Export limit exceeded: 421783 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 421783 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 421783 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (421783 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-123540 | 1 Openidentityplatform | 1 Openam | 2026-11-08 | 2 Low |
| OpenAM before 16.1.4 contains an incomplete output encoding vulnerability that allows a SAML 1.x identity provider to alter attribute values by injecting unencoded content into the service provider auto-submitted form. Attackers controlling a trusted identity provider can craft assertion attribute names or values that reach the target application in modified form, undermining the integrity of received attributes. | ||||
| CVE-2026-123539 | 1 Openidentityplatform | 1 Openam | 2026-11-08 | 4.8 Medium |
| OpenAM before 16.1.4 contains a stored cross-site scripting vulnerability that allows privileged attackers to inject script by placing markup in a user's display name. When the victim reaches the OAuth 2.0 / OpenID Connect consent page, the unencoded name executes script that can steal the OpenAM session cookie to impersonate the user. | ||||
| CVE-2026-123537 | 1 Openidentityplatform | 1 Openam | 2026-11-08 | 5 Medium |
| OpenAM before 16.1.4 contains a server-side request forgery vulnerability that allows parties registering UMA resource sets to trigger internal requests through unvalidated scope description URLs. Attackers can register resource sets with scope URLs pointing to internal hosts or cloud metadata endpoints, which OpenAM fetches when sending pending-request notification emails, enabling internal network probing. | ||||
| CVE-2026-123536 | 1 Openidentityplatform | 1 Openam | 2026-11-08 | 4.1 Medium |
| OpenAM before 16.1.4 contains a server-side request forgery vulnerability that allows administrators, including delegated realm administrators, to make the server fetch arbitrary URLs through federation configuration wizard metadata URLs. Attackers can enter metadata or OpenID Connect discovery URLs pointing to internal hosts or cloud metadata endpoints to probe the internal network and read partial responses. | ||||
| CVE-2026-123535 | 1 Tornadoweb | 1 Tornado | 2026-11-08 | 4.2 Medium |
| Tornado before 6.6 does not validate the max_age argument of RequestHandler.set_cookie (also called by set_signed_cookie, set_secure_cookie, and clear_cookie), allowing injection of additional Set-Cookie attributes. When an application passes attacker-influenced input as max_age, an attacker can embed attributes such as Domain, Path, or Secure to widen the cookie's scope to parent paths or other subdomains. | ||||
| CVE-2026-123533 | 1 Gitoxidelabs | 1 Gitoxide | 2026-11-08 | 5.5 Medium |
| gix-commitgraph before 0.42.0, as used in gitoxide before 0.61.0, contains a denial of service vulnerability because its commit-graph parser does not validate parent graph positions against the declared commit count or check the EDGE chunk length for 4-byte alignment. Attackers can supply a repository containing a crafted .git/objects/info/commit-graph file to trigger panics that abort gix merge-base, gix blame, and applications embedding gix. | ||||
| CVE-2026-123532 | 1 Gitoxidelabs | 1 Gitoxide | 2026-11-08 | 6.5 Medium |
| gix-fs in gitoxide before 0.24.1 contains a credential disclosure vulnerability that allows remote attackers to capture NTLM credentials by supplying UNC symlink targets in a crafted repository. When a victim checks out the repository on Windows with symlinks enabled, gix_fs::symlink::create calls is_dir() on the UNC target, triggering SMB authentication that leaks the username, domain, and NTLMv2 hash. | ||||
| CVE-2026-123531 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 8.8 High |
| Vikunja from 1.0.0 before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated users to bypass service.maxitemsperpage by sending page=0 to /api/v1 list endpoints. Attackers can self-register and repeatedly request page=0 to force unbounded SQL queries, memory materialisation, and per-row query fan-out, degrading availability for other users. | ||||
| CVE-2026-123529 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 4.6 Medium |
| Vikunja before 2.7.1 contains a stored CSS injection vulnerability that allows authenticated users with project write access to inject arbitrary CSS via unsanitized table-cell data-background-color attributes. Attackers can store crafted task descriptions or comments to render full-viewport phishing overlays or force zero-click outbound background-image requests that deanonymize viewers. | ||||
| CVE-2026-123528 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 6.8 Medium |
| Vikunja before 2.7.1 contains an insufficient session expiration vulnerability that allows holders of revoked access tokens to keep authenticating because SetupTokenMiddleware skips session and account-status checks. Attackers with a stolen token can, after logout, password reset, or account disabling, mint OAuth sessions via /oauth/authorize or tk_ API tokens for persistent access. | ||||
| CVE-2026-123527 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 5.4 Medium |
| Vikunja from 2.4.0 before 2.7.1 contains an authorization bypass vulnerability that allows token holders to perform unintended operations due to colliding v1 and v2 API token permission keys. Attackers with a token scoped to read project backgrounds can delete them via the v2 DELETE background route, and bucket create-only tokens can update existing buckets. | ||||
| CVE-2026-123525 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 6.5 Medium |
| Vikunja before 2.7.1 allocates memory without limits in its Trello, Todoist and Microsoft To Do migration importers, which buffer remote attachment downloads and API responses in memory without size caps. Authenticated users can start a migration that references huge attacker-served attachments or yields oversized API responses, exhausting memory and crashing the shared API process for all tenants. | ||||
| CVE-2026-123523 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 6.5 Medium |
| Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory by requesting avatars at many distinct sizes. Attackers can upload a noisy avatar and fetch it at each size up to 1024, caching roughly a gigabyte per account without eviction and causing the API process to be OOM-killed. | ||||
| CVE-2026-123521 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 5.9 Medium |
| Vikunja before 2.7.1 contains an improper restriction of excessive authentication attempts vulnerability that allows session holders to brute-force account passwords via unthrottled re-authentication endpoints. Attackers with a stolen session can guess the password via /user/settings/totp/disable without lockout, then disable TOTP without a code for persistent account takeover. | ||||
| CVE-2026-123519 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 6.5 Medium |
| Vikunja before 2.7.1 contains a denial of service vulnerability that allows authenticated users to exhaust API process memory by uploading WeKan or vikunja-file imports with no item-count cap. Attackers can submit a ~22 MB WeKan JSON with hundreds of thousands of cards or duplicate IDs to the wekan migrate endpoint, triggering OOM and crashing the instance. | ||||
| CVE-2026-123517 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 4.3 Medium |
| Vikunja before 2.7.1 contains an information disclosure vulnerability that allows authenticated users to determine whether private teams exist by calling the team member self-removal endpoint. Attackers can send DELETE requests to /teams/{id}/members/{own username} for arbitrary team ids and use the distinguishable responses to learn if a team exists, is SSO-managed, or has a single member. | ||||
| CVE-2026-123516 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 4.3 Medium |
| Vikunja before 2.7.1 contains a resource exhaustion vulnerability in the vikunja-file ZIP importer that allows authenticated users to consume CPU and memory by uploading archives with excessive entries. Attackers can upload export ZIPs containing many empty or non-files/ entries that bypass the per-entry caps, forcing scanArchive to process every entry twice. | ||||
| CVE-2026-123515 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 4.1 Medium |
| Vikunja before 2.7.1 contains a client-side request forgery vulnerability that allows users with write access to make viewers' clients request loopback or LAN addresses by storing img elements in rich text. Attackers can plant images in tasks, comments, project descriptions, or imported Markdown to trigger blind GET requests against local services and track when viewers open content. | ||||
| CVE-2026-123513 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 6.8 Medium |
| Vikunja before 2.7.1 contains a credential exposure vulnerability that allows attackers to steal stored auth tokens by inducing users to switch the frontend API URL. Because checkAndSetApiUrl leaves origin-independent localStorage tokens in place, the bearer token and desktop OAuth refresh token are sent to the attacker's server, enabling account takeover. | ||||
| CVE-2026-123512 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 6.1 Medium |
| Vikunja before 2.7.1 embeds live password-reset, email-confirmation and account-deletion tokens in the URL query string of emailed links, so the full request URI, including the token, is written to Vikunja's HTTP access log and any reverse-proxy logs when a user clicks the link. Attackers with read access to those logs can replay an unredeemed password-reset token to take over the account or an account-deletion token to confirm the deletion. | ||||