CVE-2026-102539Medium· 5.7▾ TwilightPoC availableSuper Productivity is an advanced todo list app with integrated timeboxing and time tracking capabilities. From 17.3.0 until 18.13.1, the SuperSync end-to-end encryption setup calls sync(true) before a user sets an encryption password, c…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 31.4 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 14.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.1%
— → 5.7
none → medium
Exploit / PoC code exists
Last analysed / modified upstream
0.1% → 0.2%
Super Productivity is an advanced todo list app with integrated timeboxing and time tracking capabilities. From 17.3.0 until 18.13.1, the SuperSync end-to-end encryption setup calls sync(true) before a user sets an encryption password, causing the operation-upload path to transmit and store all user operations in plaintext. The exposed operations can include private task content and connected issue-provider credentials, including reusable passwords, API tokens, and app passwords. Users who complete E2EE setup have the plaintext operations deleted, while users who leave the password-setting step can leave the data stored indefinitely. The Disable SuperSync action did not remove plaintext that had already been uploaded. Routing and causal metadata remain plaintext by design and are not part of this vulnerability. This issue is fixed in version 18.13.1.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-110200Medium· 6.5Langflow OSS is affected by multiple vulnerabilities
CVE-2026-111993Low· 3.3Soarkey StudentManagement AdminDao.java UserDao.login cleartext storage
CVE-2026-62376High· 8.1Vikunja is an open-source self-hosted task management platform
CVE-2026-107807High· 8.8Nginx UI is a web user interface for the Nginx web server
CVE-2025-5154Low· 2.3A vulnerability was identified in PhonePe App 25.03.21.0 on Android
CVE-2023-22894Medium· 4.9Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter