CVE-2026-52821 Kimai: Improper Authorization in Kimai Activity Creation with Preset Project Allows Creation Under Unauthorized Projects

Kimai is an open-source time tracking application. Prior to 2.57.0, GET or POST requests to /en/admin/activity/create/project and /en/admin/project/create/customer require only the generic createactivity or createproject capability and do not verify edit access to the supplied Project or Customer...

CVE-2026-52821 Kimai: Improper Authorization in Kimai Activity Creation with Preset Project Allows Creation Under Unauthorized Projects

Kimai is an open-source time tracking application. Prior to 2.57.0, GET or POST requests to /en/admin/activity/create/project and /en/admin/project/create/customer require only the generic createactivity or createproject capability and do not verify edit access to the supplied Project or Customer...

CVE-2026-52820 Kimai: Timesheet PATCH/POST allows assigning to project outside user's team via query_builder OR-bypass

Kimai is an open-source time tracking application. Prior to 2.57.0, PATCH /api/timesheets/id and POST /api/timesheets accept a user-controlled project identifier through TimesheetApiEditForm and FormTrait, and ProjectRepository::getQueryBuilderForFormType places that identifier in an unconditiona...

CVE-2026-52820

Kimai , an open-source PHP/Symfony time-tracking application, is affected by an authorization bypass in the PATCH /api/timesheets/{id} and POST /api/timesheets endpoints (prior to 2.57.0 ). A user-supplied project ID is injected into ProjectRepository::getQueryBuilderForFormType(), where it appea...

CVE-2026-52820 Kimai: Timesheet PATCH/POST allows assigning to project outside user's team via query_builder OR-bypass

Kimai is an open-source time tracking application. Prior to 2.57.0, PATCH /api/timesheets/id and POST /api/timesheets accept a user-controlled project identifier through TimesheetApiEditForm and FormTrait, and ProjectRepository::getQueryBuilderForFormType places that identifier in an unconditiona...

EUVD-2026-78364

The WSO2 Integrator MI VS Code extension fails to properly sanitize or validate user-supplied input when processing Micro Integrator projects opened from untrusted sources. This allows a crafted project to inject and execute arbitrary operating system commands through the unit test execution flow...

CVE-2026-90878 vllm-project vLLM Jinja Template Rendering completions resource consumption

A vulnerability was determined in vllm-project vLLM up to 0.27.1. This affects an unknown part of the file /v1/chat/completions of the component Jinja Template Rendering. This manipulation of the argument chattemplate causes resource consumption. The attack can be initiated remotely. The exploit...

PT-2026-92675

Vulnerability in the Oracle Project Intelligence product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project...

PT-2026-92684

Vulnerability in the Oracle Project Intelligence product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project...

PT-2026-93184

Name of the Vulnerable Software and Affected Versions a2ui-project a2ui versions prior to 0.10.7 Description A remote attack can be launched against the Basic Catalog component due to inefficient regular expression complexity within an unknown function in the file renderers/web core/src/v0 9/basi...

PT-2026-92098

Name of the Vulnerable Software and Affected Versions Vikunja versions prior to 2.6.0 Description Authenticated attackers can insert task position rows into project views belonging to other tenants. This occurs because the application fails to validate that the user-supplied project view id in...

CVE-2026-92114: Inefficient Regular Expression Complexity

A vulnerability was identified in a2ui-project a2ui up to 0.10.6. Affected is an unknown function of the file renderers/webcore/src/v09/basiccatalog/functions/saferegex.ts of the component Basic Catalog. Such manipulation leads to inefficient regular expression complexity. The attack can be...

CVE-2026-88765: Improper Neutralization of Special Elements used in a Command

GitLab has remediated an issue in GitLab EE affecting all versions from 12.3 to 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 under certain conditions could allow an authenticated user to achieve remote code execution by importing a specially crafted Git project export to overflow the Unicod...

CVE-2026-91980: Exposure of Sensitive Information to an Unauthorized Actor

vikunja before 2.6.0 fails to validate team access when attaching teams to projects, allowing authenticated users to enumerate all teams and members. Attackers can attach arbitrary team IDs via the project teams endpoint to retrieve complete team rosters including member names and admin flags for...

CVE-2026-83161: Improper Access Control

Vulnerability in the Oracle Project Intelligence product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project...

CVE-2026-83152: Improper Access Control

Vulnerability in the Oracle Project Intelligence product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project...

PT-2026-92094

Name of the Vulnerable Software and Affected Versions vikunja versions prior to 2.6.0 Description Authenticated users can enumerate all teams and members because the software fails to validate team access when attaching teams to projects. By sending arbitrary team IDs to the project teams endpoin...

CVE-2026-91971: Uncontrolled Resource Consumption

Vikunja before 2.6.0 fails to apply pixel decode limits to avatar and project-background upload endpoints, allowing authenticated users to upload crafted images that decode to excessive pixel counts. Attackers can upload small images with extreme aspect ratios that consume significant CPU and...

EUVD-2026-78163

ZITADEL is an open source identity management platform. Prior to version 4.16.0, a bug in how ZITADEL updates permissions when multiple project roles are deleted at the same time can cause some user permissions to be missed. This issue specifically affects User Grants on Granted Projects projects...

DEBIAN-CVE-2026-47256

OpenTelemetry, also known as OTel, is a vendor-neutral open source Observability framework for instrumenting, generating, collecting, and exporting telemetry data such as traces, metrics, and logs. Prior to 0.154.0, the Sentry exporter reads the remote OTLP sender-controlled service.name resource...