Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4,798

CVE-2026-123522

Vikunja before 2.7.1 Task Information Disclosure via Kanban Bucket Move Webhook

Vikunja before 2.7.1 contains an authorization bypass vulnerability that allows authenticated users to read any task by injecting a crafted task object into a no-op Kanban bucket move. Attackers can set task.id to a victim task and task.project_id to their own project, routing full task contents to their webhook and forging mention notifications.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Vikunja
Products
Vikunja
CVE-2026-123518

Vikunja before 2.7.1 Missing Authorization in Kanban Task-Bucket Move

Vikunja before 2.7.1 contains an incorrect authorization vulnerability in TaskBucket.CanUpdate, which checks write access to the bucket's project and to the task separately but never verifies that both belong to the same project. Authenticated users with write access to two projects can move a task into another project's kanban bucket. This persists cross-project task_buckets rows that count toward bucket limits and, for done buckets, toggle the task's done state.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Go-vikunja Vikunja
Products
Vikunja Vikunja
CVE-2026-123514

Vikunja before 2.7.1 Orphaned Export Archives Enable Disk Exhaustion

Vikunja before 2.7.1 contains an improper resource cleanup vulnerability that leaves full-data export archives orphaned on disk after re-exports, failed exports, or account deletion. Authenticated users can repeatedly re-trigger exports containing all their attachments to exhaust disk storage, while deleted users' personal data remains retained indefinitely.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Vikunja
Products
Vikunja
CVE-2026-123510

Vikunja before 2.7.1 Plugin and Log Directories Not Anchored to Rootpath

Vikunja before 2.7.1 fails to re-anchor PluginsDir and LogPath to service.rootpath, allowing plugins to load from and logs to be written in the startup working directory. Local attackers able to write to that directory can plant plugins loaded into the server when plugins are enabled, or read misplaced logs including audit.log.

CVSS 4.0 · 1 Low EPSS < 1% KEV · Not listed
Vendors
Vikunja
Products
Vikunja
CVE-2026-123506

Vikunja 2.2.0 before 2.7.1 Token Scope Bypass via Project Webhook Endpoints

Vikunja from 2.2.0 before 2.7.1 contains an authorization bypass vulnerability that allows holders of tokens scoped only to projects_webhooks to manage the owner's user-level webhooks by supplying user_id in request bodies. Attackers can register user webhooks to their own receiver to obtain reminders and task payloads from all owner projects, and read, change or delete existing user webhooks.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Vikunja
Products
Vikunja
CVE-2026-123502

Vikunja before 2.7.1 Link-Share Hash Exposure via Request Path Logging

Vikunja before 2.7.1 contains an information exposure vulnerability that allows log readers to obtain link-share hashes because the request logger records the raw URI of the /shares/:share/auth route. Attackers with access to Vikunja or reverse proxy access logs can reuse non-expiring, non-password-protected share hashes to obtain a project JWT with read, write or admin permission.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Vikunja
Products
Vikunja
CVE-2026-123498

Vikunja veans before 2.7.1 Prompt Injection via Project and Task Metadata

Vikunja veans before 2.7.1 contains a prompt injection vulnerability that allows project members with write access to inject instructions by setting project titles or task content rendered verbatim inside the coding agent's authoritative instruction block. Attackers can craft ProjectTitle or task descriptions that the prime hook loads on SessionStart and PreCompact, causing the agent to modify the developer's checkout or run commands.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Vikunja
Products
Vikunja
CVE-2026-123494

Vikunja before 2.7.1 Login CSRF via Migration OAuth Callbacks

Vikunja before 2.7.1 contains a cross-site request forgery vulnerability that allows attackers to import their data into a victim's account because the Todoist, Microsoft To Do, and Trello migration OAuth callbacks lack a bound state parameter. Attackers can authorize their own account, keep the unused callback code or token, and lure a logged-in victim to the migration callback route to auto-import attacker-chosen projects and tasks containing phishing links.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Vikunja
Products
Vikunja
CVE-2026-124625

PipraPay Admin Panel pp-functions.php deleteData sql injection

A security vulnerability has been detected in PipraPay 3.0.0. Affected by this issue is the function deleteData of the file pp-content/pp-include/pp-functions.php of the component Admin Panel. The manipulation of the argument selected_ids/ItemID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Piprapay
Products
Piprapay
CVE-2026-124624

PipraPay pp-token anti-CSRF pp-adapter.php hash_hmac hard-coded credentials

A weakness has been identified in PipraPay 3.0.0. Affected by this vulnerability is the function hash_hmac of the file pp-content/pp-include/pp-adapter.php of the component pp-token anti-CSRF Handler. Executing a manipulation can lead to hard-coded credentials. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Piprapay
Products
Piprapay
CVE-2026-119613

AshAi sends unrecognized tool errors verbatim to MCP clients and the model, disclosing internal details

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_ai allows a caller of an AshAi tool to read internal error details, including module names and data values, by making a tool call fail. AshAi.ToToolError gained an implementation for Ash.Error.Unknown.UnknownError that returns the error's error field as is, and AshAi.Tool.Errors.format/1 sends that text to MCP clients (tool calls and resource reads in AshAi.Mcp.Server) and to the model in AshAi.ToolLoop. Ash stores the full Exception.format/2 output of a raised exception, or inspect/1 of a bare {:error, term} return, in that field. A tool result that cannot be JSON-encoded raises a Protocol.UndefinedError whose text includes the inspected value, which can be a whole record with fields the tool never returns. None of these errors were logged. The fix logs them under an error id and returns only that id to the caller. This issue affects ash_ai: from 1.5.0 before 1.5.1.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ash-project
Products
Ash Ai
CVE-2026-112171

SQL injection vulnerability in Magistra software

An attacker can inject malicious SQL statements through user-controlled input, allowing unauthorized access to, modification of, or disclosure of database data.

CVSS 4.0 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Galeno Sistemi
Products
Magistra
CVE-2026-112170

Improper verification of downloaded upgrades

The software downloads upgrade files without performing integrity checks, allowing the installation of tampered updates.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Galeno Sistemi
Products
Magistra
CVE-2026-112169

Undocumented backdoor allows authentication bypass in Magistra software

Magistra software contains undocumented backdoor functionality that allows authentication bypass and the creation of a privileged user account without credential verification.

CVSS 4.0 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Galeno Sistemi
Products
Magistra
CVE-2026-112168

Multiple embedded secrets and weak algorithms in Magistra

The Magistra software uses weak custom encryption, relies on an outdated compression algorithm to protect the database, and contains embedded secrets.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Galeno Sistemi
Products
Magistra
CVE-2026-116337

Uncontrolled resource consumption vulnerability in HTTP response handling of Qt Network impacts Qt Framework

Uncontrolled resource consumption vulnerability in the Qt Framework HTTP response handling functionality of the Qt Network module.

CVSS 4.0 · 0.6 Low EPSS < 1% KEV · Not listed
Vendors
Qt
Products
Qt Qt Framework Qtbase
CVE-2026-113702

iomad PDF Certificate lib.php local_iomad_pluginfile authorization

A security flaw has been discovered in iomad up to 4.5.15/5.0.11/5.1.8/5.2.4. Affected by this vulnerability is the function local_iomad_pluginfile in the library public/local/iomad/lib.php of the component PDF Certificate Handler. The manipulation results in authorization bypass. The attack can be launched remotely. The patch is identified as ac7427130865ce0ed80870813317c87ae3060fa4/7bf0b10199782e04aa579e9d516e473b164afd1c/db903abdcb3aba124cce670608ae6d7ba5f51a84/66f7417c5357b7575e39e8be390602156c1a1225. It is advisable to implement a patch to correct this issue. This CVE was requested by the vendor.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Iomad
Products
Iomad
CVE-2026-124589

lxtGH OMG-Seg MoE Shard Checkpoint Loader handle_moe_load_and_save.py load_state_dict_into_model path traversal

A weakness has been identified in lxtGH OMG-Seg up to f3b26b609bae919760cd3ccf09c36179bb8624a0. This affects the function load_state_dict_into_model of the file omg_llava/xtuner/utils/handle_moe_load_and_save.py of the component MoE Shard Checkpoint Loader. Executing a manipulation of the argument weight_map can lead to path traversal. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Lxtgh
Products
Omg-seg
CVE-2026-124588

huggingface finetrainers Model Index model.py resolve_component_cls code injection

A security flaw has been discovered in huggingface finetrainers 0.1.0/0.2.0. The impacted element is the function resolve_component_cls of the file finetrainers/utils/model.py of the component Model Index Handler. Performing a manipulation of the argument Library results in code injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Huggingface
Products
Finetrainers
CVE-2026-124637

Stored Cross-Site Scripting (XSS) in Tankuam Places

A stored Cross-Site Scripting (XSS) vulnerability was identified in the profile editing form, in the parameters: cliNom and cliCognoms, in a request to https://www.luxorgymtarrega.com/dadespersonals/modificarClient/ID. User-provided data is neither validated nor escaped before being displayed in the HTML response and stored in the database, allowing arbitrary JavaScript code to be executed in the victim’s browser.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Kompini
Products
Tankuam Places