137177 matches found
EUVD-2026-42931
9router: Unauthenticated LLM proxy access via /codex rewrite authorization bypass...
SUSE CVE-2026-72451
In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix xfrm state cache insertion race The xfrm input state cache insertion code checks the validity of the state before acquiring the global xfrmstatelock. Thus it's possible for someone else to kill the state after it passed...
GHSA-44V6-7FXQ-VGF4 Vikunja has an incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parent_project_id=0
Summary The fix for CVE-2026-35595 project re-parenting privilege escalation only gates reparent operations when parentprojectid 0. A user with Write but not Admin permission on a shared child project can detach it from its parent by sending parentprojectid: 0, bypassing the Admin requirement. Th...
Vikunja has an incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parent_project_id=0
Summary The fix for CVE-2026-35595 project re-parenting privilege escalation only gates reparent operations when parentprojectid 0. A user with Write but not Admin permission on a shared child project can detach it from its parent by sending parentprojectid: 0, bypassing the Admin requirement. Th...
CVE-2026-55064 Vikunja incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parent_project_id=0
Vikunja is an open-source self-hosted task management platform. From 2.3.0 until 2.4.0, a user with Write but not Admin permission on a shared child project can detach it from its parent hierarchy by submitting parentprojectid equal to 0 to POST /api/v1/projects/project. The Project.CanUpdate...
CVE-2026-55064 Vikunja incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parent_project_id=0
Vikunja is an open-source self-hosted task management platform. From 2.3.0 until 2.4.0, a user with Write but not Admin permission on a shared child project can detach it from its parent hierarchy by submitting parentprojectid equal to 0 to POST /api/v1/projects/project. The Project.CanUpdate...
CVE-2026-55064
Vikunja (open-source self-hosted task management platform) versions 2.3.0 through 2.4.0 contain an incomplete fix for CVE-2026-35595. The authorization checks in pkg/models/project_permissions.go and pkg/models/project.go only gate reparent operations when parent_project_id > 0, but UpdateProj...
EUVD-2026-67831
Vikunja is an open-source self-hosted task management platform. From 2.3.0 until 2.4.0, a user with Write but not Admin permission on a shared child project can detach it from its parent hierarchy by submitting parentprojectid equal to 0 to POST /api/v1/projects/project. The Project.CanUpdate...
CVE-2026-55064 Vikunja incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parent_project_id=0
Vikunja is an open-source self-hosted task management platform. From 2.3.0 until 2.4.0, a user with Write but not Admin permission on a shared child project can detach it from its parent hierarchy by submitting parentprojectid equal to 0 to POST /api/v1/projects/project. The Project.CanUpdate...
CVE-2026-15603
morgan is an HTTP request logger middleware for Node.js. In versions prior to 1.12.0, the internal helper that escapes log token values did not neutralize the Unicode line separator characters U+0085 Next Line, U+2028 Line Separator, and U+2029 Paragraph Separator. An unauthenticated remote clien...
UBUNTU-CVE-2026-15603
morgan is an HTTP request logger middleware for Node.js. In versions prior to 1.12.0, the internal helper that escapes log token values did not neutralize the Unicode line separator characters U+0085 Next Line, U+2028 Line Separator, and U+2029 Paragraph Separator. An unauthenticated remote clien...
EUVD-2026-43098
Phalcon: Catastrophic backtracking ReDoS in the default Phalcon Router route lead to remote unauthenticated DoS...
CLSA-2026-1787932767 TuxCare security update for log4j:log4j (1 CVE)
TuxCare rebuilt log4j:log4j to address 1 CVE. Fixed in 1.2.14-tuxcare.2...
cve-2019-9053
versione aggiornata dello script...
EUVD-2026-67741
The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback,...
CLSA-2026-1787929170 TuxCare security update for org.springframework.security (1 CVE)
TuxCare rebuilt 21 org.springframework.security packages to address 1 CVE. Fixed in 5.7.11-tuxcare.8...
BIT-TOMCAT-2026-65637 Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incomplete
Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990. This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 through 10.1.57, from 9.0.115 through 9.0.120. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121,...
CVE-2026-15603 morgan vulnerable to Log Forging via unescaped Unicode line separators
morgan is an HTTP request logger middleware for Node.js. In versions prior to 1.12.0, the internal helper that escapes log token values did not neutralize the Unicode line separator characters U+0085 Next Line, U+2028 Line Separator, and U+2029 Paragraph Separator. An unauthenticated remote clien...
CVE-2026-15603
morgan is an HTTP request logger middleware for Node.js. In versions prior to 1.12.0, the internal helper that escapes log token values did not neutralize the Unicode line separator characters U+0085 Next Line, U+2028 Line Separator, and U+2029 Paragraph Separator. An unauthenticated remote clien...