CLEANSTART-2024-AL32480 Documents in deeply-nested cross-origin browsing contexts could have obtained permissions granted to the top-level origin, bypassing the existing prompt and wrongfully inheriting the top-level perm...

CVE-2022-29909 affects multiple packages. Documents in deeply-nested cross-origin browsing contexts could have obtained permissions granted to the top-level origin, bypassing the existing prompt and wrongfully inheriting the top-level permissions. See references for individual vulnerability detai...

CLEANSTART-2024-MI49895 cross-origin iframe referencing an XSLT document would inherit the parent domain's permissions (such as microphone or camera access)

Security vulnerability affects the firefox-esr package. A cross-origin iframe referencing an XSLT document would inherit the parent domain's permissions such as microphone or camera access...

CLEANSTART-2024-HW94016 Documents in deeply-nested cross-origin browsing contexts could have obtained permissions granted to the top-level origin, bypassing the existing prompt and wrongfully inheriting the top-level perm...

CVE-2022-29909 affects multiple packages. Documents in deeply-nested cross-origin browsing contexts could have obtained permissions granted to the top-level origin, bypassing the existing prompt and wrongfully inheriting the top-level permissions. See references for individual vulnerability detai...

CVE-2026-118677 n8n before 2.41.4 and 2.42.1 Local Gateway Deep-Link Silent Re-pairing to Attacker Instance

n8n before 2.41.4 and 2.42.x before 2.42.1 contains a missing confirmation vulnerability in the Local Gateway desktop app that allows its deep-link connect handler to silently re-pair the app with a different n8n instance. Attackers can lure users running the Local Gateway into opening a crafted...

CVE-2026-118677 n8n before 2.41.4 and 2.42.1 Local Gateway Deep-Link Silent Re-pairing to Attacker Instance

n8n before 2.41.4 and 2.42.x before 2.42.1 contains a missing confirmation vulnerability in the Local Gateway desktop app that allows its deep-link connect handler to silently re-pair the app with a different n8n instance. Attackers can lure users running the Local Gateway into opening a crafted...

CVE-2026-118677

The n8n Local Gateway desktop app versions before 2.41.4 and 2.42.x before 2.42.1 are vulnerable to a missing confirmation flaw in the deep-link connect handler. This allows an attacker to lure users into clicking a crafted n8n-computer-use:// link, which can silently re-pair the app with an atta...

PT-2026-117124

Description Summary In Vikunja v2.6.0 the project-permission engine resolves a user's effective permission on a project as the MAX over the entire reachable project subtree. As a result, when a user has been granted a higher permission on a parent project and the owner explicitly shares a child...

EUVD-2026-78406

Kimai is an open-source time tracking application. Prior to 2.58.0, ExportController::createExportTemplate and ExportController::editExportTemplate inherit only the class-level createexport permission, which ROLETEAMLEAD receives by default, and omit the createexporttemplate permission required b...

CVE-2026-81912: Cross-Site Request Forgery (CSRF)

Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature. The dashboard/users/groups/bulkupdate/confirm endpoint moved the selected group tree nodes without validating an action token, so a state-changing group move could be processed for an...

SUSE CVE-2026-55064

Vikunja is an open-source self-hosted task management platform. From 2.3.0 until 2.4.0, a user with Write but not Admin permission on a shared child project can detach it from its parent hierarchy by submitting parentprojectid equal to 0 to POST /api/v1/projects/project. The Project.CanUpdate...

Vikunja has an incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parent_project_id=0

Summary The fix for CVE-2026-35595 project re-parenting privilege escalation only gates reparent operations when parentprojectid 0. A user with Write but not Admin permission on a shared child project can detach it from its parent by sending parentprojectid: 0, bypassing the Admin requirement. Th...

GHSA-44V6-7FXQ-VGF4 Vikunja has an incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parent_project_id=0

Summary The fix for CVE-2026-35595 project re-parenting privilege escalation only gates reparent operations when parentprojectid 0. A user with Write but not Admin permission on a shared child project can detach it from its parent by sending parentprojectid: 0, bypassing the Admin requirement. Th...

CVE-2026-55064

Vikunja is an open-source self-hosted task management platform. From 2.3.0 until 2.4.0, a user with Write but not Admin permission on a shared child project can detach it from its parent hierarchy by submitting parentprojectid equal to 0 to POST /api/v1/projects/project. The Project.CanUpdate...

CVE-2026-55064

Vikunja (open-source self-hosted task management platform) versions 2.3.0 through 2.4.0 contain an incomplete fix for CVE-2026-35595. The authorization checks in pkg/models/project_permissions.go and pkg/models/project.go only gate reparent operations when parent_project_id > 0, but UpdateProj...

CVE-2026-55064 Vikunja incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parent_project_id=0

Vikunja is an open-source self-hosted task management platform. From 2.3.0 until 2.4.0, a user with Write but not Admin permission on a shared child project can detach it from its parent hierarchy by submitting parentprojectid equal to 0 to POST /api/v1/projects/project. The Project.CanUpdate...

CVE-2026-55064: Missing Authorization

Vikunja is an open-source self-hosted task management platform. From 2.3.0 until 2.4.0, a user with Write but not Admin permission on a shared child project can detach it from its parent hierarchy by submitting parentprojectid equal to 0 to POST /api/v1/projects/project. The Project.CanUpdate...

CVE-2026-71477: Insecure Preserved Inherited Permissions

mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.7.1, release tar archives record mise/bin/mise with user and group ID 1001 and packaging/standalone/install.envsubst extracts and moves it without normalizing ownership, allowing a local user with those IDs to replace a...

EUVD-2026-58500

Budibase before 3.40.0 contains a cross-site request forgery vulnerability in the chat-link handoff endpoint that allows attackers to bind an external chat identity to a victim's account. Attackers can craft a phishing page that auto-submits a POST request with a leaked confirmation token to bind...

CVE-2026-72839

filebrowser through 2.63.16 fails to properly restrict scope and permissions when self-signup is enabled with default CreateUserDir setting. Unauthenticated attackers can register accounts that inherit the server root scope with full create, modify, delete, rename, share, and download permissions...

CVE-2026-72849: Cross-Site Request Forgery (CSRF)

Budibase before 3.40.0 contains a cross-site request forgery vulnerability in the chat-link handoff endpoint that allows attackers to bind an external chat identity to a victim's account. Attackers can craft a phishing page that auto-submits a POST request with a leaked confirmation token to bind...