EUVD-2026-21422

Vikunja Vulnerable to TOTP Brute-Force Due to Non-Functional Account Lockout...

Vikunja Vulnerable to TOTP Brute-Force Due to Non-Functional Account Lockout

Summary The TOTP failed-attempt lockout mechanism is non-functional due to a database transaction handling bug. The account lock is written to the same database session that the login handler always rolls back on TOTP failure, so the lockout is triggered but never persisted. This allows unlimited...

EUVD-2026-21414

Vikunja has TOTP Two-Factor Authentication Bypass via OIDC Login Path...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication in the OIDC login process when the EmailFallback mechanism is enabled. An attacker can gain unauthorized access to accounts protected by TOTP by authenticating to the OIDC provider with a matching email address,...

GHSA-8JVC-MCX6-R4CG Vikunja has TOTP Two-Factor Authentication Bypass via OIDC Login Path

Summary The OIDC callback handler issues a full JWT token without checking whether the matched user has TOTP two-factor authentication enabled. When a local user with TOTP enrolled is matched via the OIDC email fallback mechanism, the second factor is completely skipped. Details The OIDC callback...

GHSA-W5FQ-8965-C969

creationtimestamp| type| source ---|---|--- 2026-04-10 15:17:16+00:00| seen| Telegram/lguE38htKCDsrEIHzbRJLgqsKSDV6aHHtfYRxKZkwP2V8...

js-yaml: js-yaml: Denial of Service via quadratic CPU time parsing with merge keys

A flaw was found in js-yaml, a JavaScript YAML parser and dumper. When merge keys are enabled, a remote attacker could exploit this vulnerability by crafting a YAML document where a chain of mappings uses merge keys, each merging the previous one. This can lead to a significant increase in CPU ti...

Malicious code in noonhelpers (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c2cb54ce39fd435f904d72dbbb5eef46166291adcd5106ea8d74d3c3c66aa3a5 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

CVE-2026-6042

creationtimestamp| type| source ---|---|--- 2026-04-10 10:29:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj54hqcl4425 2026-04-14 15:00:05+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/80269 2026-04-14 19:00:09+00:00| published-proof-of-concept|...

CVE-2026-6032

creationtimestamp| type| source ---|---|--- 2026-04-10 10:20:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj53xh4xkf2n...

CVE-2026-40212

creationtimestamp| type| source ---|---|--- 2026-04-10 10:09:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj53dzfqnr2q...

CVE-2026-5912

An integer overflow flaw was found in the WebRTC component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=486498791...

CVE-2026-5477

creationtimestamp| type| source ---|---|--- 2026-04-10 06:07:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj4nssm7jw2d 2026-04-10 07:17:18+00:00| seen| Telegram/XhYu4mFc-5em62dyPX2z20yH7qSW9mAMzHMEdwTQTYW2M...

Security Bulletin: Segmentation Fault Vulnerability in Rust time crate on Unix Systems (v0.2.7–v0.2.22) affects watsonx.data

Summary A vulnerability in the Rust time crate v0.2.7–v0.2.22 can cause segmentation faults on Unix-like systems when environment variables are set from a different thread. Windows and WebAssembly targets are unaffected. This can affect watsonx.data. Vulnerability Details CVEID:CVE-2020-26235...

CVE-2026-6013

The CVE-2026-6013 entry describes a buffer overflow in D-Link DIR-513 v1.10 affecting the POST Request Handler’s formSetRoute (/goform/formSetRoute). The vulnerable function mishandles the curTime argument, enabling a remote attacker to trigger a buffer overflow. Exploitation is described as publ...

CVE-2026-1263

creationtimestamp| type| source ---|---|--- 2026-04-10 02:19:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj4b2zhaul24 2026-04-19 17:33:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mjuidmaf7l2c...

Zod jsVideoUrlParser vulnerable to ReDoS in util.js

A weakness has been identified in Zod jsVideoUrlParser up to 0.5.1. The impacted element is the function getTime in the library lib/util.js. This manipulation of the argument timestamp causes inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit ha...

Regular Expression Denial of Service (ReDoS)

Overview js-video-url-parser is an A parser to extract provider, video id, starttime and others from YouTube, Vimeo, ... urls Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the getTime function in lib/util.js. An attacker can cause excessive...

Google Chrome WebRTC DoS

The vulnerability of Google Chrome’s WebRTC technology is related to a potential overflow condition. Exploiting this vulnerability could allow an attacker to cause a service failure through a specially created web page...

Event-Driven Temporal Graph Networks for Asynchronous Multi-Agent Cyber Defense in NetForge_RL

The transition of Multi-Agent Reinforcement Learning MARL policies from simulated cyber wargames to operational Security Operations Centers SOCs is fundamentally bottlenecked by the Sim2Real gap. Legacy simulators abstract away network protocol physics, rely on synchronous ticks, and provide clea...