CVE-2026-105814 Order-Dependent Authentication Bypass in the DS JSON API in TP-Link Tapo C210

TP-Link Tapo C210 V3.60 contains an authentication bypass vulnerability in the DS JSON API. A crafted JSON request containing both a protected operation and public onboarding-related fields may cause module-level authorization checks to be applied inconsistently, allowing protected camera...

CVE-2026-105814 Order-Dependent Authentication Bypass in the DS JSON API in TP-Link Tapo C210

TP-Link Tapo C210 V3.60 contains an authentication bypass vulnerability in the DS JSON API. A crafted JSON request containing both a protected operation and public onboarding-related fields may cause module-level authorization checks to be applied inconsistently, allowing protected camera...

CVE-2026-105814

The TP-Link Tapo C210 (V3.60) contains an authentication bypass vulnerability within the DS JSON API . The root cause is an order-dependent flaw where a crafted JSON request combining a protected operation with public onboarding-related fields causes inconsistent module-level authorization checks...

GO-2026-6722 Vikunja: TOTP secret is readable after enrollment, no step-up auth in code.vikunja.io/api

Vikunja: TOTP secret is readable after enrollment, no step-up auth in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...

GO-2026-6726 Vikunja: API token scopes bypassed via task expand parameter (comments, reactions, time entry counts) in code.vikunja.io/api

Vikunja: API token scopes bypassed via task expand parameter comments, reactions, time entry counts in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positi...

GO-2026-6753 Vikunja: Link-share principal ID collision allows cross-account API token issuance and management in code.vikunja.io/api

Vikunja: Link-share principal ID collision allows cross-account API token issuance and management in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...

GO-2026-6752 Vikunja: Link-share token can enumerate users through the v2 API in code.vikunja.io/api

Vikunja: Link-share token can enumerate users through the v2 API in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...

GO-2026-6721 Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited in code.vikunja.io/api

Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causin...

GO-2026-6758 Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover in code.vikunja.io/api

Vikunja: OIDC email-fallback account linking ignores emailverified, enabling local-account takeover in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positi...

GO-2026-6749 Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA) in code.vikunja.io/api

Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide BOLA in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

GO-2026-6747 Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to the share's permission level in code.vikunja.io/api

Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint v1 and v2 and escalate to the share's permission level in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mappe...

GO-2026-6714 Vikunja: Cross-project task disclosure through subtask expansion in code.vikunja.io/api

Vikunja: Cross-project task disclosure through subtask expansion in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...

GO-2026-6731 Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants in code.vikunja.io/api

Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

GO-2026-6750 Vikunja: Scoped API token can mint unrestricted OAuth session credentials in code.vikunja.io/api

Vikunja: Scoped API token can mint unrestricted OAuth session credentials in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

GO-2026-6730 Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check in code.vikunja.io/api

Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

GO-2026-6745 Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2.6.0) in code.vikunja.io/api

Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission broken access control / privilege-management regression in v2.6.0 in code.vikunja.io/api...

GO-2026-6732 Vikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UID in code.vikunja.io/api

Vikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UID in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If thi...

GO-2026-6748 Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access in code.vikunja.io/api

Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is...

CVE-2026-53995

MLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileStore tracking backend that allows unauthenticated attackers to control filesystem paths by submitting a crafted trace ID containing traversal sequences to the POST /api/3.0/mlflow/traces endpoint. Attackers can exploit...

CVE-2026-53995 MLflow 3.17.1 and prior Path Traversal via Trace ID API

MLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileStore tracking backend that allows unauthenticated attackers to control filesystem paths by submitting a crafted trace ID containing traversal sequences to the POST /api/3.0/mlflow/traces endpoint. Attackers can exploit...