CVE-2026-55511

Yamcs is a mission control framework. In versions prior to 5.12.8 and 5.13.2 , an authenticated user holding the SystemPrivilege.ControlArchiving privilege can inject arbitrary Java into the StreamSQL aggregate expression compiler by crafting a malicious double-quoted column name. The column name...

GHSA-X8MJ-6P3Q-G5PP free5GC NRF nnrf-nfm lacks NF Profile input validation — enables NF Registration Poisoning with arbitrary service endpoints

Summary free5GC NRF Docker image free5gc-fuzz:latest accepts NF registration requests without validating any field constraints against 3GPP TS 29.510, allowing unauthenticated attackers to inject fake NF profiles with arbitrary service endpoint IP addresses. All 17 constraint violations tested UU...

free5GC NRF nnrf-nfm lacks NF Profile input validation — enables NF Registration Poisoning with arbitrary service endpoints

Summary free5GC NRF Docker image free5gc-fuzz:latest accepts NF registration requests without validating any field constraints against 3GPP TS 29.510, allowing unauthenticated attackers to inject fake NF profiles with arbitrary service endpoint IP addresses. All 17 constraint violations tested UU...

EUVD-2026-67835

free5GC is an open-source implementation of the 5G core network. In 4.2.2 and earlier, the NRF RegisterNFInstance handler at PUT /nnrf-nfm/v1/nf-instances/nfInstanceID accepts NF Profiles without enforcing UUID format, nfStatus enum values, heartBeatTimer ranges, mandatory profile fields, or...

CVE-2026-55068 free5GC: NRF nnrf-nfm lacks NF Profile input validation — enables NF Registration Poisoning with arbitrary service endpoints

free5GC is an open-source implementation of the 5G core network. In 4.2.2 and earlier, the NRF RegisterNFInstance handler at PUT /nnrf-nfm/v1/nf-instances/nfInstanceID accepts NF Profiles without enforcing UUID format, nfStatus enum values, heartBeatTimer ranges, mandatory profile fields, or...

CVE-2026-55068 free5GC: NRF nnrf-nfm lacks NF Profile input validation — enables NF Registration Poisoning with arbitrary service endpoints

free5GC is an open-source implementation of the 5G core network. In 4.2.2 and earlier, the NRF RegisterNFInstance handler at PUT /nnrf-nfm/v1/nf-instances/nfInstanceID accepts NF Profiles without enforcing UUID format, nfStatus enum values, heartBeatTimer ranges, mandatory profile fields, or...

CVE-2026-55068

free5GC (open-source 5G core network) version 4.2.2 and earlier is vulnerable to NF Registration Poisoning in the NRF component. The RegisterNFInstance handler (PUT /nnrf-nfm/v1/nf-instances/{nfInstanceID}) accepts NF profile bodies without enforcing 3GPP TS 29.510 constraints for UUID format, nf...

GHSA-569V-Q83C-3J3G Vikunja vulnerable to authenticated cross-tenant kanban-bucket relocation via `project_view_id` mass-assignment

Summary POST /api/v1/projects/project/views/view/buckets/bucket mass-assigns the request body's projectviewid onto the bucket row. The permission check only verifies that the URL-supplied bucket already belongs to the URL-supplied project, view pair; the body's projectviewid is never validated. A...

Vikunja vulnerable to authenticated cross-tenant kanban-bucket relocation via `project_view_id` mass-assignment

Summary POST /api/v1/projects/project/views/view/buckets/bucket mass-assigns the request body's projectviewid onto the bucket row. The permission check only verifies that the URL-supplied bucket already belongs to the URL-supplied project, view pair; the body's projectviewid is never validated. A...

CVE-2026-55067 Vikunja: Authenticated cross-tenant kanban-bucket relocation via `project_view_id` mass-assignment

Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/project/views/view/buckets/bucket allows the request body projectviewid value to be mass assigned by Bucket.Update in pkg/models/kanban.go. The permission check validates that the bucket currentl...

CVE-2026-55067 Vikunja: Authenticated cross-tenant kanban-bucket relocation via `project_view_id` mass-assignment

Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/project/views/view/buckets/bucket allows the request body projectviewid value to be mass assigned by Bucket.Update in pkg/models/kanban.go. The permission check validates that the bucket currentl...

CVE-2026-55067 Vikunja: Authenticated cross-tenant kanban-bucket relocation via `project_view_id` mass-assignment

Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/project/views/view/buckets/bucket allows the request body projectviewid value to be mass assigned by Bucket.Update in pkg/models/kanban.go. The permission check validates that the bucket currentl...

CVE-2026-55067

Vikunja , an open-source self-hosted task management platform, is affected by a cross-tenant mass-assignment flaw prior to 2.4.0 . In pkg/models/kanban.go, the Bucket.Update function writes the request body's project_view_id without validating the destination view; the permission check only confi...

EUVD-2026-67834

Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/project/views/view/buckets/bucket allows the request body projectviewid value to be mass assigned by Bucket.Update in pkg/models/kanban.go. The permission check validates that the bucket currentl...

Vikunja has cross-tenant IDOR in kanban move-task endpoint via unauthorized body task_id

Summary The kanban endpoint POST /api/v1/projects/project/views/view/buckets/bucket/tasks moves a task into a bucket. The task is identified by taskid in the request body. The endpoint's authorization check TaskBucket.CanUpdate only verifies that the caller may update the project/view/bucket name...

GHSA-5PG6-M483-7VRG Vikunja has cross-tenant IDOR in kanban move-task endpoint via unauthorized body task_id

Summary The kanban endpoint POST /api/v1/projects/project/views/view/buckets/bucket/tasks moves a task into a bucket. The task is identified by taskid in the request body. The endpoint's authorization check TaskBucket.CanUpdate only verifies that the caller may update the project/view/bucket name...

CVE-2026-55066

Vikunja (open-source self-hosted task management) has a cross-tenant IDOR in the kanban move-task endpoint. The task_id field is attacker-controlled via the request body, yet TaskBucket.CanUpdate only authorizes the project/view/bucket from the URL — never the task itself. Because Task.ReadOne pe...

CVE-2026-55066 Vikunja: Cross-tenant IDOR in kanban move-task endpoint via unauthorized body task_id

Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/project/views/view/buckets/bucket/tasks accepts a body supplied taskid but TaskBucket.CanUpdate in pkg/models/kanbantaskbucket.go authorizes only the project, view, and bucket from the URL...

EUVD-2026-67833

Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/project/views/view/buckets/bucket/tasks accepts a body supplied taskid but TaskBucket.CanUpdate in pkg/models/kanbantaskbucket.go authorizes only the project, view, and bucket from the URL...

CVE-2026-55066 Vikunja: Cross-tenant IDOR in kanban move-task endpoint via unauthorized body task_id

Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/project/views/view/buckets/bucket/tasks accepts a body supplied taskid but TaskBucket.CanUpdate in pkg/models/kanbantaskbucket.go authorizes only the project, view, and bucket from the URL...