Tagged “osv”
CVEs tagged osv, newest first.
7111 CVEsRSS
CVE-2026-57458High· 8.1PoCVikunja is an open-source self-hosted task management platform
Vikunja is an open-source self-hosted task management platform. In version 2.3.0, a scoped API token limited to the `oauth.authorize` permission can call `POST /api/v1/oauth/authorize`, obtain an OAuth authorization code, and exchange th…
CVE-2026-62367High· 7.5Vikunja is an open-source self-hosted task management platform
Vikunja is an open-source self-hosted task management platform. In versions 1.0.0 through 2.3.0, when an administrator enables the per-provider `emailfallback` option on an OpenID Connect provider, Vikunja links an SSO login to a pre-exi…
CVE-2026-62376High· 8.1PoCVikunja is an open-source self-hosted task management platform
Vikunja is an open-source self-hosted task management platform. Versions prior to 2.4.0 store password-reset, email-confirmation, and account-deletion tokens in the `user_tokens` table in plaintext. If an attacker gains read access to th…
GHSA-g38j-7v97-x298MediumVikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UID
Vikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UID
GHSA-8wvg-r2j4-3737MediumVikunja: Assignee email addresses disclosed to read-only project members via the task assignees endpoint
Vikunja: Assignee email addresses disclosed to read-only project members via the task assignees endpoint
GHSA-3hc7-r24j-rpwcMediumVikunja: Cross-project task disclosure through subtask expansion
Vikunja: Cross-project task disclosure through subtask expansion
GHSA-w2ch-4xgr-22wwLowVikunja: Task relation deletion does not check read access to the other task, allowing cross-project relation removal
Vikunja: Task relation deletion does not check read access to the other task, allowing cross-project relation removal
CVE-2026-108258Medium· 6.9Shiny for Python is a framework for building interactive web applications in Python
Shiny for Python is a framework for building interactive web applications in Python. From 1.4.0 until 1.6.4, bookmark restore accepts a client-supplied state_id and joins it into the server-side shiny_bookmarks directory without validati…
GHSA-fprf-r6rv-xg99Medium· 5.4Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants
Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants
GHSA-4hv6-xc92-j86gMedium· 6.5Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes
Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes
GHSA-pjr3-86v4-5p7wMedium· 5.4Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2.6.0)
Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2.6.0)
GHSA-hjx8-qv73-f7cmMedium· 6.5Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed
Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed
GHSA-fmmf-xq98-g327MediumVikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check
Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check
GHSA-m687-p538-r5hpHighVikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted
Vikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted
CVE-2026-107841Medium· 5.7pacioli provides least-privilege governance and a governed agent broker for ERPNext
pacioli provides least-privilege governance and a governed agent broker for ERPNext. From version 0.9.6 until version 0.10.0, the pacioli-guard document-layer consent gate allows nested cancellation operations to ride any consent establi…
CVE-2026-107840High· 7.5yopass is a service for securely sharing secrets, passwords, and files
yopass is a service for securely sharing secrets, passwords, and files. Prior to version 14.7.0, the Prometheus metrics middleware in pkg/server/server.go uses the attacker-controlled r.Method value directly as the method label for yopas…
CVE-2026-107839High· 7.5PoCageLANServer provides a cross-platform web server and launcher for offline multiplayer in several Age of Empires and Age of Mythology games
ageLANServer provides a cross-platform web server and launcher for offline multiplayer in several Age of Empires and Age of Mythology games. Prior to version 1.15.2, the AoE3 POST /game/cloud/getFileURL handler in the bundled game server…
CVE-2026-107835Medium· 4.0PoCOWASP Coraza WAF is a golang modsecurity compatible web application firewall library
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Prior to 3.8.1, internal/cookies.ParseCookies in internal/cookies/cookies.go handles boundary ASCII control characters and control-only or empty cookie…
GHSA-p3pr-8f3m-4qp8Medium· 6.4pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host
pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host
GHSA-fr26-jjhm-638cHighpyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=)
pyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=)
GHSA-jq7h-wrvp-3rgxHigh· 7.5pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's session
pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's session
GHSA-889w-m37p-88m5High· 7.5pyLoad: Api.set_user_permission never invalidates the target's session
pyLoad: Api.set_user_permission never invalidates the target's session
GHSA-9q47-3cm2-2rp8MediumpyLoad: Rate-Limit Bypass and Audit-Log Spoofing via Trusted Client-Controlled `X-Forwarded-For` Header
pyLoad: Rate-Limit Bypass and Audit-Log Spoofing via Trusted Client-Controlled `X-Forwarded-For` Header
GHSA-68w4-83fh-f2w8High· 8.1pyload-ng: getUserData/get_userdata exposed at Perms.ANY allow any authenticated account to brute-force the administrator password
pyload-ng: getUserData/get_userdata exposed at Perms.ANY allow any authenticated account to brute-force the administrator password
CVE-2026-107825Medium· 4.0PoCOWASP Coraza WAF is a golang modsecurity compatible web application firewall library
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessURI in internal/corazawaf/transaction.go handles a url.ParseRequestURI failure by retaining the raw URI but leaving QUER…
CVE-2026-107834Medium· 5.3OWASP Coraza WAF is a golang modsecurity compatible web application firewall library
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the multipart loop in internal/bodyprocessors/multipart.go executes defer temp.Close() for every uploaded file part, so each te…
CVE-2026-107833Medium· 5.9PoCOWASP Coraza WAF is a golang modsecurity compatible web application firewall library
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessResponse in internal/bodyprocessors/json.go passes the ignoreJSONRecursionLimit value of -1 to readJSON, while the recur…
CVE-2026-107826High· 7.5PoCOWASP Coraza WAF is a golang modsecurity compatible web application firewall library
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, readJSON in internal/bodyprocessors/json.go can stop its bounded flattening walk after reaching SecArgumentsLimit or the byte b…
CVE-2026-48484Medium· 6.5PoCpyLoad is a free and open-source download manager written in Python
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the API `rpc` function in `api_blueprint.py` handles `multipart/form-data` uploads by reading the whole content of the uploaded file into memor…
CVE-2026-75597Medium· 5.3PoCpyLoad is a free and open-source download manager written in Python
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the `/web/<path:filename>` route in `src/pyload/webui/app/blueprints/app_blueprint.py` renders Jinja2 templates without any authentication requ…