https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T22:01:25.381764+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-371591 EUVD-2026-371591 2026-10-07T22:01:25.435973+00:00 EUVD-2026-371591 https://cve.radiocsirt.org/vuln/fkie_cve-2026-91984 fkie_cve-2026-91984 2026-10-07T22:01:25.436012+00:00

Vikunja before 2.6.0 fails to validate that user-supplied project_view_id in task-position requests belongs to the task's project. Authenticated attackers can insert task position rows into arbitrary other tenant project views via POST or PUT task-position endpoints.

 https://cve.radiocsirt.org/vuln/ghsa-ccgq-fx7h-2v4c GHSA-ccgq-fx7h-2v4c 2026-10-07T22:01:25.436047+00:00

Vikunja before 2.6.0 fails to validate that user-supplied project_view_id in task-position requests belongs to the task's project. Authenticated attackers can insert task position rows into arbitrary other tenant project views via POST or PUT task-position endpoints.