Contao: Improper access control in the table access voter
CVE-2026-107851
Due to a caching defect in the security voter that governs table-level access to Contao's Data Container (DCA) backend,
2026-10-10 归档
今日共收录 1383 条安全情报，包含 534 个 CVE，469 篇安全通告，以及 100 篇研究论文。
← 返回归档列表Vikunja: Planka migration retains an unbounded aggregate of attacker-served attachments and can OOM the API
CVE-2026-91970
# Planka migration retains an unbounded aggregate of attacker-served attachments and can OOM the API ## Summary The al
Vikunja: Unbounded CSV row cardinality permits API process termination
CVE-2026-91969
# Unbounded CSV row cardinality permits API process termination ## Summary The authenticated v2 CSV migration route ca
Vikunja: Unbounded nested task-filter recursion permits API process termination
CVE-2026-91968
# Unbounded nested task-filter recursion permits API process termination ## Summary Authenticated task-list routes acc
Vikunja: Denial of service via decompression bomb in the data import
CVE-2026-91979
### Summary Vikunja lets you export your data as a zip and import it back. The import doesn't limit how large the archiv
Vikunja: Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway project
CVE-2026-91980
### Summary When you share a project with a team, the API lets you attach any team on the instance, including teams you
Vikunja: Unbounded image decode on avatar and project-background uploads enables decode/resize amplification
CVE-2026-91971
### Summary The 50-megapixel decode guard exists only on the task-attachment preview path. Avatar and project-background
Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords
CVE-2026-91973
### Summary The `/dav`, `/.well-known`, and `/feeds` groups are registered on the root Echo instance with only BasicAuth
Vikunja: API token scopes bypassed via task expand parameter (comments, reactions, time entry counts)
CVE-2026-91983
## Summary API token permission checks only match the HTTP method and route path. The `expand` query parameter on task
Vikunja: Cross-tenant task-position rows can be injected into arbitrary project views via the unvalidated project_view_id in the task position endpoint (v1 and v2)
CVE-2026-91984
## Summary The task-position endpoint authorizes only the task side of the write: `TaskPosition.CanUpdate` delegates to
Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited
CVE-2026-91972
### Summary `registerAPIRoutesV2` never applies the unconditional pre-auth rate-limit floor (`unauthRateLimit()`) to the
Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure
CVE-2026-76216
## Summary Vikunja's `web.Auth` interface (`pkg/web/web.go`, single method `GetID() int64`) is satisfied by BOTH `*user.
yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels
CVE-2026-107840
The Prometheus metrics middleware in pkg/server/server.go used r.Method directly as a label value on request counter and
Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)
CVE-2026-68582
## Summary The task-collection endpoint `GET /api/v1/projects/{project}/views/{view}/tasks` loads the requested project
EIPStackGroup OpENer v2.3 / master commit 76b95cf contains a buffer overflow in the...
CVE-2026-75350
EIPStackGroup OpENer v2.3 / master commit 76b95cf contains a buffer overflow in the GetAttributeList() implementation fo
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')...
CVE-2026-42695
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FolioVision FV Flo
EIPStackGroup OpENer v2.3 and master up to commit 76b95cf contain an expired pointer dereference...
CVE-2026-75347
EIPStackGroup OpENer v2.3 and master up to commit 76b95cf contain an expired pointer dereference vulnerability in the Et
LobsterAI 2026.5.27 through 2026.9.23 contains an external control of file path vulnerability in...
CVE-2026-108156
LobsterAI 2026.5.27 through 2026.9.23 contains an external control of file path vulnerability in the skills:delete IPC h
AstronRPA through 1.1.6 contains a download of code without integrity check vulnerability that...
CVE-2026-108160
AstronRPA through 1.1.6 contains a download of code without integrity check vulnerability that allows network attackers
AstronRPA through 1.1.6 contains a cross-site scripting vulnerability in the desktop client's...
CVE-2026-108159
AstronRPA through 1.1.6 contains a cross-site scripting vulnerability in the desktop client's smart-component chat that