CVE-2026-89307

The "Firma Circolare" feature in the "Design Scuole Italia" WordPress theme allows an authenticated attacker to inject arbitrary HTML via the sign parameter, enabling forced redirection of visiting users to an attacker-controlled URL Stored HTML Injection / Open Redirect...

CVE-2026-19780 Koha Eval Code Injection Remote Code Execution Vulnerability

Koha Eval Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Koha. Authentication is required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP por...

Amazon-VPC-CNI-K8S input validation error vulnerability

Amazon-VPC-CNI-K8S versions prior to 1.14.0 to 1.22.4 have a vulnerability related to input validation errors. This vulnerability stems from improper verification of Pod identifiers. It may allow authenticated remote users to create Pod identifiers that conflict with existing ones, thereby...

CVE-2026-59965

Payload Plugins is a collection of plugins designed to enhance Payload CMS. In 0.7.0, @jhb.software/payload-alt-text-plugin exposes POST /api/alt-text-plugin/generate and POST /api/alt-text-plugin/bulk with a default guard that accepts any authenticated user, while...

WordPress Advanced Popups plugin <= 1.2.3 - Authenticated (Author+) Stored Cross-Site Scripting via 'Notification Button Link' Field vulnerability

Authenticated Author+ Stored Cross-Site Scripting via 'Notification Button Link' Field vulnerability discovered by Nguyen Cong Quang in WordPress Plugin Advanced Popups versions = 1.2.3...

EUVD-2026-78668

The "Firma Circolare" feature in the "Design Scuole Italia" WordPress theme allows an authenticated attacker to inject arbitrary HTML via the sign parameter, enabling forced redirection of visiting users to an attacker-controlled URL Stored HTML Injection / Open Redirect...

WordPress WP Directory Kit plugin <= 1.5.4 - Authenticated (Custom+) SQL Injection vulnerability

Authenticated Custom+ SQL Injection vulnerability discovered by adhikara13 in WordPress Plugin WP Directory Kit versions = 1.5.4...

CVE-2026-91980

vikunja before 2.6.0 fails to validate team access when attaching teams to projects, allowing authenticated users to enumerate all teams and members. Attackers can attach arbitrary team IDs via the project teams endpoint to retrieve complete team rosters including member names and admin flags for...

CVE-2026-91979 Vikunja before 2.6.0 Denial of Service via Decompression Bomb

Vikunja before 2.6.0 fails to limit archive expansion during data import, allowing authenticated users to cause denial of service. Attackers can upload highly compressed files that expand to tens of gigabytes in memory and disk, exhausting server resources and crashing the instance...

CVE-2026-91979 Vikunja before 2.6.0 Denial of Service via Decompression Bomb

Vikunja before 2.6.0 fails to limit archive expansion during data import, allowing authenticated users to cause denial of service. Attackers can upload highly compressed files that expand to tens of gigabytes in memory and disk, exhausting server resources and crashing the instance...

CVE-2026-91980 vikunja before 2.6.0 Team Enumeration via Project Share

vikunja before 2.6.0 fails to validate team access when attaching teams to projects, allowing authenticated users to enumerate all teams and members. Attackers can attach arbitrary team IDs via the project teams endpoint to retrieve complete team rosters including member names and admin flags for...

CVE-2026-91971 Vikunja before 2.6.0 Denial of Service via Avatar Upload

Vikunja before 2.6.0 fails to apply pixel decode limits to avatar and project-background upload endpoints, allowing authenticated users to upload crafted images that decode to excessive pixel counts. Attackers can upload small images with extreme aspect ratios that consume significant CPU and...

CVE-2026-91971 Vikunja before 2.6.0 Denial of Service via Avatar Upload

Vikunja before 2.6.0 fails to apply pixel decode limits to avatar and project-background upload endpoints, allowing authenticated users to upload crafted images that decode to excessive pixel counts. Attackers can upload small images with extreme aspect ratios that consume significant CPU and...

CVE-2026-91970 Vikunja before 2.6.0 Resource Exhaustion via Planka Migration

Vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the Planka migrator that fails to enforce aggregate memory budgets during migration jobs. Authenticated attackers can submit migration requests pointing to attacker-controlled servers advertising numerous size-compliant...

CVE-2026-91969

vikunja versions before 2.6.0 are affected by a resource exhaustion vulnerability in the POST /api/v2/migration/csv/migrate endpoint, which fails to limit the cardinality of parsed CSV rows. An authenticated attacker can upload a multipart CSV file containing millions of tiny records, exhausting ...

CVE-2026-91969

vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the POST /api/v2/migration/csv/migrate endpoint that fails to limit parsed row cardinality. Authenticated attackers can upload multipart CSV files with millions of tiny records to exhaust process memory and terminate the...

CVE-2026-91968

vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the task-filter endpoint that accepts deeply nested filter expressions without recursion depth limits. Authenticated attackers can supply thousands of nested parentheses in the filter query parameter to exhaust memory an...

CVE-2026-91967

AVideo through 29.0 contains a blind server-side request forgery vulnerability in the getHeaderContentTypeFromURL function that issues getheaders calls guarded only by format validation. Authenticated users with canUpload permission can store attacker-chosen URLs as video links, triggering...

EUVD-2026-78805

FreeRDP versions before 3.31.0 contain an out-of-bounds write vulnerability in server-side static virtual channel handling when CHANNELOPTIONSHOWPROTOCOL is enabled. Authenticated clients can queue oversized channel messages that cause buffer underflow and corrupt heap memory including live...

CVE-2026-91947

FreeRDP server versions before 3.31.0 contain a use-after-free vulnerability in the DRDYNVC parser , where a channel pointer is dereferenced after its synchronization lock is released. An authenticated client can trigger a heap-use-after-free by racing AUDIN channel closure messages against DRDYN...