52615 matches found
CVE-2026-40103 Vikunja's Scoped API tokens with projects.background permission can delete project backgrounds
Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, Vikunja's scoped API token enforcement for custom project background routes is method-confused. A token with only projects.background can successfully delete a project background, while a token with only...
CVE-2026-40103
Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, Vikunja's scoped API token enforcement for custom project background routes is method-confused. A token with only projects.background can successfully delete a project background, while a token with only...
CVE-2026-35599
Summary: CVE-2026-35599 affects Vikunja prior to version 2.3.0, where addRepeatIntervalToTime uses an O(n) loop to advance a date by RepeatAfter until it passes now. When a repeating task uses a 1-second interval and an old due_date, this can trigger billions of iterations, causing high CPU usage...
CVE-2026-35599 Vikunja has an Algorithmic Complexity DoS in Repeating Task Handler
Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the addRepeatIntervalToTime function uses an On loop that advances a date by the task's RepeatAfter duration until it exceeds the current time. By creating a repeating task with a 1-second interval and a due date far ...
CVE-2026-35598 Vikunja has Missing Authorization on CalDAV Task Read
Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the CalDAV GetResource and GetResourcesByList methods fetch tasks by UID from the database without verifying that the authenticated user has access to the task's project. Any authenticated CalDAV user who knows or...
EUVD-2026-21388
Cross Site Scripting vulnerability in Altenar Sportsbook Software Platform SB2 v.2.0 allows a remote attacker to obtain sensitive information and execute arbitrary code via the URL parameter...
CVE-2026-40227
In systemd 260 before 261, a local unprivileged user can trigger an assert via an IPC API call with an array or map that has a null element...
CVE-2026-31262
Cross Site Scripting vulnerability in Altenar Sportsbook Software Platform SB2 v.2.0 allows a remote attacker to obtain sensitive information and execute arbitrary code via the URL parameter...
GHSA-3P68-RC4W-QGX5 vulnerabilities
Vulnerabilities for packages: kubeflow-pipelines, kubeflow-katib, opensearch-dashboards, langfuse, jitsucom-jitsu, kubeflow-centraldashboard, nextcloud-server, prism, lerna, saf...
golang: cmd/compile: no-op interface conversion bypasses overlap checking
A flaw was found in the cmd/compile package in the Go standard library. A no-op interface conversion prevented the compiler from correctly identifying non-overlapping memory moves. As a result, the compiler allows unsafe memory move operations to occur at runtime, potentially causing data...
GHSA-3P68-RC4W-QGX5 vulnerabilities
Vulnerabilities for packages: opensearch-dashboards-fips, arangodb, librechat, nextcloud-server, redisinsight, gitlab-rails-ce, saf, prism, kibana, lerna, langfuse-fips, kubeflow-pipelines, kubeflow-katib, wazuh-dashboard, jitsucom-jitsu, awx, kubeflow-centraldashboard, opensearch-dashboards,...
RHSA-2026:6552 Red Hat Security Advisory: OpenShift Container Platform 4.18.37 packages and security update
Bulletin has no description...
RHSA-2026:1249 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
Bulletin has no description...
WordPress ProSolution WP Client plugin <= 1.9.9 - Unauthenticated Arbitrary File Upload via proSol_fileUploadProcess vulnerability
Unauthenticated Arbitrary File Upload via proSolfileUploadProcess vulnerability discovered by Nabil Irawan - Heroes Cyber Security in WordPress Plugin ProSolution WP Client versions = 1.9.9...
Security Bulletin: Platform Navigator in IBM Cloud Pak for Integration is vulnerable to vulnerability in python_multipart
Summary Platform Navigator in IBM Cloud Pak for Integration is vulnerable to vulnerability in pythonmultipart. CVE-2026-24486 vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-24486 DESCRIPTION: Python-Multipart is a streaming multipart parser for Python. Prior to version...
CVE-2026-5500
wolfSSL's wcPKCS7DecodeAuthEnvelopedData does not properly sanitize the AES-GCM authentication tag length received and has no lower bounds check. A man-in-the-middle can therefore truncate the mac field from 16 bytes to 1 byte, reducing the tag check from 2⁻¹²⁸ to 2⁻⁸...
GHSA-3MWP-WVH9-7528 vulnerabilities
Vulnerabilities for packages: vllm-openai-cuda-12.9, py3-vllm-cuda-12.4, tritonserver-backend-vllm-cuda-13.0...
GHSA-43RW-359F-4H89 vulnerabilities
Vulnerabilities for packages: python...