https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T04:06:42.359636+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-368715 EUVD-2026-368715 2026-10-06T04:06:42.420416+00:00 EUVD-2026-368715 https://cve.radiocsirt.org/vuln/fkie_cve-2026-91980 fkie_cve-2026-91980 2026-10-06T04:06:42.420462+00:00

vikunja before 2.6.0 fails to validate team access when attaching teams to projects, allowing authenticated users to enumerate all teams and members. Attackers can attach arbitrary team IDs via the project teams endpoint to retrieve complete team rosters including member names and admin flags for unauthorized teams.

 https://cve.radiocsirt.org/vuln/ghsa-2922-qgfj-pr7v GHSA-2922-qgfj-pr7v 2026-10-06T04:06:42.420497+00:00

vikunja before 2.6.0 fails to validate team access when attaching teams to projects, allowing authenticated users to enumerate all teams and members. Attackers can attach arbitrary team IDs via the project teams endpoint to retrieve complete team rosters including member names and admin flags for unauthorized teams.