CVE-2026-123525

Vikunja before 2.7.1 Memory Exhaustion DoS via Trello, Todoist and Microsoft To Do Migrations

Vikunja before 2.7.1 allocates memory without limits in its Trello, Todoist and Microsoft To Do migration importers, which buffer remote attachment downloads and API responses in memory without size caps. Authenticated users can start a migration that references huge attacker-served attachments or yields oversized API responses, exhausting memory and crashing the shared API process for all tenants.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Vikunja

Products

Vikunja

CVE-2026-123521

Vikunja before 2.7.1 Password Brute-Force via TOTP Disable Endpoint

Vikunja before 2.7.1 contains an improper restriction of excessive authentication attempts vulnerability that allows session holders to brute-force account passwords via unthrottled re-authentication endpoints. Attackers with a stolen session can guess the password via /user/settings/totp/disable without lockout, then disable TOTP without a code for persistent account takeover.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Vikunja

Products

Vikunja

CVE-2026-123517

Vikunja before 2.7.1 Information Disclosure via Team Self-Removal Endpoint

Vikunja before 2.7.1 contains an information disclosure vulnerability that allows authenticated users to determine whether private teams exist by calling the team member self-removal endpoint. Attackers can send DELETE requests to /teams/{id}/members/{own username} for arbitrary team ids and use the distinguishable responses to learn if a team exists, is SSO-managed, or has a single member.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Vikunja

Products

Vikunja

CVE-2026-123513

Vikunja before 2.7.1 Auth Token Leak via API URL Change

Vikunja before 2.7.1 contains a credential exposure vulnerability that allows attackers to steal stored auth tokens by inducing users to switch the frontend API URL. Because checkAndSetApiUrl leaves origin-independent localStorage tokens in place, the bearer token and desktop OAuth refresh token are sent to the attacker's server, enabling account takeover.

CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Vikunja

Products

Vikunja

CVE-2026-123509

Vikunja before 2.7.1 Denial of Service via Unbounded Kanban Bucket Count

Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows project writers or view admins to create unlimited kanban buckets due to missing count caps. Attackers can create thousands of buckets so every kanban read runs a task SELECT and COUNT per bucket, generating heavy database load.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Vikunja

Products

Vikunja

CVE-2026-123505

Vikunja before 2.7.1 World-Readable Local File Storage and SQLite Database

Vikunja before 2.7.1 contains an insecure file permissions vulnerability that allows local users to read stored data because localStorage.Write creates blobs world-readable. Local attackers on a shared host can read attachments, project backgrounds and exports, and copy the SQLite database to crack password hashes offline.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Vikunja

Products

Vikunja

CVE-2026-123501

Vikunja before 2.7.1 Memory Exhaustion DoS via Unbounded Image Decodes

Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory through concurrent image decodes in avatar and background uploads. Attackers can send several parallel tiny, highly compressible PNGs decoded at up to 50 megapixels each, pushing the API process into memory pressure or an OOM kill.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Vikunja

Products

Vikunja

CVE-2026-123497

Vikunja veans before 2.7.1 HTTPS to HTTP Downgrade in Server Discovery

Vikunja veans before 2.7.1 contains a protocol downgrade vulnerability in serverCandidates that allows on-path attackers to force plain HTTP during veans init and login. Attackers can block HTTPS ports so discovery accepts an unverified HTTP response, capturing passwords, TOTP codes or bot tokens and persisting cleartext API traffic.

CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Vikunja

Products

Vikunja

CVE-2026-123493

Vikunja from 2.4.0 before 2.7.1 Authentication Bypass via Bot API Tokens

Vikunja from 2.4.0 before 2.7.1 contains an authentication bypass vulnerability that allows disabled or locked users to retain access through API tokens owned by their bot users. Because token validation only checks the bot's own status, attackers holding pre-minted bot tokens can keep reading and modifying shared projects via the HTTP API, CalDAV, MCP and feeds.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Go-vikunja Vikunja

Products

Vikunja Vikunja

CVE-2026-123322

Code Execution via Untrusted Angular CLI Schematics Loader in WebStorm

In JetBrains WebStorm before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Angular CLI schematics loader

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jetbrains

Products

Webstorm

CVE-2026-123320

Insufficient Login Warning Enables Credential Leakage to Malicious Server in JetBrains Toolbox App

In JetBrains Toolbox App before 3.9 insufficient warning in the login dialog allowed connecting to a malicious server

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Jetbrains

Products

Toolbox

CVE-2026-123319

Missing Domain Attribute Validation Allows Cookie Injection in JetBrains Ktor

In JetBrains Ktor before 3.6.1 missing Domain attribute validation in client cookie storage allowed cookie injection

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Jetbrains

Products

Ktor

CVE-2026-123318

Ktor CIO Engine HTTP Request Smuggling Vulnerability

In JetBrains Ktor before 3.6.1 hTTP request smuggling was possible in the CIO engine

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Jetbrains

Products

Ktor

CVE-2026-123315

Command Execution via Allow Similar Commands Option in JetBrains Junie CLI

In JetBrains Junie CLI before 26.8.24 command execution was possible via the Allow Similar Commands option

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Jetbrains

Products

Junie

CVE-2026-123087

SQL injection in Atmira’s SIREC

SQL injection vulnerability in Atmira’s SIREC. The server retrieves the value of a field from a JSON object containing user-supplied information and concatenates it into an SQL statement without properly sanitising the input. This allows the original query to be altered via malicious input, causing the database to return unexpected information.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Atmira

Products

Sirec

CVE-2026-121824

DoS via Excessive Memory Allocation in Armeria Thrift Processing

A vulnerability has been identified in armeria versions prior to 1.43.0, where processing malformed Thrift messages can cause excessive memory allocation, potentially resulting in denial of service.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Ly Corporation

Products

Armeria

CVE-2026-121823

Path Normalization Bypass Allowing Unauthorized Access

A vulnerability has been identified in armeria versions prior to 1.43.0, where inconsistent request path normalization can allow unauthenticated attackers to bypass path-based access controls and access protected resources.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Ly Corporation

Products

Armeria

CVE-2026-121822

Stored Cross‑Site Scripting via Directory Listing in Armeria

A vulnerability has been identified in armeria versions 0.80.0 through 1.42.0, where attackers who control file names can cause stored cross-site scripting (XSS) when directory listing is enabled and a user views the listing.

CVSS 4.0 · 2.4 Low EPSS < 1% KEV · Not listed

Vendors

Ly Corporation

Products

Armeria

CVE-2026-121821

CORS Policy Bypass Enables Credentialed Data Disclosure in Armeria

A vulnerability has been identified in armeria versions 0.84.0 through 1.42.0, where any-origin CORS policies do not enforce configured path restrictions, allowing an attacker-controlled website visited by an authenticated victim to read sensitive responses from excluded paths when credentials are enabled and the victim's browser sends authentication credentials.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ly Corporation

Products

Armeria

CVE-2026-121820

com.linecorp.armeria/armeria-saml: armeria-saml: Denial of Service via decompression of untrusted SAML messages

A vulnerability has been identified in armeria-saml versions prior to 1.43.0, where the HTTP-Redirect binding decoder decompresses attacker-supplied SAML messages without limiting the output size before signature validation, allowing an unauthenticated remote attacker to exhaust server memory and cause a denial of service.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Ly Corporation

Products

Armeria