Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
395 results · page 3 of 8
Apr 10, 2026Vikunja is an open-source self-hosted task management platform.CVE-2026-34727 · Other software · go-vikunja · reported by GitHubHigh 7.4
Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the OIDC callback handler issues a full JWT token without checking whether the matched user has TOTP two-factor authentication enabled. When a local user with TOTP enrolled is matched via the OIDC email fallback mechanism, the second factor is completely skipped. This vulnerability is fixed in 2.3.0.
- Product
- vikunja
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2026Modoboa is a mail hosting and management platform.CVE-2026-27602 · Other software · modoboa · reported by GitHubHigh 7.2
Modoboa is a mail hosting and management platform. Prior to version 2.7.1, `exec_cmd()` in `modoboa/lib/sysutils.py` always runs subprocess calls with `shell=True`. Since domain names flow directly into shell command strings without any sanitization, a Reseller or SuperAdmin can include shell metacharacters in a domain name to run arbitrary OS commands on the server. Version 2.7.1 patches the issue.
- Product
- modoboa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026Vikunja is an open-source self-hosted task management platform.CVE-2026-33700 · Other software · go-vikunja · reported by GitHubMedium 6.9
Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, the `DELETE /api/v1/projects/:project/shares/:share` endpoint does not verify that the link share belongs to the project specified in the URL. An attacker with admin access to any project can delete link shares from other projects by providing their own project ID combined with the target share ID. Version 2.2.1 patches the issue.
- Product
- vikunja
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026Vikunja is an open-source self-hosted task management platform.CVE-2026-33680 · Other software · go-vikunja · reported by GitHubHigh 7.5
Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.2, the `LinkSharing.ReadAll()` method allows link share authenticated users to list all link shares for a project, including their secret hashes. While `LinkSharing.CanRead()` correctly blocks link share users from reading individual shares via `ReadOne`, the `ReadAllWeb` handler bypasses this check by never calling `CanRead()`. An attacker with a read-only link share can retrieve hashes for write or admin link shares on the same project and authenticate with them, escalating to full admin access. Version 2.2.2 patches the issue.
- Product
- vikunja
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026Vikunja is an open-source self-hosted task management platform.CVE-2026-33679 · Other software · go-vikunja · reported by GitHubMedium 6.4
Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, the `DownloadImage` function in `pkg/utils/avatar.go` uses a bare `http.Client{}` with no SSRF protection when downloading user avatar images from the OpenID Connect `picture` claim URL. An attacker who controls their OIDC profile picture URL can force the Vikunja server to make HTTP GET requests to arbitrary internal or cloud metadata endpoints. This bypasses the SSRF protections that are correctly applied to the webhook system. Version 2.2.1 patches the issue.
- Product
- vikunja
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026Vikunja is an open-source self-hosted task management platform.CVE-2026-33678 · Other software · go-vikunja · reported by GitHubHigh 8.1
Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, `TaskAttachment.ReadOne()` queries attachments by ID only (`WHERE id = ?`), ignoring the task ID from the URL path. The permission check in `CanRead()` validates access to the task specified in the URL, but `ReadOne()` loads a different attachment that may belong to a task in another project. This allows any authenticated user to download or delete any attachment in the system by providing their own accessible task ID with a target attachment ID. Attachment IDs are sequential integers, making enumeration trivial. Version 2.2.1 patches the issue.
- Product
- vikunja
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026Vikunja is an open-source self-hosted task management platform.CVE-2026-33677 · Other software · go-vikunja · reported by GitHubMedium 6.5
Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, the `GET /api/v1/projects/:project/webhooks` endpoint returns webhook BasicAuth credentials (`basic_auth_user` and `basic_auth_password`) in plaintext to any user with read access to the project. While the existing code correctly masks the HMAC `secret` field, the BasicAuth fields added in a later migration were not given the same treatment. This allows read-only collaborators to steal credentials intended for authenticating against external webhook receivers. Version 2.2.1 patches the issue.
- Product
- vikunja
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026Vikunja is an open-source self-hosted task management platform.CVE-2026-33676 · Other software · go-vikunja · reported by GitHubMedium 6.5
Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, when the Vikunja API returns tasks, it populates the `related_tasks` field with full task objects for all related tasks without checking whether the requesting user has read permission on those tasks' projects. An authenticated user who can read a task that has cross-project relations will receive full details (title, description, due dates, priority, percent completion, project ID, etc.) of tasks in projects they have no access to. Version 2.2.1 patches the issue.
