D-Link - Unauthenticated Remote Code Execution

OS command injection vulnerability in soap.cgi soapcgimain in cgibin in D-Link DIR-880L DIR-880LREVAFIRMWAREPATCH1.08B04 and previous versions, DIR-868L DIR868LA1FW112b04 and previous versions, DIR-65L DIR-865LREVAFIRMWAREPATCH1.08.B01 and previous versions, and DIR-860L DIR860LA1FW110b04 and...

D-Link Central WifiManager - Server-Side Request Forgery

D-Link Central WifiManager is susceptible to server-side request forgery. The MailConnect feature on D-Link Central WiFiManager CWM-100 1.03 r0098 devices is intended to check a connection to an SMTP server but actually allows outbound TCP to any port on any IP address, as demonstrated by an...

D-Link NAS - Command Injection via Group Parameter

A vulnerability was found in D-Link DNS-320, DNS-320LW, DNS-325 and DNS-340L up to 20241028. It has been rated as critical. Affected by this issue is the function cgiuseradd of the file /cgi-bin/accountmgr.cgi?cmd=cgiuseradd. The manipulation of the argument group leads to os command injection. i...

CVE-2026-59650

creationtimestamp| type| source ---|---|--- 2026-08-03 01:36:16+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms5e6epot62u 2026-08-03 04:32:37+00:00| seen| https://infosec.exchange/users/offseq/statuses/117029694758734914 2026-08-03 20:56:04+00:00| seen|...

PT-2026-67454

Dell Monitor driver, version 1.0.0.0, contains an Improper Link Resolution Before File Access 'Link Following' vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges...

CVE-2026-32853

creationtimestamp| type| source ---|---|--- 2026-08-02 19:54:14+00:00| seen| https://bsky.app/profile/nixpkgssecuritychanges.gerbet.me/post/3ms4r6npegk2r...

CVE-2026-32854

creationtimestamp| type| source ---|---|--- 2026-08-02 19:54:14+00:00| seen| https://bsky.app/profile/nixpkgssecuritychanges.gerbet.me/post/3ms4r6npegk2r...

CVE-2026-12720

creationtimestamp| type| source ---|---|--- 2026-08-02 17:03:03+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ms4hir4mdm2t 2026-08-05 01:00:03+00:00| seen| Telegram/rJSqz12D-kpQyCOJVodGQ5YtXruuuT1BANzgPusZ6YAnQ 2026-08-06 00:01:00+00:00| published-proof-of-concept|...

CVE-2019-11683

creationtimestamp| type| source ---|---|--- 2026-08-02 17:00:05+00:00| seen| https://t.me/nuancesprognews/168 2026-08-03 01:51:30+00:00| seen| https://t.me/nuancesprognews/168...

CVE-2015-7326

creationtimestamp| type| source ---|---|--- 2026-08-02 14:45:13+00:00| seen| https://t.me/informationsec/185 2026-08-03 02:17:47+00:00| seen| https://t.me/informationsec/185...

CVE-2026-68582

creationtimestamp| type| source ---|---|--- 2026-08-02 13:30:24+00:00| seen| https://infosec.exchange/users/offseq/statuses/117026155660414417 2026-08-02 15:30:14+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3ms4cglffdo24...

CVE-2026-68581

Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs and link-share IDs are independent numeric sequences and both resolve through a generic web.Auth.GetID interface, a link-share JWT whose numeric ID equals a target user's ID is...

EUVD-2026-51992

Vikunja versions = 0.24.0 and = 2.3.0 contain a broken object level authorization BOLA vulnerability in the task-collection endpoint GET /api/v1/projects/project/views/view/tasks. The endpoint loads the requested project view from the URL path without verifying the caller is authorized for it. Fo...

CVE-2026-68582 Vikunja 0.24.0 Broken Object Level Authorization via Link-Share Token

Vikunja versions = 0.24.0 and = 2.3.0 contain a broken object level authorization BOLA vulnerability in the task-collection endpoint GET /api/v1/projects/project/views/view/tasks. The endpoint loads the requested project view from the URL path without verifying the caller is authorized for it. Fo...

CVE-2026-68582 Vikunja 0.24.0 Broken Object Level Authorization via Link-Share Token

Vikunja versions = 0.24.0 and = 2.3.0 contain a broken object level authorization BOLA vulnerability in the task-collection endpoint GET /api/v1/projects/project/views/view/tasks. The endpoint loads the requested project view from the URL path without verifying the caller is authorized for it. Fo...

CVE-2026-68582 Vikunja 0.24.0 Broken Object Level Authorization via Link-Share Token

Vikunja versions = 0.24.0 and = 2.3.0 contain a broken object level authorization BOLA vulnerability in the task-collection endpoint GET /api/v1/projects/project/views/view/tasks. The endpoint loads the requested project view from the URL path without verifying the caller is authorized for it. Fo...

CVE-2026-68582

Vikunja up to 2.3.0 contains a broken object level authorization (BOLA) in the task-collection endpoint GET /api/v1/projects/{project}/views/{view}/tasks. The endpoint loads the requested project view from the URL path without validating the caller’s authorization, allowing a link-share token hol...

CVE-2026-68581 Vikunja 0.22.0 through 2.3.0 Authentication Bypass via Principal ID Collision

Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs and link-share IDs are independent numeric sequences and both resolve through a generic web.Auth.GetID interface, a link-share JWT whose numeric ID equals a target user's ID is...

CVE-2026-68581 Vikunja 0.22.0 through 2.3.0 Authentication Bypass via Principal ID Collision

Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs and link-share IDs are independent numeric sequences and both resolve through a generic web.Auth.GetID interface, a link-share JWT whose numeric ID equals a target user's ID is...

CVE-2026-68581

Vikunja versions 0.22.0–2.3.0 are affected by an authentication bypass in API token management caused by principal-id collision: user IDs and link-share IDs share a numeric space via a generic web.Auth.GetID() interface, enabling a link-share JWT with a numeric ID equal to a target user ID to be ...