65272 matches found
CVE-2026-32854
creationtimestamp| type| source ---|---|--- 2026-08-02 19:54:14+00:00| seen| https://bsky.app/profile/nixpkgssecuritychanges.gerbet.me/post/3ms4r6npegk2r...
CVE-2026-12720
creationtimestamp| type| source ---|---|--- 2026-08-02 17:03:03+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ms4hir4mdm2t 2026-08-05 01:00:03+00:00| seen| Telegram/rJSqz12D-kpQyCOJVodGQ5YtXruuuT1BANzgPusZ6YAnQ 2026-08-06 00:01:00+00:00| published-proof-of-concept|...
CVE-2019-11683
creationtimestamp| type| source ---|---|--- 2026-08-02 17:00:05+00:00| seen| https://t.me/nuancesprognews/168 2026-08-03 01:51:30+00:00| seen| https://t.me/nuancesprognews/168...
CVE-2015-7326
creationtimestamp| type| source ---|---|--- 2026-08-02 14:45:13+00:00| seen| https://t.me/informationsec/185 2026-08-03 02:17:47+00:00| seen| https://t.me/informationsec/185...
CVE-2026-68582
creationtimestamp| type| source ---|---|--- 2026-08-02 13:30:24+00:00| seen| https://infosec.exchange/users/offseq/statuses/117026155660414417 2026-08-02 15:30:14+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3ms4cglffdo24...
CVE-2026-68581
Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs and link-share IDs are independent numeric sequences and both resolve through a generic web.Auth.GetID interface, a link-share JWT whose numeric ID equals a target user's ID is...
EUVD-2026-51992
Vikunja versions = 0.24.0 and = 2.3.0 contain a broken object level authorization BOLA vulnerability in the task-collection endpoint GET /api/v1/projects/project/views/view/tasks. The endpoint loads the requested project view from the URL path without verifying the caller is authorized for it. Fo...
CVE-2026-68582 Vikunja 0.24.0 Broken Object Level Authorization via Link-Share Token
Vikunja versions = 0.24.0 and = 2.3.0 contain a broken object level authorization BOLA vulnerability in the task-collection endpoint GET /api/v1/projects/project/views/view/tasks. The endpoint loads the requested project view from the URL path without verifying the caller is authorized for it. Fo...
CVE-2026-68582 Vikunja 0.24.0 Broken Object Level Authorization via Link-Share Token
Vikunja versions = 0.24.0 and = 2.3.0 contain a broken object level authorization BOLA vulnerability in the task-collection endpoint GET /api/v1/projects/project/views/view/tasks. The endpoint loads the requested project view from the URL path without verifying the caller is authorized for it. Fo...
CVE-2026-68582
Vikunja up to 2.3.0 contains a broken object level authorization (BOLA) in the task-collection endpoint GET /api/v1/projects/{project}/views/{view}/tasks. The endpoint loads the requested project view from the URL path without validating the caller’s authorization, allowing a link-share token hol...
CVE-2026-68582 Vikunja 0.24.0 Broken Object Level Authorization via Link-Share Token
Vikunja versions = 0.24.0 and = 2.3.0 contain a broken object level authorization BOLA vulnerability in the task-collection endpoint GET /api/v1/projects/project/views/view/tasks. The endpoint loads the requested project view from the URL path without verifying the caller is authorized for it. Fo...
CVE-2026-68581 Vikunja 0.22.0 through 2.3.0 Authentication Bypass via Principal ID Collision
Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs and link-share IDs are independent numeric sequences and both resolve through a generic web.Auth.GetID interface, a link-share JWT whose numeric ID equals a target user's ID is...
CVE-2026-68581
Vikunja versions 0.22.0–2.3.0 are affected by an authentication bypass in API token management caused by principal-id collision: user IDs and link-share IDs share a numeric space via a generic web.Auth.GetID() interface, enabling a link-share JWT with a numeric ID equal to a target user ID to be ...
CVE-2026-68581 Vikunja 0.22.0 through 2.3.0 Authentication Bypass via Principal ID Collision
Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs and link-share IDs are independent numeric sequences and both resolve through a generic web.Auth.GetID interface, a link-share JWT whose numeric ID equals a target user's ID is...
CVE-2026-68581
Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs and link-share IDs are independent numeric sequences and both resolve through a generic web.Auth.GetID interface, a link-share JWT whose numeric ID equals a target user's ID is...
CVE-2026-68581 Vikunja 0.22.0 through 2.3.0 Authentication Bypass via Principal ID Collision
Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs and link-share IDs are independent numeric sequences and both resolve through a generic web.Auth.GetID interface, a link-share JWT whose numeric ID equals a target user's ID is...
EUVD-2026-51991
Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs and link-share IDs are independent numeric sequences and both resolve through a generic web.Auth.GetID interface, a link-share JWT whose numeric ID equals a target user's ID is...
CVE-2026-16062
creationtimestamp| type| source ---|---|--- 2026-08-02 10:50:24+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3ms3ss6ptam2v...
CVE-2026-16292
creationtimestamp| type| source ---|---|--- 2026-08-02 10:10:04+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3ms3qk37jco2s 2026-08-02 11:43:00+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3ms3vqaq2cw2d 2026-08-02 11:43:01+00:00| seen|...