Directory Traversal

Overview mcp-sequential-thinking is an A Sequential Thinking MCP Server for advanced problem solving Affected versions of this package are vulnerable to Directory Traversal in the exportsession process. An attacker can access or modify files outside the intended directory by supplying crafted inp...

EUVD-2026-66224

Kimai before 2.56.0 does not enforce team-membership checks in TimesheetVoter::voteOnAttribute, which maps permissions only to owntimesheet or othertimesheet. As a result, any authenticated user with ROLETEAMLEAD or a role holding editothertimesheet/deleteothertimesheet can read, modify, and...

CVE-2026-55066

Vikunja (open-source self-hosted task management) has a cross-tenant IDOR in the kanban move-task endpoint. The task_id field is attacker-controlled via the request body, yet TaskBucket.CanUpdate only authorizes the project/view/bucket from the URL — never the task itself. Because Task.ReadOne pe...

CVE-2026-55066 Vikunja: Cross-tenant IDOR in kanban move-task endpoint via unauthorized body task_id

Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/project/views/view/buckets/bucket/tasks accepts a body supplied taskid but TaskBucket.CanUpdate in pkg/models/kanbantaskbucket.go authorizes only the project, view, and bucket from the URL...

EUVD-2026-67291

A vulnerability has been found in arben-adm mcp-sequential-thinking up to 0.5.0. Impacted is the function importsession/exportsession of the file mcpsequentialthinking/server.py of the component Import Session/Export Session. Such manipulation of the argument filepath leads to path traversal. It ...

CVE-2026-81845

A vulnerability has been found in arben-adm mcp-sequential-thinking up to 0.5.0. Impacted is the function importsession/exportsession of the file mcpsequentialthinking/server.py of the component Import Session/Export Session. Such manipulation of the argument filepath leads to path traversal. It ...

CVE-2026-81845: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability has been found in arben-adm mcp-sequential-thinking up to 0.5.0. Impacted is the function importsession/exportsession of the file mcpsequentialthinking/server.py of the component Import Session/Export Session. Such manipulation of the argument filepath leads to path traversal. It ...

CVE-2026-81845 arben-adm mcp-sequential-thinking Import Session/Export Session server.py export_session path traversal

A vulnerability has been found in arben-adm mcp-sequential-thinking up to 0.5.0. Impacted is the function importsession/exportsession of the file mcpsequentialthinking/server.py of the component Import Session/Export Session. Such manipulation of the argument filepath leads to path traversal. It ...

CVE-2026-81845

A path traversal vulnerability in arben-adm mcp-sequential-thinking (up to version 0.5.0) affects the import_session/export_session functions in mcp_sequential_thinking/server.py. Manipulating the file_path argument allows an attacker to access files outside the intended directory. The attack can...

CVE-2026-81845 arben-adm mcp-sequential-thinking Import Session/Export Session server.py export_session path traversal

A vulnerability has been found in arben-adm mcp-sequential-thinking up to 0.5.0. Impacted is the function importsession/exportsession of the file mcpsequentialthinking/server.py of the component Import Session/Export Session. Such manipulation of the argument filepath leads to path traversal. It ...

CVE-2026-81845 arben-adm mcp-sequential-thinking Import Session/Export Session server.py export_session path traversal

A vulnerability has been found in arben-adm mcp-sequential-thinking up to 0.5.0. Impacted is the function importsession/exportsession of the file mcpsequentialthinking/server.py of the component Import Session/Export Session. Such manipulation of the argument filepath leads to path traversal. It ...

PT-2026-82804

Name of the Vulnerable Software and Affected Versions arben-adm mcp-sequential-thinking versions prior to 0.6.0 Description A path traversal issue exists in the Import Session/Export Session component within the mcp sequential thinking/server.py file. Remote attackers can exploit this by...

CVE-2026-80202

Kimai before 2.56.0 has an authorization bypass in TimesheetVoter::voteOnAttribute() , which maps permissions only to own_timesheet or other_timesheet without enforcing team-membership checks. Any authenticated user holding ROLE_TEAMLEAD (or a role with edit_other_timesheet/delete_other_timesheet...

CVE-2026-80202 Kimai before 2.56.0 Authorization Bypass via TimesheetVoter

Kimai before 2.56.0 does not enforce team-membership checks in TimesheetVoter::voteOnAttribute, which maps permissions only to owntimesheet or othertimesheet. As a result, any authenticated user with ROLETEAMLEAD or a role holding editothertimesheet/deleteothertimesheet can read, modify, and...

CVE-2026-76073 Label Studio through 1.23.0 Cross-Organization Annotation Access via Unscoped AnnotationAPI Queryset

Label Studio does not scope the annotation detail endpoint to the requesting user's organization. AnnotationAPI in labelstudio/tasks/api.py declares queryset = Annotation.objects.all and provides no getqueryset override, so the default lookup retrieves any annotation by primary key. The view's...

CVE-2026-76073 Label Studio through 1.23.0 Cross-Organization Annotation Access via Unscoped AnnotationAPI Queryset

Label Studio does not scope the annotation detail endpoint to the requesting user's organization. AnnotationAPI in labelstudio/tasks/api.py declares queryset = Annotation.objects.all and provides no getqueryset override, so the default lookup retrieves any annotation by primary key. The view's...

CVE-2026-77767 Reconmap Report Preview Endpoint Is Marked AllowAnonymous, Exposing Every Project and Client Organisation Without Authentication

Reconmap's API applies a fallback authorization policy in apps/api/app/Program.cs that requires an authenticated user holding the administrator role, so controllers without their own attribute reject anonymous callers. The report preview action in apps/api/app/Controllers/ReportsController.cs...

CVE-2026-76212

phpMyFAQ before 4.1.7, when configured to use PostgreSQL via the native pgsql PHP extension, declares an incorrect LIKE ESCAPE character '=' in the Search/Database/Pgsql.php backend while escapeLikeWildcards escapes user input with the '|' prefix. As a result, wildcard escaping is a no-op and...

CVE-2026-75106 OpnForm Editable Submission Secret Derivation via Empty Hashids Salt

OpnForm derives editable-submission secrets from sequential row identifiers using Hashids with an empty default salt, allowing unauthenticated attackers to compute hashes for any submission. Attackers can read other respondents' full submission data through the submission-fetch endpoint or...

Use of Password Hash With Insufficient Computational Effort

Overview openssl-encrypt is an A package for secure file encryption and decryption based on modern ciphers using heavy-compute-load chaining of hashing and KDF to generate strong encryption password based on users provided password to ensure secure encryption of files Affected versions of this...