https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T17:29:11.960285+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-336579 EUVD-2026-336579 2026-10-06T17:29:12.024607+00:00 EUVD-2026-336579 https://cve.radiocsirt.org/vuln/fkie_cve-2026-25561 fkie_cve-2026-25561 2026-10-06T17:29:12.024642+00:00

WeKan versions prior to 8.19 contain an authorization weakness in the attachment upload API. The API does not fully validate that provided identifiers (such as boardId, cardId, swimlaneId, and listId) are consistent and refer to a coherent card/board relationship, enabling attempts to upload attachments with mismatched object relationships.

 https://cve.radiocsirt.org/vuln/ghsa-5q4r-452w-ggwq GHSA-5q4r-452w-ggwq 2026-10-06T17:29:12.024673+00:00

WeKan versions prior to 8.19 contain an authorization weakness in the attachment upload API. The API does not fully validate that provided identifiers (such as boardId, cardId, swimlaneId, and listId) are consistent and refer to a coherent card/board relationship, enabling attempts to upload attachments with mismatched object relationships.