Security advisories

medium2026-03-25

CVE-2026-33700-Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion

go-vikunja/vikunja · GHSA-f95f-77jx-fcjc

medium2026-03-25

CVE-2026-33682-Unauthenticated SSRF Vulnerability in Streamlit on Windows (NTLM Credential Exposure)

streamlit/streamlit · GHSA-7p48-42j8-8846

high2026-03-25

CVE-2026-33680-Vikjuna: Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation

go-vikunja/vikunja · GHSA-8hp8-9fhr-pfm9

medium2026-03-25

CVE-2026-33679-Vikjuna Bypasses Webhook SSRF Protections During OpenID Connect Avatar Download

go-vikunja/vikunja · GHSA-g9xj-752q-xh63

high2026-03-25

CVE-2026-33678-Vikjuna: IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion

go-vikunja/vikunja · GHSA-jfmm-mjcp-8wq2

medium2026-03-25

CVE-2026-33677-Vikjuna: Webhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via API

go-vikunja/vikunja · GHSA-7c2g-p23p-4jg3

medium2026-03-25

CVE-2026-33676-Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read

go-vikunja/vikunja · GHSA-8cmm-j6c4-rr8v

medium2026-03-25

CVE-2026-33675-Vikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network Resources

go-vikunja/vikunja · GHSA-g66v-54v9-52pr

medium2026-03-25

CVE-2026-33672-Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching

micromatch/picomatch · GHSA-3v7f-55p6-f55p

high2026-03-25

CVE-2026-33671-Picomatch has a ReDoS vulnerability via extglob quantifiers

micromatch/picomatch · GHSA-c2c7-rcm5-vvqj

high2026-03-25

CVE-2026-33668-Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connect

go-vikunja/vikunja · GHSA-94xm-jj8x-3cr4

high2026-03-25

CVE-2026-33665-n8n: LDAP Email-Based Account Linking Allows Privilege Escalation and Account Takeover

n8n-io/n8n · GHSA-c545-x2rh-82fc

high2026-03-25

CVE-2026-33663-n8n is Vulnerable to Credential Theft via Name-Based Resolution and Permission Checker Bypass in Community Edition

n8n-io/n8n · GHSA-m63j-689w-3j35

critical2026-03-25

CVE-2026-33660-n8n has Multiple Remote Code Execution Vulnerabilities in Merge Node AlaSQL SQL Mode

n8n-io/n8n · GHSA-58qr-rcgv-642v

low2026-03-25

CVE-2026-33658-Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests

rails/rails · GHSA-p9fm-f462-ggrg

medium2026-03-25

smol-toml: Denial of Service via TOML documents containing thousands of consecutive commented lines

squirrelchat/smol-toml · GHSA-v3rj-xjv7-4jmq

high2026-03-25

CVE-2026-6409-Protobuf: Denial of Service issue through malicious messages containing negative varints or deep recursion

protocolbuffers/protobuf · GHSA-p2gh-cfq4-4wjc

medium2026-03-25

CVE-2026-33693-Activitypub-Federation has SSRF via 0.0.0.0 bypass in activitypub-federation-rust v4_is_invalid()

lemmynet/activitypub-federation-rust · GHSA-q537-8fr5-cw35

high2026-03-25

CVE-2026-33548-MantisBT has Stored HTML Injection/XSS when displaying Tags in Timeline

mantisbt/mantisbt · GHSA-73vx-49mv-v8w5

medium2026-03-25

CVE-2026-33532-yaml is vulnerable to Stack Overflow via deeply nested YAML collections

eemeli/yaml · GHSA-48c2-rrv3-qjmp