CVE-2026-35596

CVE-2026-35596 affects Vikunja prior to 2.3.0. The function hasAccessToLabel contains a SQL operator precedence bug in the label-permission query, causing any authenticated user to read any label that has at least one task, regardless of project access. This exposes label titles, descriptions, co...

CVE-2026-35596 Vikunja has Broken Access Control on Label Read via SQL Operator Precedence Bug

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the hasAccessToLabel function contains a SQL operator precedence bug that allows any authenticated user to read any label that has at least one task association, regardless of project access. Label titles, description...

CVE-2026-35594 Vikunja Link Share JWT tokens remain valid for 72 hours after share deletion or permission downgrade

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, Vikunja's link share authentication GetLinkShareFromClaims in pkg/models/linksharing.go constructs authorization objects entirely from JWT claims without any server-side database validation. When a project owner delet...

CVE-2026-35594 Vikunja Link Share JWT tokens remain valid for 72 hours after share deletion or permission downgrade

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, Vikunja's link share authentication GetLinkShareFromClaims in pkg/models/linksharing.go constructs authorization objects entirely from JWT claims without any server-side database validation. When a project owner delet...

CVE-2026-40021

Apache Log4net before version 3.3.0 contains a vulnerability in XmlLayout and XmlLayoutSchemaLog4J where characters forbidden by XML 1.0 are not sanitized in MDC keys/values and the identity field. The issue causes a serialization exception and silent loss of the affected log event, which can be ...

Brute Force

Overview Affected versions of this package are vulnerable to Brute Force due to improper enforcement of authentication lockout in the login process. An attacker can gain unauthorized access to accounts protected by two-factor authentication by repeatedly submitting incorrect TOTP codes without...

CVE-2026-5412

creationtimestamp| type| source ---|---|--- 2026-04-10 14:41:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj5kkkmro32q 2026-04-10 15:17:16+00:00| seen| Telegram/lguE38htKCDsrEIHzbRJLgqsKSDV6aHHtfYRxKZkwP2V8 2026-04-10 15:48:37+00:00| seen|...

CVE-2026-39972 vulnerabilities

Vulnerabilities for packages: frankenphp-8.2, frankenphp-8.4, frankenphp-8.3, frankenphp-8.5...

CVE-2025-58913

creationtimestamp| type| source ---|---|--- 2026-04-10 14:12:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj5iw4kwz72i 2026-04-10 15:17:16+00:00| seen| Telegram/lguE38htKCDsrEIHzbRJLgqsKSDV6aHHtfYRxKZkwP2V8 2026-04-10 15:50:59+00:00| seen|...

GHSA-5568-6QCG-G7FX Apache ActiveMQ: Denial of Service via Out of Memory vulnerability

Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ. ActiveMQ NIO SSL transports do not correctly handle TLSv1.3 handshake KeyUpdates triggered by clients. This makes it possible for a client to rapidly trigger updates which causes...

CVE-2026-39304

The Apache ActiveMQ messaging middleware (including Client and Broker components) is vulnerable to a Denial of Service (DoS) via Out of Memory (OOM) . The root cause is the incorrect handling of TLSv1.3 handshake KeyUpdates within the ActiveMQ NIO SSL transports . A malicious client can rapidly t...

CVE-2026-25203

creationtimestamp| type| source ---|---|--- 2026-04-10 02:35:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj4bydxyvs2i 2026-04-10 03:17:30+00:00| published-proof-of-concept| Telegram/Fvik4eX2xz-nzJuB7IaHT1kkv6IwgWipFYk1oHJ2HiAA0EI 2026-04-10 05:00:53+00:00| seen|...

CVE-2026-3360

creationtimestamp| type| source ---|---|--- 2026-04-10 02:30:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj4bpfiglp2n 2026-04-10 03:17:30+00:00| published-proof-of-concept| Telegram/Fvik4eX2xz-nzJuB7IaHT1kkv6IwgWipFYk1oHJ2HiAA0EI 2026-04-10 05:00:42+00:00| seen|...

GHSA-HWR4-MQ23-WCV5 vulnerabilities

Vulnerabilities for packages: frankenphp-8.2, frankenphp-8.4, frankenphp-8.3, frankenphp-8.5...

GHSA-W8RR-5GCM-PP58 vulnerabilities

Vulnerabilities for packages: dgraph, cert-manager-fips, flyte, ory-kratos-fips, weaviate, docker-cli-buildx-fips, loki, k6-operator-fips, kubo, gitlab-kas-fips, net-kourier-fips, prometheus-alertmanager-fips, grafana-alloy, ferretdb, splunk-otel-collector, knative-eventing-fips, kubo-fips,...

CVE-2026-1924 Aruba HiSpeed Cache <= 3.0.4 - Cross-Site Request Forgery to Plugin Settings Reset

The Aruba HiSpeed Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.4. This is due to missing nonce verification on the ahscajaxresetoptions function. This makes it possible for unauthenticated attackers to reset all plugin settings t...

CVE-2026-39625

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in kutethemes TechOne techone allows Code Injection.This issue affects TechOne: from n/a through = 3.0.3...

[SECURITY] Fedora 43 Update: doctl-1.154.0-1.fc43

The official command line interface for the DigitalOcean API...

[SECURITY] Fedora 43 Update: fido-device-onboard-0.5.5-8.fc43

A rust implementation of the FIDO Device Onboard Specification...

[SECURITY] Fedora 43 Update: libpng15-1.5.30-25.fc43

The libpng15 package provides libpng 1.5, an older version of the libpng. library for manipulating PNG Portable Network Graphics image format files. This version should be used only if you are unable to use the current version of libpng...