CVE-2026-91980

vikunja before 2.6.0 contains an authorization flaw in the project teams endpoint: when attaching teams to projects, the application fails to validate whether the requesting user has access to the target team. An authenticated user can supply arbitrary team IDs via this endpoint to retrieve compl...

CVE-2026-91968 vikunja before 2.6.0 Denial of Service via unbounded filter recursion

vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the task-filter endpoint that accepts deeply nested filter expressions without recursion depth limits. Authenticated attackers can supply thousands of nested parentheses in the filter query parameter to exhaust memory an...

CVE-2026-91968 vikunja before 2.6.0 Denial of Service via unbounded filter recursion

vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the task-filter endpoint that accepts deeply nested filter expressions without recursion depth limits. Authenticated attackers can supply thousands of nested parentheses in the filter query parameter to exhaust memory an...

CVE-2026-91968 vikunja before 2.6.0 Denial of Service via unbounded filter recursion

vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the task-filter endpoint that accepts deeply nested filter expressions without recursion depth limits. Authenticated attackers can supply thousands of nested parentheses in the filter query parameter to exhaust memory an...

CVE-2026-88617

SmartAdmin v3.30.0 contains an authorization flaw in the configuration query endpoint. This allows a remote attacker to escalate privileges...

EUVD-2026-78785

ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the fix for CVE-2026-44221 added an UPDATESCHEMA authorization check only to LocalDocumentType.createProperty, while the remaining public schema mutators in engine/src/main/java/com/arcadedb/schema/LocalDocumentType.java and...

CVE-2026-47780 free5GC: UDR Improper ueId validation in free5GC EE subscription handlers allows arbitrary identifier persistence

free5GC is an open-source implementation of the 5G core network. In 4.2.3 and earlier, HandleCreateEeSubscriptions and HandleQueryeesubscriptions in free5gc/udr internal/sbi/apidatarepository.go validate the ueId path value with a regular expression whose final .+ alternative accepts every...

CVE-2026-91994

Semaphore UI through 2.19.12 exempts GET and HEAD requests from project resource permission checks in GetMustCanMiddleware. Attackers with guest or taskrunner roles can read all project environments including plaintext secrets, credentials, and passwords via GET requests to the environment endpoi...

CVE-2026-91997 evolution-api through 2.3.7 Prometheus Metrics IP Allowlist Bypass

evolution-api through 2.3.7 contains an incorrect array comparison in the metricsIPWhitelist middleware that always evaluates to false, allowing unauthenticated access to the /metrics endpoint. Attackers can bypass IP whitelist restrictions to access sensitive metrics disclosing server version,...

CVE-2026-91993 Jpom through 2.11.12 Workspace Isolation Bypass via /build/branch-list

Jpom through 2.11.12 fails to validate workspace ownership when resolving repositoryId on the /build/branch-list endpoint, allowing authenticated users to access repositories from other workspaces. Attackers can submit repository identifiers from different workspaces to enumerate repository...

CVE-2026-91923

KubeSphere through 4.1.3 contains a server-side request forgery vulnerability in the git credential verification endpoint that accepts unvalidated caller-supplied URLs without allowlist restrictions. Authenticated attackers can supply arbitrary URLs to reach internal services and exfiltrate...

CVE-2026-52819

Kimai is an open-source time tracking application. Prior to 2.57.0, the GET /api/timesheets list endpoint accepts user and users target identifiers from a caller with viewothertimesheet but does not apply accessuser or verify that a ROLETEAMLEAD requester leads a team containing each target user...

EUVD-2026-78414

KubeSphere through 4.1.3 contains a server-side request forgery vulnerability in the git credential verification endpoint that accepts unvalidated caller-supplied URLs without allowlist restrictions. Authenticated attackers can supply arbitrary URLs to reach internal services and exfiltrate...

CVE-2026-91923

KubeSphere through 4.1.3 is affected by a server-side request forgery (SSRF) vulnerability in its git credential verification endpoint . The endpoint accepts caller-supplied URLs without allowlist restrictions, allowing authenticated attackers to direct requests to internal services and exfiltrat...

CVE-2026-91923 KubeSphere through 4.1.3 SSRF via git credential verification endpoint

KubeSphere through 4.1.3 contains a server-side request forgery vulnerability in the git credential verification endpoint that accepts unvalidated caller-supplied URLs without allowlist restrictions. Authenticated attackers can supply arbitrary URLs to reach internal services and exfiltrate...

CVE-2026-91923 KubeSphere through 4.1.3 SSRF via git credential verification endpoint

KubeSphere through 4.1.3 contains a server-side request forgery vulnerability in the git credential verification endpoint that accepts unvalidated caller-supplied URLs without allowlist restrictions. Authenticated attackers can supply arbitrary URLs to reach internal services and exfiltrate...

CVE-2026-91922 Steedos Platform through 3.0.15-beta.47 Reflected XSS via page render

Steedos Platform through 3.0.15-beta.47 contains a reflected cross-site scripting vulnerability in the anonymous /api/page/render endpoint that fails to properly escape query parameters in inline script elements. Attackers can craft malicious links with script-terminating sequences in the schemaA...

CVE-2026-52825 Kimai: Improper Authorization in Kimai Team Member and Team Activity Assignment APIs Allows Expansion of Team Scope Beyond Authorized Visibility

Kimai is an open-source time tracking application. Prior to 2.58.0, POST /api/teams/id/members/userId and POST /api/teams/id/activities/activityId verify that a teamlead may edit the Team but do not verify accessuser for the referenced User or view access for the referenced Activity. A teamlead c...

CVE-2026-52819 Kimai: Teamlead authorization bypass in GET /api/timesheets allows reading other users' timesheet records without being teamlead of the target

Kimai is an open-source time tracking application. Prior to 2.57.0, the GET /api/timesheets list endpoint accepts user and users target identifiers from a caller with viewothertimesheet but does not apply accessuser or verify that a ROLETEAMLEAD requester leads a team containing each target user...

grafana: Grafana: Denial of Service due to excessive memory allocation via large JSON payloads

A flaw was found in Grafana. An unauthenticated attacker can exploit the public dashboard query endpoint by sending arbitrarily large JSON payloads. This vulnerability, caused by a lack of request body size limits, triggers excessive memory allocation, leading to a denial of service through memor...