Skip to content
OpenAdvisories

Vendor

Kovah

19 known vulnerabilities.

Products

LinkAce 19
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium 5.0
    CVE-2026-35516

    LinkAce has SSRF via CheckLinksCommand - Link URL Update Bypasses laravel-html-meta Protection

    LinkAce is a self-hosted archive to collect website links. Prior to 2.5.4, LinkRepository::update and CheckLinksCommand::checkLink do not check for private IPs. An authenticated user can read responses from internal services (AWS IMDSv1, cloud metadata, inter…

    Kovah LinkAce
  • Medium 6.5
    CVE-2026-33954

    LinkAce discloses private notesto unauthorized authenticated users via the web link detail page

    LinkAce is a self-hosted archive to collect website links. In versions prior to 2.5.3, a private note attached to a non-private link can be disclosed to a different authenticated user via the web interface. The API appears to correctly enforce note visibility…

    Kovah LinkAce
  • Medium 5.3
    CVE-2026-30954

    LinkAce has a Cross-User Tag/List Attachment IDOR in processTaxonomy()

    LinkAce is a self-hosted archive to collect website links. In 2.1.0 and earlier, the processTaxonomy() method in LinkRepository.php allows authenticated users to attach other users' private tags and lists to their own links by passing integer IDs.

    Kovah LinkAce
  • Medium 4.6
    CVE-2024-56507

    Reflected Cross-Site Scripting (XSS) Vulnerability in LinkAce

    LinkAce is a self-hosted archive to collect links of your favorite websites. Prior to 1.15.6, a reflected cross-site scripting (XSS) vulnerability exists in the LinkAce. This issue occurs in the "URL" field of the "Edit Link" module, where user input is not p…

    Kovah LinkAce