Vikunja 0.24.0 Broken Object Level Authorization via Link-Share Token
CVE-2026-68582
Vikunja versions >= 0.24.0 and <= 2.3.0 contain a broken object level authorization (BOLA) vulnerability in the task-col
#advisory
共收录 23627 条相关情报。
← 返回所有主题Vikunja 0.22.0 through 2.3.0 Authentication Bypass via Principal ID Collision
CVE-2026-68581
Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs and
FreeRDP before 3.29.0 Integer Overflow via Audio Input Channel
CVE-2026-68580
FreeRDP before 3.29.0 contains integer overflow vulnerabilities in the audio input redirection channel (audin) across AL
FreeRDP before 3.30.0 Heap Overflow via CliprdrStream_Read
CVE-2026-68579
FreeRDP before 3.30.0 (<= 3.29.0) contains a heap-based buffer overflow in the Windows clipboard client's CliprdrStream_
better-auth before 1.4.1 basePath Modification DoS
CVE-2025-71401
better-auth (npm) before 1.4.2 allows an external request to configure baseURL when it is not otherwise defined (e.g., B
better-auth passkey before 1.4.0 IDOR via delete-passkey
CVE-2025-71400
better-auth passkey versions before 1.4.0 contain an insecure direct object reference vulnerability in the passkey delet
Better Auth before 1.4.4 Path Normalization Bypass via rou3
CVE-2025-71399
Better Auth relies on better-call, which uses the rou3 router library. In affected versions of rou3, paths are normalize
The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site...
CVE-2026-12231
The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ exad_info
A flaw was found in the keycloak-services component of Keycloak, which is used for managing...
CVE-2026-18573
A flaw was found in the keycloak-services component of Keycloak, which is used for managing authentication and authoriza
A flaw was found in the full-scope-disabled client-policy executor within the keycloak-services...
CVE-2026-18570
A flaw was found in the full-scope-disabled client-policy executor within the keycloak-services component. This componen
Keycloak provides authorization services that allow administrators to restrict access to...
CVE-2026-18572
Keycloak provides authorization services that allow administrators to restrict access to resources based on time policie
The Simply Schedule Appointments WordPress plugin before 1.6.12.6 does not correctly restrict a...
CVE-2026-16540
The Simply Schedule Appointments WordPress plugin before 1.6.12.6 does not correctly restrict a bulk appointment operati
The ProfileGrid WordPress plugin before 5.9.9.8 does not verify that a notification belongs to...
CVE-2026-16291
The ProfileGrid WordPress plugin before 5.9.9.8 does not verify that a notification belongs to the requesting user befo
A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions...
CVE-2026-18571
A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 (FGAP V2) is enabled.
The Frontend File Manager Plugin WordPress plugin through 23.6 does not perform nonce validation...
CVE-2026-16292
The Frontend File Manager Plugin WordPress plugin through 23.6 does not perform nonce validation on one of its file-meta
The AI ChatBot for WooCommerce WordPress plugin before 4.8.4 does not perform any authorization...
CVE-2026-15241
The AI ChatBot for WooCommerce WordPress plugin before 4.8.4 does not perform any authorization or nonce check on one o
The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not sanitise or...
CVE-2026-16063
The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not sanitise or escape event timeline cont
The SMS Alert WordPress plugin before 3.9.8 does not bind its "mobile verified" session flag to...
CVE-2026-15206
The SMS Alert WordPress plugin before 3.9.8 does not bind its "mobile verified" session flag to the phone number that w
The login-social WordPress plugin through 1.0.4 does not validate password-reset requests against...
CVE-2026-16261
The login-social WordPress plugin through 1.0.4 does not validate password-reset requests against a reset key or the req
The Narrative Publisher WordPress plugin through 1.0.7 does not restrict write access to a REST...
CVE-2026-16273
The Narrative Publisher WordPress plugin through 1.0.7 does not restrict write access to a REST-exposed post meta field