Archive
9 October 2026
Vulnerabilities first published on this day (UTC), newest first.
18 results · Clear filters · Feed
-
Low —
Vikunja: Task relation deletion does not check read access to the other task, allowing cross-project relation removal
## Summary Deleting a task relation only requires write access on the base task. Unlike relation creation, it does not verify that the caller can read the other task. A user with write access to one project can therefore delete relations whose other end lives…
-
Low 3.5
Contao: Cross-site request forgery in custom backend actions
Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, RequestTokenListener validates REQUEST_TOKEN only for POST requests, while the declarative GET guard runs only when an act parameter is present. Backend actions dispatched through the k…
-
Low 1.9
Missing authorization in illumos zonestatd allows local users to disrupt zonestat and enumerate running zones
A missing authorization check in the illumos zones statistics daemon (zonestatd) allows a local user in any zone to disrupt zonestat in other zones and to determine which zones are running. The zonestatd door server procedure, zsd_server() in usr/src/cmd/zone…
-
Low 1.9
Missing authorization in illumos ipmgmtd allows local users to change persistent IPMP group membership
A missing authorization check in the illumos IP management daemon (ipmgmtd) allows a local user to change the persistent IP multipathing (IPMP) configuration. The ipmgmtd door dispatch table in usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmt_door.c does not require t…
-
Low 3.6
The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate bounds checking when par…
-
Low 3.6
The Affinity by Canva application before 3.3.1 (October 2026 release) did not correctly handle incomplete UTF-8 charact…
-
Low 3.6
The Affinity by Canva app for macOS before 3.3.1 (October 2026 release) did not perform adequate bounds checking when g…
-
Low 2.9
The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not validate image dimensions again…
-
Low 3.6
The Affinity by Canva app before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing Aff…
-
Low 3.7
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Generation of Error Message …
-
Low 3.8
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Check for Unusual …
-
Low 3.1
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Validation of Spec…
-
Low 3.7
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Use of Less Trusted Source …
-
Low 3.3
Code Snippets < 3.10.0 - Admin+ Network-Scoped Snippet Activation and Deactivation via update_code_snippet
The Code Snippets WordPress plugin before 3.10.0 does not perform a capability check on one of its snippet-management actions and derives the network scope of the targeted snippet from the request instead of from the stored record, allowing an administrator o…
-
Low 3.1
Ops Manager Improper Authorization in Daily Host Monitoring Retrieval
An authenticated Ops Manager user with a read-only project role can retrieve a daily host monitoring record associated with a different project when they possess the required record identifier. Insufficient ownership validation can expose deployment metadata,…
-
Low 3.3
OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation r…
-
Low 2.3
OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When CUPS-Add-Modify-Class replaces…
-
Low 3.3
OpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulnerability in the submission-timeout handling of cup…