CVE-2026-34727

Vikunja

CVE-2026-34727 Vikunja ahs a TOTP Two-Factor Authentication Bypass via OIDC Login Path

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the OIDC callback handler issues a full JWT token without checking whether the matched user has TOTP two-factor authentication enabled. When a local user with TOTP enrolled is matched via the OIDC email fallback...

Brute Force

Overview Affected versions of this package are vulnerable to Brute Force due to improper enforcement of authentication lockout in the login process. An attacker can gain unauthorized access to accounts protected by two-factor authentication by repeatedly submitting incorrect TOTP codes without...

GHSA-FGFV-PV97-6CMJ Vikunja Vulnerable to TOTP Brute-Force Due to Non-Functional Account Lockout

Summary The TOTP failed-attempt lockout mechanism is non-functional due to a database transaction handling bug. The account lock is written to the same database session that the login handler always rolls back on TOTP failure, so the lockout is triggered but never persisted. This allows unlimited...

EUVD-2026-21422

Vikunja Vulnerable to TOTP Brute-Force Due to Non-Functional Account Lockout...

Vikunja Vulnerable to TOTP Brute-Force Due to Non-Functional Account Lockout

Summary The TOTP failed-attempt lockout mechanism is non-functional due to a database transaction handling bug. The account lock is written to the same database session that the login handler always rolls back on TOTP failure, so the lockout is triggered but never persisted. This allows unlimited...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication in the OIDC login process when the EmailFallback mechanism is enabled. An attacker can gain unauthorized access to accounts protected by TOTP by authenticating to the OIDC provider with a matching email address,...

EUVD-2026-21414

Vikunja has TOTP Two-Factor Authentication Bypass via OIDC Login Path...

GHSA-8JVC-MCX6-R4CG Vikunja has TOTP Two-Factor Authentication Bypass via OIDC Login Path

Summary The OIDC callback handler issues a full JWT token without checking whether the matched user has TOTP two-factor authentication enabled. When a local user with TOTP enrolled is matched via the OIDC email fallback mechanism, the second factor is completely skipped. Details The OIDC callback...

GHSA-W5FQ-8965-C969

creationtimestamp| type| source ---|---|--- 2026-04-10 15:17:16+00:00| seen| Telegram/lguE38htKCDsrEIHzbRJLgqsKSDV6aHHtfYRxKZkwP2V8...

js-yaml: js-yaml: Denial of Service via quadratic CPU time parsing with merge keys

A flaw was found in js-yaml, a JavaScript YAML parser and dumper. When merge keys are enabled, a remote attacker could exploit this vulnerability by crafting a YAML document where a chain of mappings uses merge keys, each merging the previous one. This can lead to a significant increase in CPU ti...

Malicious code in noonhelpers (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c2cb54ce39fd435f904d72dbbb5eef46166291adcd5106ea8d74d3c3c66aa3a5 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

CVE-2026-6042

creationtimestamp| type| source ---|---|--- 2026-04-10 10:29:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj54hqcl4425 2026-04-14 15:00:05+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/80269 2026-04-14 19:00:09+00:00| published-proof-of-concept|...

CVE-2026-6032

creationtimestamp| type| source ---|---|--- 2026-04-10 10:20:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj53xh4xkf2n...

CVE-2026-40212

creationtimestamp| type| source ---|---|--- 2026-04-10 10:09:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj53dzfqnr2q...

CVE-2026-5912

An integer overflow flaw was found in the WebRTC component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=486498791...

CVE-2026-5477

creationtimestamp| type| source ---|---|--- 2026-04-10 06:07:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj4nssm7jw2d 2026-04-10 07:17:18+00:00| seen| Telegram/XhYu4mFc-5em62dyPX2z20yH7qSW9mAMzHMEdwTQTYW2M...

Security Bulletin: Segmentation Fault Vulnerability in Rust time crate on Unix Systems (v0.2.7–v0.2.22) affects watsonx.data

Summary A vulnerability in the Rust time crate v0.2.7–v0.2.22 can cause segmentation faults on Unix-like systems when environment variables are set from a different thread. Windows and WebAssembly targets are unaffected. This can affect watsonx.data. Vulnerability Details CVEID:CVE-2020-26235...

CVE-2026-6013

The CVE-2026-6013 entry describes a buffer overflow in D-Link DIR-513 v1.10 affecting the POST Request Handler’s formSetRoute (/goform/formSetRoute). The vulnerable function mishandles the curTime argument, enabling a remote attacker to trigger a buffer overflow. Exploitation is described as publ...

CVE-2026-1263

creationtimestamp| type| source ---|---|--- 2026-04-10 02:19:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj4b2zhaul24 2026-04-19 17:33:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mjuidmaf7l2c...