CVE Notifier

CVE-2026-91987 CWE-770 6.5

atomic-agents-stack before 1.1.0 Cost Guardrail Bypass via Unknown Model

atomic-agents-stack before 1.1.0 contains a cost-guardrail bypass in the _estimate_batch_cost function that returns zero cost for unknown models not in the pricing table. Attackers can configure deployments with unknown …

cve.org dep0we:atomic-agents-stack 15 Sep 2026

CVE-2026-91986 CWE-74 5.4

gitoxide gix-transport before 0.59.2 CR/LF/NUL Injection

gitoxide gix-transport before 0.59.2 fails to filter control characters in git-daemon connect requests, allowing attackers to inject NUL/CR/LF bytes via crafted git URLs. Attackers can inject extra NUL-delimited protocol…

cve.org GitoxideLabs:gitoxide 15 Sep 2026

CVE-2026-91985 CWE-200 7.5

Vikunja before 2.6.0 Privilege Escalation via Link Share Hash

Vikunja before 2.6.0 fails to properly restrict access to the link-share hash field in single-share read endpoints, allowing read-only members to obtain the share's secret credential. Attackers can exchange the disclosed…

cve.org go-vikunja:vikunja 15 Sep 2026

CVE-2026-91984 CWE-639 4.3

Vikunja before 2.6.0 Broken Object-Level Authorization via task-position

Vikunja before 2.6.0 fails to validate that user-supplied project_view_id in task-position requests belongs to the task's project. Authenticated attackers can insert task position rows into arbitrary other tenant project…

cve.org go-vikunja:vikunja 15 Sep 2026

CVE-2026-91983 CWE-863 4.3

Vikunja before 2.6.0 API Token Scope Bypass via expand Parameter

Vikunja before 2.6.0 contains an API token scope bypass vulnerability in task read endpoints where authorization fails to inspect query string parameters. Attackers with limited token scopes can use the expand parameter …

cve.org go-vikunja:vikunja 15 Sep 2026

CVE-2026-91982 CWE-522 4.3

Vikunja before 2.6.0 TOTP Secret Disclosure via API

Vikunja before 2.6.0 continues to expose the raw TOTP shared secret after enrollment through the GET /api/v1/user/settings/totp and /api/v1/user/settings/totp/qrcode endpoints without re-authentication. Attackers with a …

cve.org go-vikunja:vikunja 15 Sep 2026

CVE-2026-91981 CWE-200 4.3

Vikunja before 2.6.0 User Enumeration via v2 API

Vikunja versions before 2.6.0 fail to properly validate link-share tokens in the v2 API user search endpoints. Attackers with a read-only share link can enumerate project users via the projects endpoint and confirm arbit…

cve.org go-vikunja:vikunja 15 Sep 2026

CVE-2026-91980 CWE-200 4.3

vikunja before 2.6.0 Team Enumeration via Project Share

vikunja before 2.6.0 fails to validate team access when attaching teams to projects, allowing authenticated users to enumerate all teams and members. Attackers can attach arbitrary team IDs via the project teams endpoint…

cve.org go-vikunja:vikunja 15 Sep 2026

CVE-2026-91979 CWE-400 6.5

Vikunja before 2.6.0 Denial of Service via Decompression Bomb

Vikunja before 2.6.0 fails to limit archive expansion during data import, allowing authenticated users to cause denial of service. Attackers can upload highly compressed files that expand to tens of gigabytes in memory a…

cve.org go-vikunja:vikunja 15 Sep 2026

CVE-2026-91973 CWE-307 7.5

Vikunja before 2.6.0 Authentication Bypass via CalDAV BasicAuth

Vikunja before 2.6.0 contains an authentication bypass vulnerability in CalDAV BasicAuth endpoints that lack rate limiting protection. Remote unauthenticated attackers can issue unbounded credential-guessing requests aga…

cve.org go-vikunja:vikunja 15 Sep 2026

CVE-2026-91972 CWE-307 7.5

Vikunja before 2.6.0 Authentication Bypass via Unthrottled API

Vikunja versions before 2.6.0 fail to apply rate limiting to /api/v2 public authentication endpoints including login, register, password-reset, and OAuth token routes. Remote unauthenticated attackers can perform unbound…

cve.org go-vikunja:vikunja 15 Sep 2026

CVE-2026-91971 CWE-400 6.5

Vikunja before 2.6.0 Denial of Service via Avatar Upload

Vikunja before 2.6.0 fails to apply pixel decode limits to avatar and project-background upload endpoints, allowing authenticated users to upload crafted images that decode to excessive pixel counts. Attackers can upload…

cve.org go-vikunja:vikunja 15 Sep 2026