Export limit exceeded: 29163 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 421154 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (421154 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-123512 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 6.1 Medium |
| Vikunja before 2.7.1 embeds live password-reset, email-confirmation and account-deletion tokens in the URL query string of emailed links, so the full request URI, including the token, is written to Vikunja's HTTP access log and any reverse-proxy logs when a user clicks the link. Attackers with read access to those logs can replay an unredeemed password-reset token to take over the account or an account-deletion token to confirm the deletion. | ||||
| CVE-2026-123511 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 4.3 Medium |
| Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated CalDAV clients to create unbounded dummy tasks by sending VTODOs with thousands of RELATED-TO properties. Attackers can repeat unknown related UIDs in a single PUT request to generate thousands of task, relation, and event rows, bloating the database and overloading the event pipeline. | ||||
| CVE-2026-123510 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 3.3 Low |
| Vikunja before 2.7.1 fails to re-anchor PluginsDir and LogPath to service.rootpath, allowing plugins to load from and logs to be written in the startup working directory. Local attackers able to write to that directory can plant plugins loaded into the server when plugins are enabled, or read misplaced logs including audit.log. | ||||
| CVE-2026-123509 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 4.3 Medium |
| Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows project writers or view admins to create unlimited kanban buckets due to missing count caps. Attackers can create thousands of buckets so every kanban read runs a task SELECT and COUNT per bucket, generating heavy database load. | ||||
| CVE-2026-123507 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 2.7 Low |
| Vikunja from 0.24.0 before 2.7.1 contains a nil pointer dereference vulnerability that allows project admins to break project views by saving a filter-mode bucket configuration with a null filter. Because validateProjectViewFilters skips nil entries, every subsequent read of the view panics in kanban and task collection code, returning HTTP 500 to all project members. | ||||
| CVE-2026-123506 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 5.4 Medium |
| Vikunja from 2.2.0 before 2.7.1 contains an authorization bypass vulnerability that allows holders of tokens scoped only to projects_webhooks to manage the owner's user-level webhooks by supplying user_id in request bodies. Attackers can register user webhooks to their own receiver to obtain reminders and task payloads from all owner projects, and read, change or delete existing user webhooks. | ||||
| CVE-2026-123505 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 5.5 Medium |
| Vikunja before 2.7.1 contains an insecure file permissions vulnerability that allows local users to read stored data because localStorage.Write creates blobs world-readable. Local attackers on a shared host can read attachments, project backgrounds and exports, and copy the SQLite database to crack password hashes offline. | ||||
| CVE-2026-123504 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 4.3 Medium |
| Vikunja from 0.22.0 before 2.7.1 contains an information disclosure vulnerability that allows read-only project members to view full webhook target URLs by listing project webhooks. Attackers can extract incoming-webhook tokens or API keys embedded in target_url values to post to receiving channels or reuse keys until rotated. | ||||
| CVE-2026-123503 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 5.4 Medium |
| Vikunja before 2.7.1 contains an improper authorization vulnerability in canDoBucket that allows users with project write access to delete buckets via a mismatched view ID. Attackers can request deletion through another view's bucket endpoint to bypass the last-bucket rule, leaving dangling default/done bucket references and inconsistent task buckets. | ||||
| CVE-2026-123502 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 5.2 Medium |
| Vikunja before 2.7.1 contains an information exposure vulnerability that allows log readers to obtain link-share hashes because the request logger records the raw URI of the /shares/:share/auth route. Attackers with access to Vikunja or reverse proxy access logs can reuse non-expiring, non-password-protected share hashes to obtain a project JWT with read, write or admin permission. | ||||
| CVE-2026-123501 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 6.5 Medium |
| Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory through concurrent image decodes in avatar and background uploads. Attackers can send several parallel tiny, highly compressible PNGs decoded at up to 50 megapixels each, pushing the API process into memory pressure or an OOM kill. | ||||
