EUVD-2026-104054

A vulnerability was detected in donetick up to 0.1.82. The impacted element is the function CanDeleteHistory of the file internal/chore/model/model.go of the component History Deletion Handler. The manipulation of the argument AssignedTo results in improper authorization. The attack can be launch...

CVE-2026-112045 donetick History Deletion model.go CanDeleteHistory improper authorization

A vulnerability was detected in donetick up to 0.1.82. The impacted element is the function CanDeleteHistory of the file internal/chore/model/model.go of the component History Deletion Handler. The manipulation of the argument AssignedTo results in improper authorization. The attack can be launch...

CVE-2026-111918

Vikunja from 1.0.0-rc0 before 2.7.0 contains an improper authorization vulnerability in RecalculateTaskPositions that allows authenticated users with zero accessible projects to write taskpositions rows for all tasks instance-wide. Attackers can delete their Inbox after repointing defaultprojecti...

CVE-2026-111900

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an improper authorization vulnerability in attachment.php that fails to verify whether an attachment's parent FAQ is published or visible to the requester. Authenticated users with the dlattachment permission can request...

CVE-2026-111918

Vikunja from 1.0.0-rc0 before 2.7.0 contains an improper authorization vulnerability in RecalculateTaskPositions that allows authenticated users with zero accessible projects to write taskpositions rows for all tasks instance-wide. Attackers can delete their Inbox after repointing defaultprojecti...

CVE-2026-111918 Vikunja 1.0.0-rc0 before 2.7.0 Cross-Tenant Task Position Writes via Saved Filter Creation

Vikunja from 1.0.0-rc0 before 2.7.0 contains an improper authorization vulnerability in RecalculateTaskPositions that allows authenticated users with zero accessible projects to write taskpositions rows for all tasks instance-wide. Attackers can delete their Inbox after repointing defaultprojecti...

EUVD-2026-103303

Vikunja from 1.0.0-rc0 before 2.7.0 contains an improper authorization vulnerability in RecalculateTaskPositions that allows authenticated users with zero accessible projects to write taskpositions rows for all tasks instance-wide. Attackers can delete their Inbox after repointing defaultprojecti...

CVE-2026-111918 Vikunja 1.0.0-rc0 before 2.7.0 Cross-Tenant Task Position Writes via Saved Filter Creation

Vikunja from 1.0.0-rc0 before 2.7.0 contains an improper authorization vulnerability in RecalculateTaskPositions that allows authenticated users with zero accessible projects to write taskpositions rows for all tasks instance-wide. Attackers can delete their Inbox after repointing defaultprojecti...

CVE-2026-111918

The Vikunja task management application (versions 1.0.0-rc0 before 2.7.0 ) is vulnerable to an improper authorization vulnerability in the RecalculateTaskPositions function. This flaw allows authenticated users with no accessible projects to write task_positions rows for all tasks across the enti...

CVE-2026-111918 Vikunja 1.0.0-rc0 before 2.7.0 Cross-Tenant Task Position Writes via Saved Filter Creation

Vikunja from 1.0.0-rc0 before 2.7.0 contains an improper authorization vulnerability in RecalculateTaskPositions that allows authenticated users with zero accessible projects to write taskpositions rows for all tasks instance-wide. Attackers can delete their Inbox after repointing defaultprojecti...

CVE-2026-111900 phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Draft FAQ Attachment Disclosure via attachment.php

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an improper authorization vulnerability in attachment.php that fails to verify whether an attachment's parent FAQ is published or visible to the requester. Authenticated users with the dlattachment permission can request...

EUVD-2026-103320

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an improper authorization vulnerability in attachment.php that fails to verify whether an attachment's parent FAQ is published or visible to the requester. Authenticated users with the dlattachment permission can request...

CVE-2026-111900

The software phpMyFAQ versions before 4.1.9 and 4.2.0-alpha before 4.2.0-beta is vulnerable to an improper authorization flaw in attachment.php. The application fails to verify if an attachment's parent FAQ is published or visible to the requester. Consequently, authenticated users possessing the...

CVE-2026-111900 phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Draft FAQ Attachment Disclosure via attachment.php

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an improper authorization vulnerability in attachment.php that fails to verify whether an attachment's parent FAQ is published or visible to the requester. Authenticated users with the dlattachment permission can request...

CVE-2026-31309

CVE-2026-31309: Improper Access Control in Mysterium Node before v1.36.0 Improper authorization in the /tequilapi/config/user endpoint of Mysterium Node from v1.21.1-rc0 before v1.36.0 allows an unauthenticated attacker to arbitrarily overwrite the node's configuration and achieve a full node...

Linux Distros Unpatched Vulnerability : CVE-2026-16301

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain...

Linux Distros Unpatched Vulnerability : CVE-2026-5954

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain...

CVE-2026-111900: Incorrect Authorization

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an improper authorization vulnerability in attachment.php that fails to verify whether an attachment's parent FAQ is published or visible to the requester. Authenticated users with the dlattachment permission can request...

Linux Distros Unpatched Vulnerability : CVE-2026-103549

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain...

CVE-2026-17068 IBM i is Affected By Improper Authorization and Access Control Vulnerabilities in Network File System

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to bypass NFS version restrictions due to improper enforcement of the export version flag...