91285 matches found
GO-2026-6745 Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2.6.0) in code.vikunja.io/api
Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission broken access control / privilege-management regression in v2.6.0 in code.vikunja.io/api...
GO-2026-6758 Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover in code.vikunja.io/api
Vikunja: OIDC email-fallback account linking ignores emailverified, enabling local-account takeover in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positi...
GO-2026-6721 Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited in code.vikunja.io/api
Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causin...
CVE-2026-53995 MLflow 3.17.1 and prior Path Traversal via Trace ID API
MLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileStore tracking backend that allows unauthenticated attackers to control filesystem paths by submitting a crafted trace ID containing traversal sequences to the POST /api/3.0/mlflow/traces endpoint. Attackers can exploit...
CVE-2026-53995
MLflow versions 3.17.1 and earlier are vulnerable to a path traversal vulnerability in the FileStore tracking backend. An unauthenticated remote attacker can submit a crafted trace ID containing traversal sequences (e.g., ../) to the POST /api/3.0/mlflow/traces endpoint. By exploiting FileStore.s...
CVE-2026-53995 MLflow 3.17.1 and prior Path Traversal via Trace ID API
MLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileStore tracking backend that allows unauthenticated attackers to control filesystem paths by submitting a crafted trace ID containing traversal sequences to the POST /api/3.0/mlflow/traces endpoint. Attackers can exploit...
CVE-2026-53995
MLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileStore tracking backend that allows unauthenticated attackers to control filesystem paths by submitting a crafted trace ID containing traversal sequences to the POST /api/3.0/mlflow/traces endpoint. Attackers can exploit...
CVE-2026-53995 MLflow 3.17.1 and prior Path Traversal via Trace ID API
MLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileStore tracking backend that allows unauthenticated attackers to control filesystem paths by submitting a crafted trace ID containing traversal sequences to the POST /api/3.0/mlflow/traces endpoint. Attackers can exploit...
CVE-2026-112779
Grav API plugin grav-plugin-api 1.0.40 before 1.0.42 caches a full translation dictionary for every well-formed language code sent to the unauthenticated GET /api/v1/translations/lang endpoint, and 1.0.16 before 1.0.42 fails to check target and destination page rules in the sync and batch copy...
CVE-2026-112297
A flaw has been found in ptbsare anx-calibre-manager up to 1.13.12. The impacted element is the function LLMClient.chat of the file blueprints/api/llm.py of the component LLM Configuration Handler. This manipulation of the argument baseurl causes server-side request forgery. The attack can be...
EUVD-2026-104594
A flaw has been found in ptbsare anx-calibre-manager up to 1.13.12. The impacted element is the function LLMClient.chat of the file blueprints/api/llm.py of the component LLM Configuration Handler. This manipulation of the argument baseurl causes server-side request forgery. The attack can be...
CVE-2026-112297
A server-side request forgery (SSRF) vulnerability exists in ptbsare anx-calibre-manager versions up to 1.13.12 . The flaw is located within the LLM Configuration Handler component, specifically in the LLMClient.chat function of the file blueprints/api/llm.py. An attacker can remotely initiate th...
CVE-2026-112297 ptbsare anx-calibre-manager LLM Configuration llm.py LLMClient.chat server-side request forgery
A flaw has been found in ptbsare anx-calibre-manager up to 1.13.12. The impacted element is the function LLMClient.chat of the file blueprints/api/llm.py of the component LLM Configuration Handler. This manipulation of the argument baseurl causes server-side request forgery. The attack can be...
CVE-2026-73804
A flaw was found in Gitea. An authenticated attacker with a restricted user-level Application Programming Interface API token can achieve privilege escalation by registering an arbitrary Secure Shell SSH public key to the account. Subsequent API requests signed with the corresponding private key...
CVE-2026-109434
Fenrir Sleipnir Browser for Android before 3.9.0 contains a UI spoofing vulnerability that allows remote attackers to impersonate the browser's trusted address bar by entering fullscreen mode via the Fullscreen API without displaying a persistent notification or trusted-origin indicator. Attacker...
CVE-2026-109437
Cognition before 0.13.0 contains an unauthenticated remote code execution vulnerability due to defaulting its agent sandbox backend to local execution and shipping no authentication on its REST/SSE API. Attackers can create a session via POST /sessions and post a message via POST...
CVE-2026-112779 Grav API Plugin before 1.0.42 Cache Exhaustion and Page Permission Bypass
Grav API plugin grav-plugin-api 1.0.40 before 1.0.42 caches a full translation dictionary for every well-formed language code sent to the unauthenticated GET /api/v1/translations/lang endpoint, and 1.0.16 before 1.0.42 fails to check target and destination page rules in the sync and batch copy...
EUVD-2026-104585
Grav API plugin grav-plugin-api 1.0.40 before 1.0.42 caches a full translation dictionary for every well-formed language code sent to the unauthenticated GET /api/v1/translations/lang endpoint, and 1.0.16 before 1.0.42 fails to check target and destination page rules in the sync and batch copy...
CVE-2026-112779
The Grav API plugin (grav-plugin-api) versions 1.0.40 before 1.0.42 contains a vulnerability where the unauthenticated GET /api/v1/translations/{lang} endpoint caches a full translation dictionary for every well-formed language code. Unauthenticated attackers can exploit this via small requests t...
CVE-2026-112779
Grav API plugin grav-plugin-api 1.0.40 before 1.0.42 caches a full translation dictionary for every well-formed language code sent to the unauthenticated GET /api/v1/translations/lang endpoint, and 1.0.16 before 1.0.42 fails to check target and destination page rules in the sync and batch copy...