CVE-2026-68581

Vikunja versions 0.22.0–2.3.0 are affected by an authentication bypass in API token management caused by principal-id collision: user IDs and link-share IDs share a numeric space via a generic web.Auth.GetID() interface, enabling a link-share JWT with a numeric ID equal to a target user ID to be ...

CVE-2026-16062

creationtimestamp| type| source ---|---|--- 2026-08-02 10:50:24+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3ms3ss6ptam2v...

CVE-2026-16292

creationtimestamp| type| source ---|---|--- 2026-08-02 10:10:04+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3ms3qk37jco2s 2026-08-02 11:43:00+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3ms3vqaq2cw2d 2026-08-02 11:43:01+00:00| seen|...

CVE-2026-18573

creationtimestamp| type| source ---|---|--- 2026-08-02 10:08:30+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3ms3qhbd6vx2g...

CVE-2026-68581: Incorrect Authorization

Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs and link-share IDs are independent numeric sequences and both resolve through a generic web.Auth.GetID interface, a link-share JWT whose numeric ID equals a target user's ID is...

CVE-2026-68582: Authorization Bypass Through User-Controlled Key

Vikunja versions = 0.24.0 and = 2.3.0 contain a broken object level authorization BOLA vulnerability in the task-collection endpoint GET /api/v1/projects/project/views/view/tasks. The endpoint loads the requested project view from the URL path without verifying the caller is authorized for it. Fo...

PT-2026-67334

Name of the Vulnerable Software and Affected Versions Vikunja versions 0.22.0 through 2.3.0 Description Failure to validate the principal type in API token management allows an authenticated attacker to impersonate other users. User IDs and link-share IDs are independent numeric sequences that bo...

PT-2026-67335

Name of the Vulnerable Software and Affected Versions Vikunja versions 0.24.0 through 2.3.0 Description A broken object level authorization BOLA issue exists in the task-collection endpoint 'GET /api/v1/projects/project/views/view/tasks'. The system loads the project view from the URL path withou...

CVE-2026-18556

creationtimestamp| type| source ---|---|--- 2026-08-01 21:44:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/6yk3ai2b622lz 2026-08-02 03:27:01+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117023665141420912 2026-08-02 06:36:08+00:00| seen|...

CVE-2026-67292

creationtimestamp| type| source ---|---|--- 2026-08-01 20:12:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms2bpofl4v2m 2026-08-04 09:30:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msapafceeg2s 2026-08-05 02:18:03+00:00| seen|...

CVE-2026-66402

creationtimestamp| type| source ---|---|--- 2026-08-01 20:10:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms2bm2o5mc2a 2026-08-02 09:00:26+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3ms3mnkwzbp2x 2026-08-02 09:02:35+00:00| seen|...

CVE-2026-67328

creationtimestamp| type| source ---|---|--- 2026-08-01 18:00:46+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ms22etaago2p 2026-08-01 22:34:40+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3ms2jolkde62v 2026-08-01 22:34:53+00:00| seen|...

[SECURITY] [DLA 4713-1] sslh security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4713-1 [email protected] https://www.debian.org/lts/security/ Thorsten Alteholz August 01, 2026 https://wiki.debian.org/LTS -...

CVE-2025-71403

creationtimestamp| type| source ---|---|--- 2026-08-01 13:47:11+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mrzm7fofvq22...

CVE-2026-67327

better-auth versions = 1.1.3 and = 1.7.0-beta.0 and 1.7.0-beta.10 are vulnerable to account takeover via pre-account hijacking on magic-link and email-OTP sign-in when open email/password registration is enabled. An attacker registers an account with the victim's email address and an...

CVE-2026-67327

better-auth versions = 1.1.3 and = 1.7.0-beta.0 and 1.7.0-beta.10 are vulnerable to account takeover via pre-account hijacking on magic-link and email-OTP sign-in when open email/password registration is enabled. An attacker registers an account with the victim's email address and an...

CVE-2026-67327 better-auth before 1.6.22 Account Takeover via Magic-Link Email-OTP

better-auth versions = 1.1.3 and = 1.7.0-beta.0 and 1.7.0-beta.10 are vulnerable to account takeover via pre-account hijacking on magic-link and email-OTP sign-in when open email/password registration is enabled. An attacker registers an account with the victim's email address and an...

CVE-2026-67327 better-auth before 1.6.22 Account Takeover via Magic-Link Email-OTP

better-auth versions = 1.1.3 and = 1.7.0-beta.0 and 1.7.0-beta.10 are vulnerable to account takeover via pre-account hijacking on magic-link and email-OTP sign-in when open email/password registration is enabled. An attacker registers an account with the victim's email address and an...

CVE-2026-67327

better-auth versions = 1.1.3 and = 1.7.0-beta.0 and 1.7.0-beta.10 are vulnerable to account takeover via pre-account hijacking on magic-link and email-OTP sign-in when open email/password registration is enabled. An attacker registers an account with the victim's email address and an...

EUVD-2026-51841

better-auth versions = 1.1.3 and = 1.7.0-beta.0 and 1.7.0-beta.10 are vulnerable to account takeover via pre-account hijacking on magic-link and email-OTP sign-in when open email/password registration is enabled. An attacker registers an account with the victim's email address and an...