CVE Notifier

CVE-2026-91922 CWE-79 6.1

Steedos Platform through 3.0.15-beta.47 Reflected XSS via page render

Steedos Platform through 3.0.15-beta.47 contains a reflected cross-site scripting vulnerability in the anonymous /api/page/render endpoint that fails to properly escape query parameters in inline script elements. Attacke…

cve.org steedos:steedos-platform 15 Sep 2026

CVE-2026-1759 CWE-280 6.5

CVE-2026-1759

Improper handling of insufficient permissions or privileges vulnerability in Secomea GateManager allows Privilege Escalation. This issue affects GateManager: 11.5;0, 11.4.625515072:0. Fixed in Version 11.6 or 11.4.62…

cve.org Secomea:GateManager 15 Sep 2026

CVE-2026-80489 CWE-835 5.9

EUC_JISX0213 decoding may hang on crafted input

Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling…

cve.org The · GNU · C 15 Sep 2026

CVE-2026-1758 CWE-384 8.3

Session Fixation

Session fixation vulnerability in Secomea GateManager (webserver module) allows Session Fixation. This issue affects GateManager: 11.5;0, 11.4.625515072:0. Fixed in Version 11.6 or 11.4.626194074 and above

cve.org Secomea:GateManager 15 Sep 2026

CVE-2026-77117 CWE-835 5.9

SHIFT_JISX0213 decoding may hang on crafted input

Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calli…

cve.org The · GNU · C 15 Sep 2026

CVE-2026-52827 CWE-287 N/A

Kimai: Two-factor authentication bypass on the Kimai API

Kimai is an open-source time tracking application. Prior to 2.59.0, the KIMAI_SESSION cookie issued after password verification but before TOTP completion is accepted by every /api route because config/packages/security.…

cve.org kimai:kimai 15 Sep 2026

CVE-2026-52822 CWE-285 N/A

Kimai: Improper Authorization in Kimai Timesheet Restart and Duplicate Allows New Timesheets After Project Access Revocation

Kimai is an open-source time tracking application. Prior to 2.58.0, PATCH /api/timesheets/{id}/restart, PATCH /api/timesheets/{id}/duplicate, and the web duplicate workflow can derive a new record from an owned historica…

cve.org kimai:kimai 15 Sep 2026

CVE-2026-52828 CWE-862 N/A

Kimai: ExportTemplate CRUD Missing Authorization Check Allows Unauthorized TEAMLEAD Access

Kimai is an open-source time tracking application. Prior to 2.58.0, ExportController::createExportTemplate() and ExportController::editExportTemplate() inherit only the class-level create_export permission, which ROLE_TE…

cve.org kimai:kimai 15 Sep 2026

CVE-2026-52826 CWE-285 N/A

Kimai: Improper Authorization in Kimai Project, Customer, and Activity Rate Edit Endpoints Allows Cross-Scope Rate Manipulation

Kimai is an open-source time tracking application. Prior to 2.57.0, GET or POST requests to /en/admin/project/{id}/rate/{rate}, /en/admin/customer/{id}/rate/{rate}, and /en/admin/activity/{id}/rate/{rate} independently r…

cve.org kimai:kimai 15 Sep 2026

CVE-2026-52823 CWE-352 N/A

Kimai: Login CSRF in Kimai Timesheet Stop and Restart API Endpoints Allows Unauthorized State Changes

Kimai is an open-source time tracking application. Prior to 2.58.0, TimesheetController exposes GET /api/timesheets/{id}/stop and GET /api/timesheets/{id}/restart, which reuse an authenticated browser session and perform…

cve.org kimai:kimai 15 Sep 2026

CVE-2026-86818 CWE-172 4.8

fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization

fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv, that added a mailto scheme parser in version 4.1.3. In versions 4.1.3 and 4.1.4, the mailto parser compares each query field name to…

cve.org fast-uri:fast-uri 15 Sep 2026

CVE-2026-52824 CWE-1188 N/A

Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover

Kimai is an open-source time tracking application. Prior to 2.58.0, the official Docker image sets APP_SECRET to the public value change_this_to_something_unique in Dockerfile, and .docker/entrypoint.sh neither replaces …

cve.org kimai:kimai 15 Sep 2026