| CVE-2026-123500 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 6.2 Medium |
| Vikunja before 2.7.1 contains an insecure file permissions vulnerability that allows local users to read dump archives created with umask permissions by the vikunja dump command. Local attackers on a shared host can read the world-readable zip in the rootpath to obtain config, password hashes, TOTP secrets, tokens, and stored files. | ||||
| CVE-2026-123499 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 5.9 Medium |
| Vikunja veans before 2.7.1 contains a credential exposure vulnerability that allows malicious repository authors to capture API tokens by specifying an attacker-controlled server in .veans.yml. When veans runs in an untrusted checkout, it sends VEANS_TOKEN as a Bearer token, or login passwords, TOTP codes and tokens, to that server, granting attackers the victim's Vikunja access. | ||||
| CVE-2026-123498 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 3.7 Low |
| Vikunja veans before 2.7.1 contains a prompt injection vulnerability that allows project members with write access to inject instructions by setting project titles or task content rendered verbatim inside the coding agent's authoritative instruction block. Attackers can craft ProjectTitle or task descriptions that the prime hook loads on SessionStart and PreCompact, causing the agent to modify the developer's checkout or run commands. | ||||
| CVE-2026-123497 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 6.8 Medium |
| Vikunja veans before 2.7.1 contains a protocol downgrade vulnerability in serverCandidates that allows on-path attackers to force plain HTTP during veans init and login. Attackers can block HTTPS ports so discovery accepts an unverified HTTP response, capturing passwords, TOTP codes or bot tokens and persisting cleartext API traffic. | ||||
| CVE-2026-123496 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 3.3 Low |
| Vikunja veans before 2.7.1 contains a symlink following vulnerability that allows attackers to make veans init write files outside the repository via crafted repo symlinks. Attackers can ship symlinked .veans.yml, .claude, or .opencode entries to overwrite user files like ~/.bashrc or install veans hooks and plugins globally. | ||||
| CVE-2026-123495 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 4.6 Medium |
| Vikunja 2.0.0 before 2.7.1 accepts form-encoded bodies on the /api/v2 login and OIDC callback endpoints without CSRF or Origin checks, enabling login cross-site request forgery. An attacker with an account can lure a victim to a page posting the attacker's credentials or OIDC code, switching the victim into the attacker's account and exposing data the victim then adds. | ||||
| CVE-2026-123494 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 3.5 Low |
| Vikunja before 2.7.1 contains a cross-site request forgery vulnerability that allows attackers to import their data into a victim's account because the Todoist, Microsoft To Do, and Trello migration OAuth callbacks lack a bound state parameter. Attackers can authorize their own account, keep the unused callback code or token, and lure a logged-in victim to the migration callback route to auto-import attacker-chosen projects and tasks containing phishing links. | ||||
| CVE-2026-123854 | 1 Jetbrains | 1 Pycharm | 2026-11-08 | 5.5 Medium |
| In JetBrains PyCharm before 2026.3 code execution was possible in Safe Mode via a crafted Jupyter notebook widget module | ||||
| CVE-2026-104768 | 2026-11-08 | 7.5 High | ||
| The AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.0.4. This is due to missing privilege-ceiling validation in the `create_user()` function within the anonymous-user action (and equally in the Create User and Add/Change Role WordPress-integration actions), which verify only that the submitted role exists via `automatorwp_get_editable_roles()` without confirming the role falls at or below the acting context's privilege level — allowing attacker-controlled trigger tag data (e.g., a `{comment_author}` tag bound to the Role option) to supply any role, including `administrator`, unchallenged. This makes it possible for unauthenticated attackers to create a new administrator-role account tied to an attacker-controlled email address, receiving the generated password via WordPress's new-user notification email and thereby gaining full administrative access to the site. Exploitation requires the site to have an anonymous automation configured with the Role option bound to a dynamic trigger tag such as `{comment_author}`, and is triggered when a site administrator performs the routine action of approving a comment — an action that provides no in-UI indication that it will mint a new privileged account from the comment author field. | ||||