共收录 2098 条相关情报。
← 返回所有主题CVE-2026-91984
## Summary The task-position endpoint authorizes only the task side of the write: `TaskPosition.CanUpdate` delegates to
CVE-2026-76216
## Summary Vikunja's `web.Auth` interface (`pkg/web/web.go`, single method `GetID() int64`) is satisfied by BOTH `*user.
CVE-2026-107841
### Impact `pacioli-guard`'s document-layer consent gate requires a human-minted, single-use, document-bound and **act-
CVE-2026-68582
## Summary The task-collection endpoint `GET /api/v1/projects/{project}/views/{view}/tasks` loads the requested project
CVE-2026-68581
Executive Summary Vikunja accepts both regular-user JSON Web Tokens (JWTs) and link-share JWTs through its generic auth
CVE-2026-107841
pacioli provides least-privilege governance and a governed agent broker for ERPNext. From version 0.9.6 until version 0.
CVE-2026-107822
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3
CVE-2026-107841
pacioli provides least-privilege governance and a governed agent broker for ERPNext. From version 0.9.6 until version 0.
CVE-2026-107822
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3
CVE-2026-78341
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Incorrect Authorization vuln
CVE-2026-101028
Incorrect Authorization vulnerability in ash-project ash allows an actor to infer data in related records they cannot re
CVE-2026-101028
Incorrect Authorization vulnerability in ash-project ash allows an actor to infer data in related records they cannot re
CVE-2026-107728
Strawberry GraphQL is a library for creating GraphQL APIs. From 0.217.0 until 0.326.1, PermissionExtension.resolve() on
CVE-2026-107728
Strawberry GraphQL is a library for creating GraphQL APIs. From 0.217.0 until 0.326.1, PermissionExtension.resolve() on
CVE-2026-61442
# Platform member PATCH routes allow owner resource rewrites and project lead reassignment delete bypass ## Summary `p
CVE-2026-61440
# Platform members can rewrite shared labels and owner issue labels without owner/admin authorization ## Summary `prai
CVE-2026-107450
In Stump through 0.1.10, the updateSmartList and deleteSmartList GraphQL mutations (crates/graphql/src/mutation/smart_li
CVE-2026-102488
In affected versions, Octopus Server incorrectly evaluates multiple scoped permission assignments, allowing a highly pri
CVE-2026-106471
A flaw was found in Candlepin. The central authorization filter incorrectly grants access when any one of multiple @Veri
CVE-2026-81535
In wolfSSH through 1.5.0 built with --enable-fwd, DoChannelOpen() in src/internal.c gates only direct-tcpip channel open