Vikunja: Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway project
CVE-2026-91980
### Summary When you share a project with a team, the API lets you attach any team on the instance, including teams you
#advisory
共收录 23210 条相关情报。
← 返回所有主题Vikunja: Unbounded image decode on avatar and project-background uploads enables decode/resize amplification
CVE-2026-91971
### Summary The 50-megapixel decode guard exists only on the task-attachment preview path. Avatar and project-background
Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords
CVE-2026-91973
### Summary The `/dav`, `/.well-known`, and `/feeds` groups are registered on the root Echo instance with only BasicAuth
Vikunja: API token scopes bypassed via task expand parameter (comments, reactions, time entry counts)
CVE-2026-91983
## Summary API token permission checks only match the HTTP method and route path. The `expand` query parameter on task
Vikunja: Cross-tenant task-position rows can be injected into arbitrary project views via the unvalidated project_view_id in the task position endpoint (v1 and v2)
CVE-2026-91984
## Summary The task-position endpoint authorizes only the task side of the write: `TaskPosition.CanUpdate` delegates to
Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to the share's permission level
CVE-2026-91985
## Summary A user who has only read permission on a project can call the single link-share read endpoint and receive th
Vikunja: TOTP secret is readable after enrollment, no step-up auth
CVE-2026-91982
### Summary Once a user has TOTP enabled, the API still hands back the raw shared secret to anyone holding that account'
Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited
CVE-2026-91972
### Summary `registerAPIRoutesV2` never applies the unconditional pre-auth rate-limit floor (`unauthRateLimit()`) to the
Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access
CVE-2026-62376
### Summary Vikunja stores password-reset, email-confirmation, and account-deletion tokens in the `user_tokens` table i
Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover
CVE-2026-62367
## Summary With the per-provider OIDC `emailfallback` option enabled, Vikunja links an SSO login to a pre-existing **lo
Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite
CVE-2026-107806
## Summary An authenticated nginx-ui user can call `POST /api/restore`, upload a forged encrypted backup, restore `app.
ageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud `getFileURL` Endpoint Leads to Remote Denial of Service
CVE-2026-107839
### Summary The AoE3 `POST /game/cloud/getFileURL` handler in `luskaner/ageLANServer`'s bundled game server decodes an a
Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure
CVE-2026-76216
## Summary Vikunja's `web.Auth` interface (`pkg/web/web.go`, single method `GetID() int64`) is satisfied by BOTH `*user.
yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels
CVE-2026-107840
The Prometheus metrics middleware in pkg/server/server.go used r.Method directly as a label value on request counter and
pacioli: A submit consent marker licensed cancellation of caller-named pre-existing documents
CVE-2026-107841
### Impact `pacioli-guard`'s document-layer consent gate requires a human-minted, single-use, document-bound and **act-
Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)
CVE-2026-68582
## Summary The task-collection endpoint `GET /api/v1/projects/{project}/views/{view}/tasks` loads the requested project
Vikunja: Link-share principal ID collision allows cross-account API token issuance and management
CVE-2026-68581
Executive Summary Vikunja accepts both regular-user JSON Web Tokens (JWTs) and link-share JWTs through its generic auth
Vikunja: Scoped API token can mint unrestricted OAuth session credentials
CVE-2026-57458
## Summary A scoped API token can bypass its declared permissions by using the OAuth authorization flow to mint normal
EIPStackGroup OpENer v2.3 / master commit 76b95cf contains a buffer overflow in the...
CVE-2026-75350
EIPStackGroup OpENer v2.3 / master commit 76b95cf contains a buffer overflow in the GetAttributeList() implementation fo
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')...
CVE-2026-42695
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FolioVision FV Flo