| GHSA-XXC3-XPMC-VMVR |
Vikunja: Unbounded nested task-filter recursion permits API process termination
|
GitHub |
2026‑10‑09 |
Hoch |
| GHSA-XV7Q-FVMC-JX96 |
Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover
|
GitHub |
2026‑10‑09 |
Hoch |
| GHSA-X34J-47HF-4XG7 |
TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment
|
GitHub |
2026‑10‑09 |
Kritisch |
| GHSA-X2RP-9QF7-2FMQ |
Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled
|
GitHub |
2026‑10‑09 |
Mittel |
| GHSA-WQ92-8X3R-FM38 |
Vikunja: Planka migration retains an unbounded aggregate of attacker-served attachments and can OOM the API
|
GitHub |
2026‑10‑09 |
Hoch |
| GHSA-W7JP-MF2V-8342 |
Vikunja: Denial of service via decompression bomb in the data import
|
GitHub |
2026‑10‑09 |
Hoch |
| GHSA-W39F-H553-H2MX |
Vikunja: Cross-tenant task-position rows can be injected into arbitrary project views via the unvalidated project_view_id in the task…
|
GitHub |
2026‑10‑09 |
Mittel |
| GHSA-W2CH-4XGR-22WW |
Vikunja: Task relation deletion does not check read access to the other task, allowing cross-project relation removal
|
GitHub |
2026‑10‑09 |
Niedrig |
| GHSA-VVCV-VPPH-H844 |
Vikunja: Link-share principal ID collision allows cross-account API token issuance and management
|
GitHub |
2026‑10‑09 |
Hoch |
| GHSA-VFXW-3X8P-2VJR |
Vikunja: Link-share token can enumerate users through the v2 API
|
GitHub |
2026‑10‑09 |
Mittel |
| GHSA-V3P6-34MC-HJ7V |
Vikunja: Scoped API token can mint unrestricted OAuth session credentials
|
GitHub |
2026‑10‑09 |
Hoch |
| GHSA-RJ9J-8772-4H6C |
Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)
|
GitHub |
2026‑10‑09 |
Kritisch |
| GHSA-R6W9-259G-GWRV |
Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access
|
GitHub |
2026‑10‑09 |
Hoch |
| GHSA-QFWC-VX6F-3G6G |
Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to…
|
GitHub |
2026‑10‑09 |
Hoch |
| GHSA-Q6WP-FR43-GM9V |
Contao: Improper access control in the preview links module
|
GitHub |
2026‑10‑09 |
Mittel |
| GHSA-PWHX-CVV3-QJ5C |
Tina: Code injection via unescaped Git branch name in generated client source
|
GitHub |
2026‑10‑09 |
Hoch |
| GHSA-PQF9-H8G4-8GMH |
Vikunja: Unbounded CSV row cardinality permits API process termination
|
GitHub |
2026‑10‑09 |
Hoch |
| GHSA-PJR3-86V4-5P7W |
Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control /…
|
GitHub |
2026‑10‑09 |
Mittel |
| GHSA-P393-CF76-4JMR |
Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite
|
GitHub |
2026‑10‑09 |
Kritisch |
| GHSA-MRVP-7WMX-5M4H |
Contao: Path traversal in the images controller
|
GitHub |
2026‑10‑09 |
Mittel |