CVE-2026-123498

Vikunja versions before 2.7.1 are vulnerable to a prompt injection vulnerability (CWE-1427). Project members with write access can inject malicious instructions by setting ProjectTitle or task descriptions that are rendered verbatim within a coding agent's authoritative instruction block. Specifi...

DEBIAN-CVE-2026-25063

gradle-completion provides Bash and Zsh completion support for Gradle. A command injection vulnerability was found in gradle-completion up to and including 9.3.0 that allows arbitrary code execution when a user triggers Bash tab completion in a project containing a malicious Gradle build file. Th...

CVE-2021-45228

An XSS issue was discovered in COINS Construction Cloud 11.12. Due to insufficient neutralization of user input in the description of a task, it is possible to store malicious JavaScript code in the task description. This is later executed when it is reflected back to the user...