GHSA-Q6WP-FR43-GM9V Contao: Improper access control in the preview links module

core-bundle/config/services.yaml registers the preview access voter with the class Contao\CoreBundle\Security\Voter\DataContainer\PreviewAccessVoter, but the class shipped on disk is named PreviewVoter. Symfony resolves the class with getReflectionClass$class, false, gets null, silently skips the...

GHSA-VFXW-3X8P-2VJR Vikunja: Link-share token can enumerate users through the v2 API

Summary A link-share token, the credential you hand out to let someone view a shared project, can call the v2 user-search endpoints, which it was never meant to reach. The v1 versions of the same endpoints correctly reject link-share tokens; the v2 versions don't. As a result, anyone with a share...

EUVD-2026-78652

Vikunja: Link-share token can enumerate users through the v2 API...

Vikunja: Link-share token can enumerate users through the v2 API

Summary A link-share token, the credential you hand out to let someone view a shared project, can call the v2 user-search endpoints, which it was never meant to reach. The v1 versions of the same endpoints correctly reject link-share tokens; the v2 versions don't. As a result, anyone with a share...

GHSA-88F6-4RJV-X774 Vikunja: TOTP secret is readable after enrollment, no step-up auth

Summary Once a user has TOTP enabled, the API still hands back the raw shared secret to anyone holding that account's access token. Reading it doesn't ask for the password, even though disabling TOTP does. So a stolen token, an XSS, or a browser left open is enough to copy the second factor into...

Vikunja: TOTP secret is readable after enrollment, no step-up auth

Summary Once a user has TOTP enabled, the API still hands back the raw shared secret to anyone holding that account's access token. Reading it doesn't ask for the password, even though disabling TOTP does. So a stolen token, an XSS, or a browser left open is enough to copy the second factor into...

EUVD-2026-62457

Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure...

EUVD-2026-51991

Vikunja: Link-share principal ID collision allows cross-account API token issuance and management...

connectwise-screenconnect_auth-bypass-add-user-poc

CVE-2024-1708 e CVE-2024-1709 Una prova di concetto sviluppata da @watchTowr per sfruttare un bypass dell'autenticazione al fine di aggiungere un nuovo utente amministrativo in ConnectWise ScreenConnect. Questo è il primo passo di una banale catena di esecuzione remota di comandi. Segui il team d...

CVE-2026-107848

The Contao Open Source CMS (versions 4.0.0 until 5.3.50 and 5.7.12) is vulnerable to a Cross-Site Request Forgery (CSRF) flaw. The root cause is that RequestTokenListener only validates the REQUEST_TOKEN for POST requests, while the declarative GET guard only activates when an act parameter is pr...

WordPress User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin <= 4.3.12 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Tarcísio Luchesi De Almeida Silva Poystick in WordPress Plugin WP User Frontend versions = 4.3.12...

DEBIAN-CVE-2026-107822

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. ...

CVE-2026-107822

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. ...

UBUNTU-CVE-2026-107822

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. ...

CVE-2026-108096 Improper authorization in query resolvers for SQL-backed models in AWS Amplify API Category

Improper authorization in the query resolvers generated by @aws-amplify/graphql-index-transformer in AWS Amplify API Category before 3.1.2 might allow an authenticated remote user to read records owned by other users of the same application via crafted queries. This issue has been addressed in...

CVE-2026-108096 Improper authorization in query resolvers for SQL-backed models in AWS Amplify API Category

Improper authorization in the query resolvers generated by @aws-amplify/graphql-index-transformer in AWS Amplify API Category before 3.1.2 might allow an authenticated remote user to read records owned by other users of the same application via crafted queries. This issue has been addressed in...

WordPress Groundhogg — CRM, Newsletters, and Marketing Automation plugin <= 4.8.3 - Unauthenticated Privilege Escalation to Support User Identity Confusion vulnerability

Unauthenticated Privilege Escalation to Support User Identity Confusion vulnerability discovered by Wordfence PRISM in WordPress Plugin Groundhogg versions = 4.8.3...

WordPress Groundhogg — CRM, Newsletters, and Marketing Automation plugin <= 4.9 - Authenticated (Custom+) Privilege Escalation to 'user' Parameter vulnerability

Authenticated Custom+ Privilege Escalation to 'user' Parameter vulnerability discovered by Wordfence PRISM in WordPress Plugin Groundhogg versions = 4.9...

EUVD-2026-95922

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. ...

CVE-2026-107822

MariaDB servers versions 10.6.1 through 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2 are vulnerable to a database privilege escalation flaw. The root cause is a user/role name collision in the ACL cache, where the system generates identical cache keys for roles and localhost user names ...