64696 matches found
CVE-2026-68581 Vikunja 0.22.0 through 2.3.0 Authentication Bypass via Principal ID Collision
Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs and link-share IDs are independent numeric sequences and both resolve through a generic web.Auth.GetID interface, a link-share JWT whose numeric ID equals a target user's ID is...
EUVD-2026-51991
Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs and link-share IDs are independent numeric sequences and both resolve through a generic web.Auth.GetID interface, a link-share JWT whose numeric ID equals a target user's ID is...
CVE-2026-16062
creationtimestamp| type| source ---|---|--- 2026-08-02 10:50:24+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3ms3ss6ptam2v...
CVE-2026-16292
creationtimestamp| type| source ---|---|--- 2026-08-02 10:10:04+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3ms3qk37jco2s 2026-08-02 11:43:00+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3ms3vqaq2cw2d 2026-08-02 11:43:01+00:00| seen|...
CVE-2026-18573
creationtimestamp| type| source ---|---|--- 2026-08-02 10:08:30+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3ms3qhbd6vx2g...
CVE-2026-18556
creationtimestamp| type| source ---|---|--- 2026-08-01 21:44:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/6yk3ai2b622lz 2026-08-02 03:27:01+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117023665141420912 2026-08-02 06:36:08+00:00| seen|...
CVE-2026-67292
creationtimestamp| type| source ---|---|--- 2026-08-01 20:12:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms2bpofl4v2m 2026-08-04 09:30:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msapafceeg2s 2026-08-05 02:18:03+00:00| seen|...
CVE-2026-66402
creationtimestamp| type| source ---|---|--- 2026-08-01 20:10:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms2bm2o5mc2a 2026-08-02 09:00:26+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3ms3mnkwzbp2x 2026-08-02 09:02:35+00:00| seen|...
CVE-2026-67328
creationtimestamp| type| source ---|---|--- 2026-08-01 18:00:46+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ms22etaago2p 2026-08-01 22:34:40+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3ms2jolkde62v 2026-08-01 22:34:53+00:00| seen|...
CVE-2025-71403
creationtimestamp| type| source ---|---|--- 2026-08-01 13:47:11+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mrzm7fofvq22...
CVE-2026-67327
better-auth versions = 1.1.3 and = 1.7.0-beta.0 and 1.7.0-beta.10 are vulnerable to account takeover via pre-account hijacking on magic-link and email-OTP sign-in when open email/password registration is enabled. An attacker registers an account with the victim's email address and an...
EUVD-2026-51841
better-auth versions = 1.1.3 and = 1.7.0-beta.0 and 1.7.0-beta.10 are vulnerable to account takeover via pre-account hijacking on magic-link and email-OTP sign-in when open email/password registration is enabled. An attacker registers an account with the victim's email address and an...
CVE-2026-67327
better-auth versions = 1.1.3 and = 1.7.0-beta.0 and 1.7.0-beta.10 are vulnerable to account takeover via pre-account hijacking on magic-link and email-OTP sign-in when open email/password registration is enabled. An attacker registers an account with the victim's email address and an...
CVE-2026-67327
Better-Auth before 1.6.22 is vulnerable to account takeover via pre-account hijacking on magic-link and email-OTP sign-in when open email/password registration is enabled. An attacker registers a victim s email with a chosen password; the account remains unverified. When the victim signs in later...
CVE-2026-67327 better-auth before 1.6.22 Account Takeover via Magic-Link Email-OTP
better-auth versions = 1.1.3 and = 1.7.0-beta.0 and 1.7.0-beta.10 are vulnerable to account takeover via pre-account hijacking on magic-link and email-OTP sign-in when open email/password registration is enabled. An attacker registers an account with the victim's email address and an...
CVE-2026-67327 better-auth before 1.6.22 Account Takeover via Magic-Link Email-OTP
better-auth versions = 1.1.3 and = 1.7.0-beta.0 and 1.7.0-beta.10 are vulnerable to account takeover via pre-account hijacking on magic-link and email-OTP sign-in when open email/password registration is enabled. An attacker registers an account with the victim's email address and an...
CVE-2026-18344
creationtimestamp| type| source ---|---|--- 2026-08-01 10:14:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/hcboak6644dts 2026-08-01 17:43:21+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mrzzfowyul2l 2026-08-01 17:44:05+00:00| seen|...
CVE-2026-16684
creationtimestamp| type| source ---|---|--- 2026-08-01 10:02:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/cl4yc4qcqanzn 2026-08-01 17:45:56+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mrzzkc2pmo2b 2026-08-01 17:46:30+00:00| seen|...