- Product
- vikunja
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026Vikunja is an open-source self-hosted task management platform.CVE-2026-33675 · Other software · go-vikunja · reported by GitHubMedium 6.4
Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, the migration helper functions `DownloadFile` and `DownloadFileWithHeaders` in `pkg/modules/migration/helpers.go` make arbitrary HTTP GET requests without any SSRF protection. When a user triggers a Todoist or Trello migration, file attachment URLs from the third-party API response are passed directly to these functions, allowing an attacker to force the Vikunja server to fetch internal network resources and return the response as a downloadable task attachment. Version 2.2.1 patches the issue.
- Product
- vikunja
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026Vikunja is an open-source self-hosted task management platform.CVE-2026-33668 · Other software · go-vikunja · reported by GitHubHigh 7.1
Vikunja is an open-source self-hosted task management platform. Starting in version 0.18.0 and prior to version 2.2.1, when a user account is disabled or locked, the status check is only enforced on the local login and JWT token refresh paths. Three other authentication paths — API tokens, CalDAV basic auth, and OpenID Connect — do not verify user status, allowing disabled or locked users to continue accessing the API and syncing data. Version 2.2.1 patches the issue.
- Product
- vikunja
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026Vikunja is an open-source self-hosted task management platform.CVE-2026-33474 · Other software · go-vikunja · reported by GitHubMedium 6.5
Vikunja is an open-source self-hosted task management platform. Starting in version 1.0.0-rc0 and prior to version 2.2.0, unbounded image decoding and resizing during preview generation lets an attacker exhaust CPU and memory with highly compressed but extremely large-dimension images. Version 2.2.0 patches the issue.
- Product
- vikunja
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026Vikunja is an open-source self-hosted task management platform.CVE-2026-33473 · Other software · go-vikunja · reported by GitHubMedium 5.7
Vikunja is an open-source self-hosted task management platform. Starting in version 0.13 and prior to version 2.2.1, any user that has enabled 2FA can have their TOTP reused during the standard 30 second validity window. Version 2.2.1 patches the issue.
- Product
- vikunja
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026Vikunja is an open-source self-hosted task management platform.CVE-2026-33336 · Other software · go-vikunja · reported by GitHubMedium 6.5
Vikunja is an open-source self-hosted task management platform. Starting in version 0.21.0 and prior to version 2.2.0, the Vikunja Desktop Electron wrapper enables `nodeIntegration` in the main BrowserWindow and does not restrict same-window navigations. An attacker who can place a link in user-generated content (task descriptions, comments, project descriptions) can cause the BrowserWindow to navigate to an attacker-controlled origin, where JavaScript executes with full Node.js access, resulting in arbitrary code execution on the victim's machine. Version 2.2.0 patches the issue. ## Root cause Two misconfigurations combine to create this vulnerability: 1. **`nodeIntegration: true`** is set in `BrowserWindow` web preferences (`desktop/main.js:14-16`), giving any page loaded in the renderer full access to Node.js APIs (`require`, `child_process`, `fs`, etc.). 2. **No `will-navigate` or `will-redirect` handler** is registered on the `webContents`. The existing `setWindowOpenHandler` (`desktop/main.js:19-23`) only intercepts `window.open()` calls (new-window requests). It does **not** intercept same-window navigations triggered by: - `<a href="https://...">` links (without `tar
- Product
- vikunja
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026Vikunja is an open-source self-hosted task management platform.CVE-2026-33335 · Other software · go-vikunja · reported by GitHubMedium 6.4
Vikunja is an open-source self-hosted task management platform. Starting in version 0.21.0 and prior to version 2.2.0, the Vikunja Desktop Electron wrapper passes URLs from `window.open()` calls directly to `shell.openExternal()` without any validation or protocol allowlisting. An attacker who can place a link with `target="_blank"` (or that otherwise triggers `window.open`) in user-generated content can cause the victim's operating system to open arbitrary URI schemes, invoking local applications, opening local files, or triggering custom protocol handlers. Version 2.2.0 patches the issue.
- Product
- vikunja
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026Vikunja is an open-source self-hosted task management platform.CVE-2026-33334 · Other software · go-vikunja · reported by GitHubMedium 6.5
Vikunja is an open-source self-hosted task management platform. Starting in version 0.21.0 and prior to version 2.2.0, the Vikunja Desktop Electron wrapper enables `nodeIntegration` in the renderer process without `contextIsolation` or `sandbox`. This means any cross-site scripting (XSS) vulnerability in the Vikunja web frontend -- present or future -- automatically escalates to full remote code execution on the victim's machine, as injected scripts gain access to Node.js APIs. Version 2.2.0 fixes the issue.
- Product
- vikunja
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026Vikunja is an open-source self-hosted task management platform.CVE-2026-33316 · Other software · go-vikunja · reported by GitHubHigh 8.1
Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.0, a flaw in Vikunja’s password reset logic allows disabled users to regain access to their accounts. The `ResetPassword()` function sets the user’s status to `StatusActive` after a successful password reset without verifying whether the account was previously disabled. By requesting a reset token through `/api/v1/user/password/token` and completing the reset via `/api/v1/user/password/reset`, a disabled user can reactivate their account and bypass administrator-imposed account disablement. Version 2.2.0 patches the issue.
- Product
- vikunja
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026Vikunja is an open-source self-hosted task management platform.CVE-2026-33315 · Other software · go-vikunja · reported by GitHubMedium 6.9
Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.0, the Caldav endpoint allows login using Basic Authentication, which in turn allows users to bypass the TOTP on 2FA-enabled accounts. The user can then access standard project information that would normally be protected behind 2FA (if enabled), such as project name, description, etc. Version 2.2.0 patches the issue.
- Product
- vikunja
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026Vikunja is an open-source self-hosted task management platform.CVE-2026-33313 · Other software · go-vikunja · reported by GitHubMedium 5.3
Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.0, an authenticated user can read any task comment by ID, regardless of whether they have access to the task the comment belongs to, by substituting the task ID in the API URL with a task they do have access to. Version 2.2.0 fixes the issue.
- Product
- vikunja
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2026A vulnerability has been found in Tiandy Easy7 Integrated Management Platform up to 7.17.0.CVE-2026-4585 · Other software · Tiandy · reported by VulDBHigh 8.9
A vulnerability has been found in Tiandy Easy7 Integrated Management Platform up to 7.17.0. This vulnerability affects unknown code of the file /Easy7/apps/WebService/ImportSystemConfiguration.jsp of the component Configuration Handler. The manipulation of the argument File leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Easy7 Integrated Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2026Vikunja is an open-source self-hosted task management platform.CVE-2026-33312 · Other software · go-vikunja · reported by GitHubMedium 5.3
Vikunja is an open-source self-hosted task management platform. Starting in version 0.20.2 and prior to version 2.2.0, the `DELETE /api/v1/projects/:project/background` endpoint checks `CanRead` permission instead of `CanUpdate`, allowing any user with read-only access to a project to permanently delete its background image. Version 2.2.0 fixes the issue.
- Product
- vikunja
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2026Vikunja is an open-source self-hosted task management platform.CVE-2026-29794 · Other software · go-vikunja · reported by GitHubMedium 5.3
Vikunja is an open-source self-hosted task management platform. Starting in version 0.8 and prior to version 2.2.0, unauthenticated users are able to bypass the application's built-in rate-limits by spoofing the `X-Forwarded-For` or `X-Real-IP` headers due to the rate-limit relying on the value of `(echo.Context).RealIP`. Unauthenticated users can abuse endpoints available to them for different potential impacts. The immediate concern would be brute-forcing usernames or specific accounts' passwords. This bypass allows unlimited requests against unauthenticated endpoints. Version 2.2.0 patches the issue.
- Product
- vikunja
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2026ZITADEL is an open source identity management platform.CVE-2026-33132 · Other software · zitadel · reported by GitHubMedium 5.3
ZITADEL is an open source identity management platform. Versions prior to 3.4.9 and 4.0.0 through 4.12.2 allowed users to bypass organization enforcement during authentication. Zitadel allows applications to enforce an organzation context during authentication using scopes (urn:zitadel:iam:org:id:{id} and urn:zitadel:iam:org:domain:primary:{domainname}). If enforced, a user needs to be part of the required organization to sign in. While this was properly enforced for OAuth2/OIDC authorization requests in login V1, corresponding controls were missing for device authorization requests and all login V2 and OIDC API V2 endpoints. This allowed users to bypass the restriction and sign in with users from other organizations. Note that this enforcement allows for an additional check during authentication and applications relying on authorizations / roles assignments are not affected by this bypass. This issue has been patched in versions 3.4.9 and 4.12.3.
- Product
- zitadel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026A security vulnerability has been detected in Tiandy Easy7 Integrated Management Platform up to 7.17.0.CVE-2026-4289 · Other software · Tiandy · reported by VulDBMedium 5.5
A security vulnerability has been detected in Tiandy Easy7 Integrated Management Platform up to 7.17.0. This affects an unknown function of the file /rest/preSetTemplate/getRecByTemplateId. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Easy7 Integrated Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026A weakness has been identified in Tiandy Easy7 Integrated Management Platform 7.17.0.CVE-2026-4288 · Other software · Tiandy · reported by VulDBMedium 5.5
A weakness has been identified in Tiandy Easy7 Integrated Management Platform 7.17.0. The impacted element is an unknown function of the file /rest/devStatus/getDevDetailedInfo of the component Endpoint. Executing a manipulation of the argument ID can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Easy7 Integrated Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026A security flaw has been discovered in Tiandy Easy7 Integrated Management Platform 7.17.0.CVE-2026-4287 · Other software · Tiandy · reported by VulDBMedium 5.5
A security flaw has been discovered in Tiandy Easy7 Integrated Management Platform 7.17.0. The affected element is an unknown function of the file /rest/devStatus/queryResources of the component Endpoint. Performing a manipulation of the argument areaId results in sql injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Easy7 Integrated Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026A vulnerability was determined in Tiandy Integrated Management Platform 7.17.0.CVE-2026-4232 · Other software · Tiandy · reported by VulDBMedium 5.5
A vulnerability was determined in Tiandy Integrated Management Platform 7.17.0. Affected by this issue is some unknown functionality of the file /rest/user/getAuthorityByUserId. Executing a manipulation of the argument userId can lead to sql injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Integrated Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026A vulnerability was found in Tiandy Easy7 Integrated Management Platform 7.17.0.CVE-2026-4221 · Other software · Tiandy · reported by VulDBMedium 5.5
A vulnerability was found in Tiandy Easy7 Integrated Management Platform 7.17.0. This affects an unknown part of the file /rest/file/uploadLedImage of the component Endpoint. The manipulation of the argument File results in unrestricted upload. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Easy7 Integrated Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026A vulnerability has been found in Technologies Integrated Management Platform 7.17.0.CVE-2026-4220 · Other software · Technologies · reported by VulDBMedium 5.5
A vulnerability has been found in Technologies Integrated Management Platform 7.17.0. Affected by this issue is some unknown functionality of the file /SetWebpagePic.jsp. The manipulation of the argument targetPath/Suffix leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Integrated Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026A vulnerability was identified in Tiandy Easy7 Integrated Management Platform 7.17.0.CVE-2026-4187 · Other software · Tiandy · reported by VulDBMedium 5.5
A vulnerability was identified in Tiandy Easy7 Integrated Management Platform 7.17.0. Impacted is an unknown function of the file /WebService/UpdateLocalDevInfo.jsp of the component Device Identifier Handler. Such manipulation of the argument username/password leads to missing authentication. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Easy7 Integrated Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2026ZITADEL is an open source identity management platform.CVE-2026-32132 · Other software · zitadel · reported by GitHubHigh 7.4
ZITADEL is an open source identity management platform. Prior to 3.4.8 and 4.12.2, a potential vulnerability exists in Zitadel's passkey registration endpoints. This endpoint allows registering a new passkey using a previously retrieved code. An improper expiration check of the code, could allow an attacker to potentially register their own passkey and gain access to the victim's account. This vulnerability is fixed in 3.4.8 and 4.12.2.
- Product
- zitadel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2026ZITADEL is an open source identity management platform.CVE-2026-32131 · Other software · zitadel · reported by GitHubHigh 7.7
ZITADEL is an open source identity management platform. Prior to 3.4.8 and 4.12.2, a vulnerability in Zitadel's Management API has been reported, which allowed authenticated users holding a valid low-privilege token (e.g., project.read, project.grant.read, or project.app.read) to retrieve management-plane information belonging to other organizations by specifying a different tenant’s project_id, grant_id, or app_id. This vulnerability is fixed in 3.4.8 and 4.12.2.
- Product
- zitadel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2026ZITADEL is an open source identity management platform.CVE-2026-32130 · Other software · zitadel · reported by GitHubHigh 7.5
ZITADEL is an open source identity management platform. From 2.68.0 to before 3.4.8 and 4.12.2, Zitadel provides a System for Cross-domain Identity Management (SCIM) API to provision users from external providers into Zitadel. Request to the API with URL-encoded path values were correctly routed but would bypass necessary authentication and permission checks. This allowed unauthenticated attackers to retrieve sensitive information such as names, email addresses, phone numbers, addresses, external IDs, and roles. Note that due to additional checks when manipulating data, an attacker could not modify or delete any user data. This vulnerability is fixed in 3.4.8 and 4.12.2.
- Product
- zitadel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2026Taskosaur is an open source project management platform with conversational AI for task execution in-app.CVE-2026-31874 · Other software · Taskosaur · reported by GitHubCritical 9.8
Taskosaur is an open source project management platform with conversational AI for task execution in-app. In 1.0.0, the application does not properly validate or restrict the role parameter during the user registration process. An attacker can manually modify the request payload and assign themselves elevated privileges. Because the backend does not enforce role assignment restrictions or ignore client-supplied role parameters, the server accepts the manipulated value and creates the account with SUPER_ADMIN privileges. This allows any unauthenticated attacker to register a fully privileged administrative account.
- Product
- Taskosaur
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2026Epross AVCON6 systems management platform contains an object-graph navigation language (OGNL) injection vulnerability that allows unauthenticated attackers to eCVE-2018-25159 · Other software · Epross · reported by VulnCheckCritical 9.3
Epross AVCON6 systems management platform contains an object-graph navigation language (OGNL) injection vulnerability that allows unauthenticated attackers to execute arbitrary commands by injecting malicious OGNL expressions. Attackers can send crafted requests to the login.action endpoint with OGNL payloads in the redirect parameter to instantiate ProcessBuilder objects and execute system commands with root privileges.
- Product
- AVCON6 systems management platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comvulncheck.com
Mar 7, 2026ZITADEL is an open source identity management platform.CVE-2026-29193 · Other software · zitadel · reported by GitHubHigh 8.2
ZITADEL is an open source identity management platform. From version 4.0.0 to 4.12.0, a vulnerability in Zitadel's login V2 UI allowed users to bypass login behavior and security policies and self-register new accounts or sign in using password even if corresponding options were disabled in their organizaton. This issue has been patched in version 4.12.1.
- Product
- zitadel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2026ZITADEL is an open source identity management platform.CVE-2026-29192 · Other software · zitadel · reported by GitHubHigh 7.7
ZITADEL is an open source identity management platform. From version 4.0.0 to 4.11.1, a vulnerability in Zitadel's login V2 interface was discovered that allowed a possible account takeover via Default URI Redirect. This issue has been patched in version 4.12.0.
- Product
- zitadel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2026ZITADEL is an open source identity management platform.CVE-2026-29191 · Other software · zitadel · reported by GitHubCritical 9.3
ZITADEL is an open source identity management platform. From version 4.0.0 to 4.11.1, a vulnerability in Zitadel's login V2 interface was discovered that allowed a possible account takeover via XSS in /saml-post Endpoint. This issue has been patched in version 4.12.0.
- Product
- zitadel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2026ZITADEL is an open source identity management platform.CVE-2026-29067 · Other software · zitadel · reported by GitHubHigh 8.1
ZITADEL is an open source identity management platform. From version 4.0.0-rc.1 to 4.7.0, a potential vulnerability exists in ZITADEL's password reset mechanism in login V2. ZITADEL utilizes the Forwarded or X-Forwarded-Host header from incoming requests to construct the URL for the password reset confirmation link. This link, containing a secret code, is then emailed to the user. This issue has been patched in version 4.7.1.
- Product
- zitadel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2026Vikunja is an open-source self-hosted task management platform.CVE-2026-28268 · Other software · go-vikunja · reported by GitHubCritical 9.8
Vikunja is an open-source self-hosted task management platform. Versions prior to 2.1.0 have a business logic vulnerability exists in the password reset mechanism of vikunja/api that allows password reset tokens to be reused indefinitely. Due to a failure to invalidate tokens upon use and a critical logic bug in the token cleanup cron job, reset tokens remain valid forever. This allows an attacker who intercepts a single reset token (via logs, browser history, or phishing) to perform a complete, persistent account takeover at any point in the future, bypassing standard authentication controls. Version 2.1.0 contains a patch for the issue.
- Product
- vikunja
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2026Initiative is a self-hosted project management platform.CVE-2026-28276 · Other software · Morelitea · reported by GitHubHigh 7.5
Initiative is a self-hosted project management platform. An access control vulnerability exists in Initiative versions prior to 0.32.2 where uploaded documents are served from a publicly accessible /uploads/ directory without any authentication or authorization checks. Any uploaded file can be accessed directly via its URL by unauthenticated users (e.g., in an incognito browser session), leading to potential disclosure of sensitive documents. The problem was patched in v0.32.2, and the patch was further improved on in 032.4.
- Product
- initiative
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2026Initiative is a self-hosted project management platform.CVE-2026-28275 · Other software · Morelitea · reported by GitHubHigh 8.1
Initiative is a self-hosted project management platform. Versions of the application prior to 0.32.4 do not invalidate previously issued JWT access tokens after a user changes their password. As a result, older tokens remain valid until expiration and can still be used to access protected API endpoints. This behavior allows continued authenticated access even after the account password has been updated. Version 0.32.4 fixes the issue.
- Product
- initiative
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2026Initiative is a self-hosted project management platform.CVE-2026-28274 · Other software · Morelitea · reported by GitHubHigh 8.7
Initiative is a self-hosted project management platform. Versions of the application prior to 0.32.4 are vulnerable to Stored Cross-Site Scripting (XSS) in the document upload functionality. Any user with upload permissions within the "Initiatives" section can upload a malicious `.html` or `.htm` file as a document. Because the uploaded HTML file is served under the application's origin without proper sandboxing, the embedded JavaScript executes in the context of the application. As a result, authentication tokens, session cookies, or other sensitive data can be exfiltrated to an attacker-controlled server. Additionally, since the uploaded file is hosted under the application's domain, simply sharing the direct file link may result in execution of the malicious script when accessed. Version 0.32.4 fixes the issue.
- Product
- initiative
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2026ZITADEL is an open source identity management platform.CVE-2026-27946 · Other software · zitadel · reported by GitHubHigh 8.2
ZITADEL is an open source identity management platform. Prior to versions 4.11.1 and 3.4.7, a vulnerability in Zitadel's self-management capability allowed users to mark their email and phone as verified without going through an actual verification process. The patch in versions 4.11.1 and 3.4.7 resolves the issue by requiring the correct permission in case the verification flag is provided and only allows self-management of the email address and/or phone number itself. If an upgrade is not possible, an action (v2) could be used to prevent setting the verification flag on the own user.
- Product
- zitadel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2026ZITADEL is an open source identity management platform.CVE-2026-27945 · Other software · zitadel · reported by GitHubLow 2.1
ZITADEL is an open source identity management platform. Zitadel Action V2 (introduced as early preview in 2.59.0, beta in 3.0.0 and GA in 4.0.0) is a webhook based approach to allow developers act on API request to Zitadel and customize flows such the issue of a token. Zitadel's Action target URLs can point to local hosts, potentially allowing adversaries to gather internal network information and connect to internal services. When the URL points to a local host / IP address, an adversary might gather information about the internal network structure, the services exposed on internal hosts etc. This is sometimes called a Server-Side Request Forgery (SSRF). Zitadel Actions expect responses according to specific schemas, which reduces the threat vector. The patch in version 4.11.1 resolves the issue by checking the target URL against a denylist. By default localhost, resp. loopback IPs are denied. Note that this fix was only released on v4.x. Due to the stage (preview / beta) in which the functionality was in v2.x and v3.x, the changes that have been applied to it since then and the severity, respectively the actual thread vector, a backport to the corresponding versions was not feasi
- Product
- zitadel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2026ZITADEL is an open source identity management platform.CVE-2026-27840 · Other software · zitadel · reported by GitHubMedium 4.3
ZITADEL is an open source identity management platform. Starting in version 2.31.0 and prior to versions 3.4.7 and 4.11.0, opaque OIDC access tokens in the v2 format truncated to 80 characters are still considered valid. Zitadel uses a symmetric AES encryption for opaque tokens. The cleartext payload is a concatenation of a couple of identifiers, such as a token ID and user ID. Internally Zitadel has 2 different versions of token payloads. v1 tokens are no longer created, but are still verified as to not invalidate existing session after upgrade. The cleartext payload has a format of `<token_id>:<user_id>`. v2 tokens distinguished further where the `token_id` is of the format `v2_<oidc_session_id>-at_<access_token_id>`. V1 token authZ/N session data is retrieved from the database using the (simple) `token_id` value and `user_id` value. The `user_id` (called `subject` in some parts of our code) was used as being the trusted user ID. V2 token authZ/N session data is retrieved from the database using the `oidc_session_id` and `access_token_id` and in this case the `user_id` from the token is ignored and taken from the session data in the database. By truncating the token to 80 chars,
- Product
- zitadel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2026Vikunja is an open-source self-hosted task management platform.CVE-2026-27819 · Other software · go-vikunja · reported by GitHubHigh 7.2
Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, the restoreConfig function in vikunja/pkg/modules/dump/restore.go of the go-vikunja/vikunja repository fails to sanitize file paths within the provided ZIP archive. A maliciously crafted ZIP can bypass the intended extraction directory to overwrite arbitrary files on the host system. Additionally, we’ve discovered that a malformed archive triggers a runtime panic, crashing the process immediately after the database has been wiped permanently. The application trusts the metadata in the ZIP archive. It uses the Name attribute of the zip.File struct directly in os.OpenFile calls without validation, allowing files to be written outside the intended directory. The restoration logic assumes a specific directory structure within the ZIP. When provided with a "minimalist" malicious ZIP, the application fails to validate the length of slices derived from the archive contents. Specifically, at line 154, the code attempts to access an index of len(ms)-2 on an insufficiently populated slice, triggering a panic. Version 2.0.0 fixes the issue.
- Product
- vikunja
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2026Vikunja is an open-source self-hosted task management platform.CVE-2026-27616 · Other software · go-vikunja · reported by GitHubHigh 7.3
Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, the application allows users to upload SVG files as task attachments. SVG is an XML-based format that supports JavaScript execution through elements such as <script> tags or event handlers like onload. The application does not sanitize SVG content before storing it. When the uploaded SVG file is accessed via its direct URL, it is rendered inline in the browser under the application's origin. As a result, embedded JavaScript executes in the context of the authenticated user. Because the authentication token is stored in localStorage, it is accessible via JavaScript and can be retrieved by a malicious payload. Version 2.0.0 patches this issue.
- Product
- vikunja
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2026Vikunja is an open-source self-hosted task management platform.CVE-2026-27575 · Other software · go-vikunja · reported by GitHubCritical 9.1
Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, the application allows users to set weak passwords (e.g., 1234, password) without enforcing minimum strength requirements. Additionally, active sessions remain valid after a user changes their password. An attacker who compromises an account (via brute-force or credential stuffing) can maintain persistent access even after the victim resets their password. Version 2.0.0 contains a fix.
- Product
- vikunja
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2026Vikunja is an open-source self-hosted task management platform.CVE-2026-27116 · Other software · go-vikunja · reported by GitHubMedium 6.1
Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, a reflected HTML injection vulnerability exists in the Projects module where the `filter` URL parameter is rendered into the DOM without output encoding when the user clicks "Filter." While `<script>` and `<iframe>` are blocked, `<svg>`, `<a>`, and formatting tags (`<h1>`, `<b>`, `<u>`) render without restriction — enabling SVG-based phishing buttons, external redirect links, and content spoofing within the trusted application origin. Version 2.0.0 fixes this issue.
- Product
- vikunja
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2026Pimcore is an Open Source Data & Experience Management Platform.CVE-2026-27461 · Other software · pimcore · reported by GitHubMedium 6.9
Pimcore is an Open Source Data & Experience Management Platform. In versions up to and including 11.5.14.1 and 12.3.2, the filter query parameter in the dependency listing endpoints is JSON-decoded and the value field is concatenated directly into RLIKE clauses without sanitization or parameterized queries. Exploiting this issue requires admin authentication. An attacker with admin panel access can extract the full database including password hashes of other admin users. Version 12.3.3 contains a patch.
- Product
- pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.