Skip to content
OpenAdvisories

Archive

8 November 2026

Vulnerabilities first published on this day (UTC), newest first.

← October 2026 2026 / November /8
  1. 1102
  2. 2473
  3. 3780
  4. 4395
  5. 5456
  6. 6465
  7. 7474
  8. 8323
  9. 9525
  10. 102065
  11. 11692
  12. 12388
  13. 13771
  14. 1465
  15. 1580
  16. 16 
  17. 17 
  18. 18 
  19. 19 
  20. 20 
  21. 21 
  22. 22 
  23. 23 
  24. 24 
  25. 25 
  26. 26 
  27. 27 
  28. 28 
  29. 29 
  30. 30 
All Critical High Medium Low Exploited only Public exploit

323 results · Feed

  • Medium 4.6
    CVE-2026-123495

    Vikunja 2.0.0 before 2.7.1 Login CSRF via /api/v2 Login and OIDC Callback

    Vikunja 2.0.0 before 2.7.1 accepts form-encoded bodies on the /api/v2 login and OIDC callback endpoints without CSRF or Origin checks, enabling login cross-site request forgery. An attacker with an account can lure a victim to a page posting the attacker's cr…

    go-vikunja vikunja
  • Low 3.5
    CVE-2026-123494

    Vikunja before 2.7.1 Login CSRF via Migration OAuth Callbacks

    Vikunja before 2.7.1 contains a cross-site request forgery vulnerability that allows attackers to import their data into a victim's account because the Todoist, Microsoft To Do, and Trello migration OAuth callbacks lack a bound state parameter. Attackers can …

    go-vikunja vikunja
  • Medium 5.4
    CVE-2026-123493

    Vikunja from 2.4.0 before 2.7.1 Authentication Bypass via Bot API Tokens

    Vikunja from 2.4.0 before 2.7.1 contains an authentication bypass vulnerability that allows disabled or locked users to retain access through API tokens owned by their bot users. Because token validation only checks the bot's own status, attackers holding pre…

    go-vikunja vikunja