•about 2 hours ago•CVE-2026-107848
3.5CVE-2026-107848: Cross-Site Request Forgery (CSRF) in Contao Backend Actions via GET Requests
Contao Open Source CMS versions 4.0.0 through 5.3.49 and 5.4.0-RC1 through 5.7.11 contain a Cross-Site Request Forgery (CSRF) vulnerability in backend parameter handling. The `RequestTokenListener` component validates anti-CSRF tokens solely for HTTP POST requests, while GET-based declarative guards run only when an `act` parameter is present in the query string. Consequently, custom backend actions dispatched via alternative parameters such as `key=` can execute without CSRF token verification when triggered by an authenticated user.
3 views•5 min read
•about 3 hours ago•CVE-2026-107843
5.3CVE-2026-107843: Unthrottled Activation Email Resend and Account Enumeration in Contao CMS
Contao CMS versions 4.1.0 through 5.3.49 and 5.4.0-RC1 through 5.7.11 fail to validate form submission tokens and enforce rate limiting when processing activation email resend requests via HTTP POST, enabling resource exhaustion and account state enumeration.
5 views•4 min read
•about 4 hours ago•CVE-2026-107842
5.3CVE-2026-107842: Information Disclosure via Stale Indexing in Contao Search Module
An information disclosure vulnerability in Contao CMS allows unauthenticated site visitors to view protected page titles, URLs, and text excerpts through search queries when protected page indexing is disabled after previously being enabled.
7 views•4 min read
•about 5 hours ago•GHSA-G38J-7V97-X298
6.5GHSA-G38J-7V97-X298: Missing Authorization Check in Vikunja CalDAV Task Relation Creation
In Vikunja prior to version 2.6.0, relation creation via the CalDAV endpoint fails to invoke the TaskRelation.CanCreate authorization check. This missing access control allows an authenticated user to establish unauthorized relationships and perform write operations against any task, provided its unique identifier (UID) is known.
10 views•5 min read
•about 6 hours ago•GHSA-3HC7-R24J-RPWC
6.8GHSA-3hc7-r24j-rpwc: Cross-Project Task Disclosure via Subtask Expansion in Vikunja
A cross-project information disclosure vulnerability in Vikunja allows authenticated users with read access to one project to view private task details from unauthorized projects via subtask expansion parameters.
8 views•5 min read
•about 7 hours ago•GHSA-8WVG-R2J4-3737
4.3GHSA-8wvg-r2j4-3737: Email Address Exposure in Vikunja Task Assignees API
An information disclosure vulnerability in Vikunja allows authenticated users with read access to a task to expose private email addresses of assigned users through the API task assignees endpoint due to an unmasked database query.
8 views•5 min read
•about 8 hours ago•GHSA-W2CH-4XGR-22WW
5.3GHSA-W2CH-4XGR-22WW: Missing Authorization in Vikunja Task Relation Deletion
An authorization bypass vulnerability in Vikunja versions prior to v2.6.0 permits authenticated users to delete relationships between tasks across project boundaries without requiring read or write authorization for the target related task.
7 views•5 min read
•about 9 hours ago•CVE-2026-108258
6.9CVE-2026-108258: Path Traversal in Shiny for Python Bookmark Restoration
A path traversal vulnerability in Shiny for Python (posit-dev/py-shiny) versions 1.4.0 through 1.6.3 allows unauthenticated remote attackers to read arbitrary files and traverse directories via crafted _state_id_ query parameters.
7 views•4 min read
•about 10 hours ago•CVE-2026-108260
7.6CVE-2026-108260: Stored Cross-Site Scripting (XSS) in @tinacms/web-components
A Stored Cross-Site Scripting vulnerability in @tinacms/web-components prior to version 0.2.1 allows low-privileged content authors to execute arbitrary JavaScript code in the context of website visitors via unsanitized URL attributes in custom Markdown rendering components.
7 views•5 min read
•about 11 hours ago•CVE-2026-108261
9.3CVE-2026-108261: Admin Preview Cross-Origin Bypass and GraphQL Hijacking in TinaCMS
A critical origin validation flaw in TinaCMS admin preview allows unauthenticated attackers to bypass cross-origin postMessage checks and execute unauthorized GraphQL queries and mutations under an authenticated editor's context.
10 views•5 min read
•about 12 hours ago•CVE-2026-108259
8.2CVE-2026-108259: Code Injection in @tinacms/cli via Unsanitized Git Branch Name Interpolation
@tinacms/cli prior to version 3.0.0 dynamically constructs client source files using string interpolation without properly sanitizing runtime configuration variables. An attacker with permissions to create a branch or pull request can inject arbitrary JavaScript statements via a crafted Git ref name, leading to execution during automated build processes.
10 views•5 min read
•about 13 hours ago•CVE-2026-107804
5.3CVE-2026-107804: Client IP Resolution Flaw & Authentication Lockout in Nginx UI
Nginx UI versions 2.2.0 through 2.5.10 fail to properly configure Gin framework trusted proxies when deployed behind a reverse proxy. This causes all incoming HTTP requests to be attributed to the loopback IP (127.0.0.1), enabling IP allowlist bypass and global authentication lockouts.
9 views•5 min read