before 2.7.1 contains an authentication bypass vulnerability that allows disabled or locked users to retain access through API tokens owned by their bot users. Because token validation only checks the bot's own status, attackers holding pre-minted bot tokens can keep reading an...

CVE-2026-123528

Vikunja versions before 2.7.1 are vulnerable to an insufficient session expiration flaw due to the SetupTokenMiddleware skipping necessary session and account-status checks. This allows holders of revoked access tokens to maintain authentication. Specifically, an attacker with a stolen token can ...

CVE-2026-123528 Vikunja before 2.7.1 Insufficient Session Expiration via HTTP Token Middleware

Vikunja before 2.7.1 contains an insufficient session expiration vulnerability that allows holders of revoked access tokens to keep authenticating because SetupTokenMiddleware skips session and account-status checks. Attackers with a stolen token can, after logout, password reset, or account...

CVE-2026-123528 Vikunja before 2.7.1 Insufficient Session Expiration via HTTP Token Middleware

Vikunja before 2.7.1 contains an insufficient session expiration vulnerability that allows holders of revoked access tokens to keep authenticating because SetupTokenMiddleware skips session and account-status checks. Attackers with a stolen token can, after logout, password reset, or account...

EUVD-2026-119384

Vikunja veans before 2.7.1 contains a credential exposure vulnerability that allows malicious repository authors to capture API tokens by specifying an attacker-controlled server in .veans.yml. When veans runs in an untrusted checkout, it sends VEANSTOKEN as a Bearer token, or login passwords, TO...

CVE-2026-123493

Vikunja versions 2.4.0 before 2.7.1 are vulnerable to an authentication bypass via Bot API tokens. The root cause is that token validation only verifies the bot's own status, allowing disabled or locked users to retain access if they hold pre-minted bot tokens. Attackers can exploit this to read ...

CVE-2026-123493 Vikunja from 2.4.0 before 2.7.1 Authentication Bypass via Bot API Tokens

Vikunja from 2.4.0 before 2.7.1 contains an authentication bypass vulnerability that allows disabled or locked users to retain access through API tokens owned by their bot users. Because token validation only checks the bot's own status, attackers holding pre-minted bot tokens can keep reading an...

EUVD-2026-119378

Vikunja from 2.4.0 before 2.7.1 contains an authentication bypass vulnerability that allows disabled or locked users to retain access through API tokens owned by their bot users. Because token validation only checks the bot's own status, attackers holding pre-minted bot tokens can keep reading an...

CVE-2026-123493 Vikunja from 2.4.0 before 2.7.1 Authentication Bypass via Bot API Tokens

Vikunja from 2.4.0 before 2.7.1 contains an authentication bypass vulnerability that allows disabled or locked users to retain access through API tokens owned by their bot users. Because token validation only checks the bot's own status, attackers holding pre-minted bot tokens can keep reading an...

CVE-2026-123493 Vikunja from 2.4.0 before 2.7.1 Authentication Bypass via Bot API Tokens

Vikunja from 2.4.0 before 2.7.1 contains an authentication bypass vulnerability that allows disabled or locked users to retain access through API tokens owned by their bot users. Because token validation only checks the bot's own status, attackers holding pre-minted bot tokens can keep reading an...