EUVD-2026-21417

Vikunja: Link Share JWT tokens remain valid for 72 hours after share deletion or permission downgrade...

Insufficient Session Expiration

Overview Affected versions of this package are vulnerable to Insufficient Session Expiration due to the lack of server-side validation in the GetLinkShareFromClaims process. An attacker can retain unauthorized access to resources by using previously issued JWT tokens even after a link share is...

Vikunja: Link Share JWT tokens remain valid for 72 hours after share deletion or permission downgrade

Title Link Share JWT tokens remain valid for 72 hours after share deletion or permission downgrade Description Vikunja's link share authentication constructs authorization objects entirely from JWT claims without any server-side database validation. When a project owner deletes a link share or...

GHSA-8JVC-MCX6-R4CG Vikunja has TOTP Two-Factor Authentication Bypass via OIDC Login Path

Summary The OIDC callback handler issues a full JWT token without checking whether the matched user has TOTP two-factor authentication enabled. When a local user with TOTP enrolled is matched via the OIDC email fallback mechanism, the second factor is completely skipped. Details The OIDC callback...

GHSA-8F9R-GR6R-X63Q Duplicate Advisory: OpenClaw: Feishu webhook reads and parses unauthenticated request bodies before signature validation

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-3h52-cx59-c456. This link is maintained to preserve external references. Original Description OpenClaw before 2026.3.25 parses JSON request bodies before validating webhook signatures, allowing unauthenticated...

Duplicate Advisory: OpenClaw: Feishu webhook reads and parses unauthenticated request bodies before signature validation

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-3h52-cx59-c456. This link is maintained to preserve external references. Original Description OpenClaw before 2026.3.25 parses JSON request bodies before validating webhook signatures, allowing unauthenticated...

Vikunja 安全漏洞

Vikunja is an open-source to-do application developed by Vikunja developers. Versions of Vikunja prior to 2.3.0 contained security vulnerabilities. These vulnerabilities stemmed from the use of the Size field in JSON metadata at the file import endpoint for size checks, rather than the actual...

Important Photon OS Security Update - PHSA-2026-5.0-0816

Updates of 'rubygem-rdiscount', 'python3-PyJWT' packages of Photon OS have been released...

Saltcorn 路径遍历漏洞

Saltcorn is an open-source, scalable, code-free database application builder developed by Saltcorn. Versions of Saltcorn prior to 1.4.5, 1.5.5, and 1.6.0-beta.4 contained a path traversal vulnerability. This vulnerability stemmed from the POST /sync/offlinechanges endpoint, which allowed...

PT-2026-31944

Name of the Vulnerable Software and Affected Versions: Vikunja versions prior to 2.3.0 Description: A flaw exists in the OIDC callback handler where a full JWT token is issued without verifying TOTP two-factor authentication status for the matched user. Specifically, when a local user with TOTP...

MariaDB 11.4.1 < 11.4.10 DoS

The version of MariaDB installed on the remote host is prior to 11.4.10. It is, therefore, affected by a vulnerability as referenced in the GHSA-4rj5-2227-9wgc advisory. - MariaDB server is a community developed fork of MySQL server. An authenticated user can crash MariaDB versions 11.4 before...

PT-2026-31953

Name of the Vulnerable Software and Affected Versions: Vikunja versions prior to 2.3.0 Description: The Vikunja file import endpoint incorrectly uses the attacker-controlled Size field from the JSON metadata within an import zip file instead of the actual decompressed file content length for file...

Vikunja 授权问题漏洞

Vikunja is an open-source to-do application developed by Vikunja. Versions of Vikunja prior to 2.3.0 had an authorization vulnerability. This vulnerability stemmed from the OIDC callback handler, which issued full JWT tokens without checking whether the matching user had enabled TOTP two-factor...

PT-2026-31945

Name of the Vulnerable Software and Affected Versions Vikunja versions prior to 2.3.0 Description Vikunja's link share authentication constructs authorization objects entirely from JWT claims without server-side database validation. When a project owner deletes a link share or downgrades its...

PT-2026-33210

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.6.4 Description The '/api/av/removeUnusedAttributeView' endpoint constructs a filesystem path using the user-controlled id parameter without validation or path boundary enforcement. This allows an attacker to inject...

Apache Log4j 安全漏洞

Apache Log4j is an open-source logging tool based on Java, developed by the Apache Foundation in the United States. Versions of Apache Log4j JSON Template Layout 2.25.3 and earlier contain security vulnerabilities. These vulnerabilities arise from the JsonTemplateLayout generating invalid JSON...

Vikunja 代码问题漏洞

Vikunja is an open-source to-do application developed by Vikunja. Versions of Vikunja prior to 2.3.0 had code vulnerabilities. These vulnerabilities stemmed from the fact that link-sharing authentication was entirely based on JWT claims, without server-side database validation. As a result, delet...

PT-2026-31943

Name of the Vulnerable Software and Affected Versions Apache Log4j versions up to and including 2.25.3 Description Apache Log4j's JsonTemplateLayout generates invalid JSON output when processing log events that include non-finite floating-point values NaN, Infinity, or -Infinity, violating RFC 82...

MariaDB 11.4.0 < 11.4.10/ 11.8.0 < 11.8.6/ 12.2.0 < 12.2.2

The version of MariaDB installed on the remote host is prior to 11.4.10, 11.8.6, 12.2.2. It is, therefore, affected by a vulnerability as referenced in the GHSA-4rj5-2227-9wgc advisory. - MariaDB server is a community developed fork of MySQL server. An authenticated user can crash MariaDB version...

MariaDB 11.8.1 < 11.8.6 DoS

The version of MariaDB installed on the remote host is prior to 11.8.6. It is, therefore, affected by a vulnerability as referenced in the GHSA-4rj5-2227-9wgc advisory. - MariaDB server is a community developed fork of MySQL server. An authenticated user can crash MariaDB versions 11.4 before...