Vikunja: API token scopes bypassed via task expand parameter (comments, reactions, time entry counts)
CVE-2026-91983
## Summary API token permission checks only match the HTTP method and route path. The `expand` query parameter on task
#severity:medium
共收录 5534 条相关情报。
← 返回所有主题Vikunja: Cross-tenant task-position rows can be injected into arbitrary project views via the unvalidated project_view_id in the task position endpoint (v1 and v2)
CVE-2026-91984
## Summary The task-position endpoint authorizes only the task side of the write: `TaskPosition.CanUpdate` delegates to
Vikunja: TOTP secret is readable after enrollment, no step-up auth
CVE-2026-91982
### Summary Once a user has TOTP enabled, the API still hands back the raw shared secret to anyone holding that account'
pacioli: A submit consent marker licensed cancellation of caller-named pre-existing documents
CVE-2026-107841
### Impact `pacioli-guard`'s document-layer consent gate requires a human-minted, single-use, document-bound and **act-
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')...
CVE-2026-42695
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FolioVision FV Flo
LobsterAI 2026.5.27 through 2026.9.23 contains an external control of file path vulnerability in...
CVE-2026-108156
LobsterAI 2026.5.27 through 2026.9.23 contains an external control of file path vulnerability in the skills:delete IPC h
ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability in the GET /workflow...
CVE-2026-108111
ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability in the GET /workflow/search endpoint that ex
A flaw was found in busybox. The tar applet's deferred link-creation handling for symlink and...
CVE-2026-108119
A flaw was found in busybox. The tar applet's deferred link-creation handling for symlink and hardlink entries with unsa
ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability that allows...
CVE-2026-108112
ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability that allows authenticated users to delete ot
A flaw was found in GIMP. The XCF loader processes image-simulation-intent and image-simulation...
CVE-2026-108093
A flaw was found in GIMP. The XCF loader processes image-simulation-intent and image-simulation-bpc parasites without en
Moderator Toolbox (reddit-moderator-toolbox) before 4.0.14 contains a stored cross-site scripting...
CVE-2016-20098
Moderator Toolbox (reddit-moderator-toolbox) before 4.0.14 contains a stored cross-site scripting vulnerability in the r
SmarterMail before build 9777 contains a stored mutation cross-site scripting vulnerability that...
CVE-2026-104083
SmarterMail before build 9777 contains a stored mutation cross-site scripting vulnerability that allows remote attackers
pyLoad: Rate-Limit Bypass and Audit-Log Spoofing via Trusted Client-Controlled `X-Forwarded-For` Header
## Summary pyLoad determines the "client IP" used for its rate-limiting decorator and for its security/audit logging by
pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host
## Summary pyLoad ships the WindowsPhoneNotify addon, whose `send()` method opens an HTTP connection to a host taken di
pyLoad: Unauthenticated access to /web/<path:filename> bypasses authentication on sensitive templates and leaks internal error details via exception attribute typo
CVE-2026-75597
### Summary The `/web/` route in `src/pyload/webui/app/blueprints/app_blueprint.py` renders Jinja2 templates without an
pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination
CVE-2026-48484
## Description: The API `rpc` function in `api_blueprint.py` handles `multipart/form-data` uploads by reading the whole
An unauthenticated user with network access to the Ops Manager web port can repeatedly request...
CVE-2026-87110
An unauthenticated user with network access to the Ops Manager web port can repeatedly request monitoring endpoints that
An authenticated Ops Manager organization member can retrieve another member's pending...
CVE-2026-87109
An authenticated Ops Manager organization member can retrieve another member's pending authenticator enrollment seed thr
A flaw was found in the login theme rendering component of Keycloak. The issue occurs because the...
CVE-2026-107889
A flaw was found in the login theme rendering component of Keycloak. The issue occurs because the security filter respon
OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in cupsdCheckJobs() when a...
CVE-2026-107888
OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in cupsdCheckJobs() when a job marked job-held-on-cr