GeoSentinel

🌍 GeoSentinel GeoSentinel 是一个地理空间监控平台，可实时跟踪全球动向。 它将船舶和航班路线、实时坐标以及地理数据整合到一个统一系统中，为分析、可视化和决策提供清晰的地理和地缘政治洞察。 🚀 !TIP 🚀 访问博客（Geo Sentinel 更新与见解） 🌐 打开博客 🚀 官方网站 🌍 访问网站 🚀 官方网站 🌍 访问网站 !CAUTION 🚨 Geo Sentinel AI 更新 — 及时了解最新的 Geo Sentinel AI 版本和公告。 📝 在此订阅 🎥 视频教程 — 了解如何使用 Geo Sentinel AI 。 ▶️ 观看视频 🎥 视频教程 — Ge...

CVE-2025-68930

🔍 CVE-2025-68930 分析：Traccar 中的 WebSocket 劫持漏洞 CVE-2025-68930 暴露了 Traccar （开源 GPS 跟踪系统）中的一个 关键跨站 WebSocket 劫持漏洞（CSWSH） 。以下是关键详情： 🛡️ 漏洞详情 受影响端点 ：/api/socket 根本原因 ：WebSocket 握手期间 未对Origin 标头进行验证。 利用机制 ： 1. 攻击者诱骗已认证用户访问恶意网站。 2. 恶意网站利用用户的活跃会话（JSESSIONID）与 Traccar 服务器建立 WebSocket 连接。 3. 服务器 接受连接...

CVE-2026-52827 Kimai: Two-factor authentication bypass on the Kimai API

Kimai is an open-source time tracking application. Prior to 2.59.0, the KIMAISESSION cookie issued after password verification but before TOTP completion is accepted by every /api route because config/packages/security.yaml protects the API with ISAUTHENTICATED and...

CVE-2026-52822 Kimai: Improper Authorization in Kimai Timesheet Restart and Duplicate Allows New Timesheets After Project Access Revocation

Kimai is an open-source time tracking application. Prior to 2.58.0, PATCH /api/timesheets/id/restart, PATCH /api/timesheets/id/duplicate, and the web duplicate workflow can derive a new record from an owned historical timesheet after the user's access to its project or activity has been revoked...

CVE-2026-52826 Kimai: Improper Authorization in Kimai Project, Customer, and Activity Rate Edit Endpoints Allows Cross-Scope Rate Manipulation

Kimai is an open-source time tracking application. Prior to 2.57.0, GET or POST requests to /en/admin/project/id/rate/rate, /en/admin/customer/id/rate/rate, and /en/admin/activity/id/rate/rate independently resolve the authorized parent identifier and the attacker-selected child rate identifier...

CVE-2026-52825 Kimai: Improper Authorization in Kimai Team Member and Team Activity Assignment APIs Allows Expansion of Team Scope Beyond Authorized Visibility

Kimai is an open-source time tracking application. Prior to 2.58.0, POST /api/teams/id/members/userId and POST /api/teams/id/activities/activityId verify that a teamlead may edit the Team but do not verify accessuser for the referenced User or view access for the referenced Activity. A teamlead c...

CVE-2026-52821 Kimai: Improper Authorization in Kimai Activity Creation with Preset Project Allows Creation Under Unauthorized Projects

Kimai is an open-source time tracking application. Prior to 2.57.0, GET or POST requests to /en/admin/activity/create/project and /en/admin/project/create/customer require only the generic createactivity or createproject capability and do not verify edit access to the supplied Project or Customer...

CVE-2026-49992 Kimai: Login CSRF in Default Team Creation Endpoints Allows Unauthorized Team and Permission Structure Changes

Kimai is an open-source time tracking application. Versions prior to 2.58.0 contain authenticated cross-site request forgery issues in their default team creation shortcuts for projects, customers, and activities. These endpoints are exposed through GET routes and directly create or reuse a Team,...

CVE-2026-49865 Kimai has Server-Side Request Forgery in Invoice PDF Rendering via Markdown Image URLs

Kimai is an open-source time tracking application. Versions prior to 2.58.0 contain a server-side request forgery vulnerability in their invoice PDF preview and generation workflow. If an attacker can control Markdown content that is later rendered into an invoice PDF, such as Customer.invoiceTex...

EUVD-2026-76765

Kimai is an open-source time tracking application. Versions prior to 2.58.0 contain a server-side request forgery vulnerability in their invoice PDF preview and generation workflow. If an attacker can control Markdown content that is later rendered into an invoice PDF, such as Customer.invoiceTex...

CVE-2026-80202 Kimai before 2.56.0 Authorization Bypass via TimesheetVoter

Kimai before 2.56.0 does not enforce team-membership checks in TimesheetVoter::voteOnAttribute, which maps permissions only to owntimesheet or othertimesheet. As a result, any authenticated user with ROLETEAMLEAD or a role holding editothertimesheet/deleteothertimesheet can read, modify, and...

GHSA-4VPF-W7QV-5H3Q MantisBT: Injection of TIME_TRACKING and REMINDER Notes via REST and SOAP APIs

Unvalidated notetype Parameter in mcissueupdate SOAP Endpoint Allows creation of TIMETRACKING and REMINDER Notes. The SOAP path passes the user-supplied notetype integer directly to bugnoteadd without validating that the user is authorized to create that type of note. If the user's access level i...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization through the restart and duplicate processes. An attacker can continue to create new timesheet entries for projects they no longer have access to by leveraging historical timesheet records after their permissions ha...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass via the tracked-time list endpoint. An attacker can access time tracking information without proper authorization by sending crafted requests to this endpoint. Remediation Upgrade...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the tracked-time deletion process. An attacker can remove time tracking entries associated with issues they do not have permission to modify by specifying the time entry ID from anothe...

CVE-2026-42070

Mantis Bug Tracker MantisBT is an open source issue tracker. Prior to 2.28.2, the mcissueupdate function in MantisBT allows users having updatebugthreshold access UPDATER, with default settings to edit, change view state, and modify time tracking on bugnotes belonging to other users — bypassing t...

PT-2026-39890

Name of the Vulnerable Software and Affected Versions Mantis Bug Tracker MantisBT versions prior to 2.28.2 Description The mc issue update function allows users with update bug threshold access UPDATER to edit, change the view state, and modify time tracking on bugnotes belonging to other users...

CVE-2026-42279 solidtime: Time entry update endpoint allows cross-organization modification of a known time-entry UUID

solidtime is an open-source time-tracking app. In version 0.12.0, the PUT /api/v1/organizations/organization/time-entries/timeEntry API accepts a route-bound timeEntry from another organization when the caller has time-entries:update:all in the URL organization, allowing a known foreign time-entr...

kimai 安全漏洞

Kimai is a web-based, multi-user time tracking application developed by Kimai’s individual developers. Versions of Kimai from 2.27.0 to 2.54.0 contained security vulnerabilities. These vulnerabilities stemmed from the possibility for any ROLEUSER to create tags with formula strings as names using...

CVE-2026-42092

titra is an open source time tracking project. In version 0.99.52, the globalsettings Meteor publication returns all global settings without any admin or role check. Any authenticated user can subscribe via DDP and receive sensitive configuration fields such as googlesecret, openaiapikey, and...