| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|---|---|---|---|
| CVE-2026-123502 | 5.2 | Vikunja before 2.7.1 contains an information exposure vulnerability that allows log readers to obtain link-share hashes because the request logger records the raw URI of the /shares/:share/auth route. Attackers with access to Vikunja or reverse proxy | 2026-11-08 02:16:38 | 2026-11-08 02:16:38 |
| CVE-2026-123501 | 6.5 | Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory through concurrent image decodes in avatar and background uploads. Attackers can send several parallel tiny, hig | 2026-11-08 02:16:37 | 2026-11-08 02:16:37 |
| CVE-2026-123500 | 6.2 | Vikunja before 2.7.1 contains an insecure file permissions vulnerability that allows local users to read dump archives created with umask permissions by the vikunja dump command. Local attackers on a shared host can read the world-readable zip in the | 2026-11-08 02:16:37 | 2026-11-08 02:16:37 |
| CVE-2026-123499 | 5.9 | Vikunja veans before 2.7.1 contains a credential exposure vulnerability that allows malicious repository authors to capture API tokens by specifying an attacker-controlled server in .veans.yml. When veans runs in an untrusted checkout, it sends VEANS | 2026-11-08 02:16:37 | 2026-11-08 02:16:37 |
| CVE-2026-123498 | 3.7 | Vikunja veans before 2.7.1 contains a prompt injection vulnerability that allows project members with write access to inject instructions by setting project titles or task content rendered verbatim inside the coding agent's authoritative instruction | 2026-11-08 02:16:37 | 2026-11-08 02:16:37 |
| CVE-2026-123497 | 6.8 | Vikunja veans before 2.7.1 contains a protocol downgrade vulnerability in serverCandidates that allows on-path attackers to force plain HTTP during veans init and login. Attackers can block HTTPS ports so discovery accepts an unverified HTTP response | 2026-11-08 02:16:37 | 2026-11-08 02:16:37 |
| CVE-2026-123496 | 3.3 | Vikunja veans before 2.7.1 contains a symlink following vulnerability that allows attackers to make veans init write files outside the repository via crafted repo symlinks. Attackers can ship symlinked .veans.yml, .claude, or .opencode entries to ove | 2026-11-08 02:16:37 | 2026-11-08 02:16:36 |
| CVE-2026-123495 | 4.6 | Vikunja 2.0.0 before 2.7.1 accepts form-encoded bodies on the /api/v2 login and OIDC callback endpoints without CSRF or Origin checks, enabling login cross-site request forgery. An attacker with an account can lure a victim to a page posting the atta | 2026-11-08 02:16:36 | 2026-11-08 02:16:36 |
| CVE-2026-123494 | 3.5 | Vikunja before 2.7.1 contains a cross-site request forgery vulnerability that allows attackers to import their data into a victim's account because the Todoist, Microsoft To Do, and Trello migration OAuth callbacks lack a bound state parameter. Attac | 2026-11-08 02:16:36 | 2026-11-08 02:16:36 |
| CVE-2026-123493 | 5.4 | Vikunja from 2.4.0 before 2.7.1 contains an authentication bypass vulnerability that allows disabled or locked users to retain access through API tokens owned by their bot users. Because token validation only checks the bot's own status, attackers ho | 2026-11-08 02:16:36 | 2026-11-08 02:16:36 |
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|
Stranica
/39953
Zapisa po stranici: