Security advisories

medium2026-04-10

CVE-2026-34480-Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters

apache/logging-log4j2 · GHSA-3pxv-7cmr-fjr4

low2026-04-10

CVE-2026-40077-Beszel has an IDOR in hub API endpoints that read system ID from URL parameter

henrygd/beszel · GHSA-5f5r-95pg-xrpm

medium2026-04-10

CVE-2026-40074-@sveltejs/kit: Unvalidated redirect in handle hook causes Denial-of-Service

sveltejs/kit · GHSA-3f6h-2hrp-w5wx

high2026-04-10

CVE-2026-40073-@sveltejs/adapter-node has a BODY_SIZE_LIMIT bypass

sveltejs/kit · GHSA-2crg-3p73-43xp

medium2026-04-10

CVE-2026-39961-Aiven Operator has cross-namespace secret exfiltration via ClickhouseUser connInfoSecretSource

aiven/aiven-operator · GHSA-99j8-wv67-4c72

medium2026-04-10

CVE-2026-40103-Vikunja: Scoped API tokens with projects.background permission can delete project backgrounds

go-vikunja/vikunja · GHSA-v479-vf79-mg83

high2026-04-10

@vitejs/plugin-rsc has a Denial of Service with React Server Components

vitejs/vite-plugin-react · GHSA-v457-wxvj-p9w9

high2026-04-10

Next.js has a Denial of Service with Server Components

vercel/next.js · GHSA-q4gf-8mx6-v5v3

high2026-04-10

CVE-2026-23869-React Server Components have a Denial of Service Vulnerability

facebook/react · GHSA-479c-33wc-g2pg

medium2026-04-10

CVE-2026-35602-Vikunja has File Size Limit Bypass via Vikunja Import

go-vikunja/vikunja · GHSA-qh78-rvg3-cv54

medium2026-04-10

CVE-2026-35601-Vikunja has iCalendar Property Injection via CRLF in CalDAV Task Output

go-vikunja/vikunja · GHSA-2g7h-7rqr-9p4r

medium2026-04-10

CVE-2026-35600-Vikunja has HTML Injection via Task Titles in Overdue Email Notifications

go-vikunja/vikunja · GHSA-45q4-x4r9-8fqj

medium2026-04-10

CVE-2026-35599-Vikunja has Algorithmic Complexity DoS in Repeating Task Handler

go-vikunja/vikunja · GHSA-r4fg-73rc-hhh7

medium2026-04-10

CVE-2026-35598-Vikunja Missing Authorization on CalDAV Task Read

go-vikunja/vikunja · GHSA-48ch-p4gq-x46x

medium2026-04-10

CVE-2026-35597-Vikunja Vulnerable to TOTP Brute-Force Due to Non-Functional Account Lockout

go-vikunja/vikunja · GHSA-fgfv-pv97-6cmj

medium2026-04-10

CVE-2026-35596-Vikunja has Broken Access Control on Label Read via SQL Operator Precedence Bug

go-vikunja/vikunja · GHSA-hj5c-mhh2-g7jq

high2026-04-10

CVE-2026-35595-Vikunja vulnerable to Privilege Escalation via Project Reparenting

go-vikunja/vikunja · GHSA-2vq4-854f-5c72

medium2026-04-10

CVE-2026-35206-Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment

helm/helm · GHSA-hr2v-4r36-88hr

high2026-04-10

CVE-2026-35205-Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install

helm/helm · GHSA-q5jf-9vfq-h4h7

high2026-04-10

CVE-2026-35204-Helm has a path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory

helm/helm · GHSA-vmx8-mqv2-9gmg