CVE-2026-74929

The Project Manager WordPress plugin, in versions before 4.0.7 , is vulnerable to an Insecure Direct Object Reference (IDOR) . The root cause is a failure to restrict several REST API routes to the specific projects a user is authorized to access. This oversight allows any authenticated user, suc...

CVE-2026-14938

The FluentBoards WordPress plugin (versions before 1.95.3 ) is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The plugin fails to verify that items selected during a board import operation belong to a board the requesting user is authorized to access. This allows any authenticated...

CVE-2026-33676 Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read

Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, when the Vikunja API returns tasks, it populates the relatedtasks field with full task objects for all related tasks without checking whether the requesting user has read permission on those tasks' projects. A...

CVE-2026-33676 Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read

Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, when the Vikunja API returns tasks, it populates the relatedtasks field with full task objects for all related tasks without checking whether the requesting user has read permission on those tasks' projects. A...