EUVD-2026-119386

Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory through concurrent image decodes in avatar and background uploads. Attackers can send several parallel tiny, highly compressible PNGs decoded at up to 50...

CVE-2026-123501 Vikunja before 2.7.1 Memory Exhaustion DoS via Unbounded Image Decodes

Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory through concurrent image decodes in avatar and background uploads. Attackers can send several parallel tiny, highly compressible PNGs decoded at up to 50...

CVE-2026-123501

Vikunja versions before 2.7.1 are vulnerable to an uncontrolled resource consumption flaw during avatar and background uploads. An authenticated user can trigger a Memory Exhaustion Denial of Service (DoS) by sending multiple parallel, highly compressible PNG images that decode to sizes up to 50 ...

CVE-2026-123501: go-vikunja vikunja: Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated users to…

Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory through concurrent image decodes in avatar and background uploads. Attackers can send several parallel tiny, highly compressible PNGs decoded at up to 50...

PT-2026-139782

Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory through concurrent image decodes in avatar and background uploads. Attackers can send several parallel tiny, highly compressible PNGs decoded at up to 50...

Denial-of-service (DoS)

code.vikunja.io/api is vulnerable to a denial-of-service DoS. The vulnerability is due to missing pixel count restrictions on avatar and project-background uploads, which allows an authenticated attacker to upload crafted images with extreme aspect ratios that consume excessive CPU and memory,...

CVE-2026-25728 ClipBucket v5 Affected by Remote Code Execution via Avatar/Background File Upload Race Condition

ClipBucket v5 is an open source video sharing platform. Prior to 5.5.3 - 40, a Time-of-Check to Time-of-Use TOCTOU race condition vulnerability exists in ClipBucket's avatar and background image upload functionality. The application moves uploaded files to a web-accessible location before...

ClipBucket security vulnerability

ClipBucket is an open-source PHP script developed by MacWarrior. It is available for free download and used to host video websites. Versions of ClipBucket prior to 5.5.3 – version 40 – contained a security vulnerability. This vulnerability stemmed from a race condition in the upload function for...