Search
320 CVEs · published 2026-11-08 to 2026-11-08
CVEs (320)
Showing 276–300 of 320
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-123537 | MEDIUM | Patched | 5.0 | 2026-11-08 | OpenAM before 16.1.4 contains a server-side request forgery vulnerability that allows parties registering UMA resource sets to trigger internal requests through unvalidated… |
| CVE-2026-123536 | MEDIUM | Patched | 4.1 | 2026-11-08 | OpenAM before 16.1.4 contains a server-side request forgery vulnerability that allows administrators, including delegated realm administrators, to make the server fetch arb… |
| CVE-2026-123535 | LOW | Patched | 4.2 | 2026-11-08 | Tornado before 6.6 does not validate the max_age argument of RequestHandler.set_cookie (also called by set_signed_cookie, set_secure_cookie, and clear_cookie), allowing inj… |
| CVE-2026-123534 | HIGH | Patched | 6.5 | 2026-11-08 | Tornado before 6.6 contains a path traversal vulnerability in RequestHandler.static_url() and get_version() that allows attackers to hash files outside static_path using ..… |
| CVE-2026-123533 | MEDIUM | Patched | 5.5 | 2026-11-08 | gix-commitgraph before 0.42.0, as used in gitoxide before 0.61.0, contains a denial of service vulnerability because its commit-graph parser does not validate parent graph … |
| CVE-2026-123532 | HIGH | Patched | 6.5 | 2026-11-08 | gix-fs in gitoxide before 0.24.1 contains a credential disclosure vulnerability that allows remote attackers to capture NTLM credentials by supplying UNC symlink targets in… |
| CVE-2026-123531 | HIGH | Patched | 8.8 | 2026-11-08 | Vikunja from 1.0.0 before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated users to bypass service.maxitemsperpage by sending pag… |
| CVE-2026-123530 | MEDIUM | Patched | 5.9 | 2026-11-08 | Vikunja before 2.7.1 contains a missing authentication vulnerability that allows attackers holding a stolen session to enroll and enable TOTP without the account password. … |
| CVE-2026-123529 | MEDIUM | Patched | 4.6 | 2026-11-08 | Vikunja before 2.7.1 contains a stored CSS injection vulnerability that allows authenticated users with project write access to inject arbitrary CSS via unsanitized table-c… |
| CVE-2026-123528 | HIGH | Patched | 6.8 | 2026-11-08 | Vikunja before 2.7.1 contains an insufficient session expiration vulnerability that allows holders of revoked access tokens to keep authenticating because SetupTokenMiddlew… |
| CVE-2026-123527 | MEDIUM | Patched | 5.4 | 2026-11-08 | Vikunja from 2.4.0 before 2.7.1 contains an authorization bypass vulnerability that allows token holders to perform unintended operations due to colliding v1 and v2 API tok… |
| CVE-2026-123526 | MEDIUM | Patched | 5.4 | 2026-11-08 | Vikunja before 2.7.1 contains a mass assignment vulnerability that allows any authenticated user to set the read-only external_id field through the team create and update e… |
| CVE-2026-123525 | HIGH | Patched | 6.5 | 2026-11-08 | Vikunja before 2.7.1 allocates memory without limits in its Trello, Todoist and Microsoft To Do migration importers, which buffer remote attachment downloads and API respon… |
| CVE-2026-123524 | MEDIUM | Patched | 5.7 | 2026-11-08 | Vikunja from 0.23.0 before 2.7.1 contains an information disclosure vulnerability that allows project collaborators with write access to read tasks from inaccessible projec… |
| CVE-2026-123523 | HIGH | Patched | 6.5 | 2026-11-08 | Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory by requesting avatars at many dist… |
| CVE-2026-123522 | HIGH | Patched | 7.1 | 2026-11-08 | Vikunja before 2.7.1 contains an authorization bypass vulnerability that allows authenticated users to read any task by injecting a crafted task object into a no-op Kanban … |
| CVE-2026-123521 | MEDIUM | Patched | 5.9 | 2026-11-08 | Vikunja before 2.7.1 contains an improper restriction of excessive authentication attempts vulnerability that allows session holders to brute-force account passwords via un… |
| CVE-2026-123520 | HIGH | Patched | 7.1 | 2026-11-08 | Vikunja from 0.18.0 before 2.7.1 contains a privilege escalation vulnerability that allows team owners to gain admin or ownership of read-only shared projects by deleting a… |
| CVE-2026-123519 | HIGH | Patched | 6.5 | 2026-11-08 | Vikunja before 2.7.1 contains a denial of service vulnerability that allows authenticated users to exhaust API process memory by uploading WeKan or vikunja-file imports wit… |
| CVE-2026-123518 | MEDIUM | Patched | 4.3 | 2026-11-08 | Vikunja before 2.7.1 contains an incorrect authorization vulnerability in TaskBucket.CanUpdate, which checks write access to the bucket's project and to the task separately… |
| CVE-2026-123517 | HIGH | Patched | 4.3 | 2026-11-08 | Vikunja before 2.7.1 contains an information disclosure vulnerability that allows authenticated users to determine whether private teams exist by calling the team member se… |
| CVE-2026-123516 | HIGH | Patched | 4.3 | 2026-11-08 | Vikunja before 2.7.1 contains a resource exhaustion vulnerability in the vikunja-file ZIP importer that allows authenticated users to consume CPU and memory by uploading ar… |
| CVE-2026-123515 | MEDIUM | Patched | 4.1 | 2026-11-08 | Vikunja before 2.7.1 contains a client-side request forgery vulnerability that allows users with write access to make viewers' clients request loopback or LAN addresses by … |
| CVE-2026-123514 | MEDIUM | Patched | 4.3 | 2026-11-08 | Vikunja before 2.7.1 contains an improper resource cleanup vulnerability that leaves full-data export archives orphaned on disk after re-exports, failed exports, or account… |
| CVE-2026-123513 | HIGH | Patched | 6.8 | 2026-11-08 | Vikunja before 2.7.1 contains a credential exposure vulnerability that allows attackers to steal stored auth tokens by inducing users to switch the frontend API URL. Becaus… |