CVE ID :CVE-2026-58660 Published : July 15, 2026, 6:16 p.m. | 17 minutes ago Description :Kanboard through 1.2.52, fixed in commit 564cc30, BoardAjaxController save() method (used by the kanban board drag-and-drop endpoint) validates the caller's role on the attacker-supplied project_id but...

#Sicherheitslücke #Update

Original-Artikel öffnen Zurück zur Übersicht

ARTICLEVIEW

CVE-2026-58660 - Kanboard BoardAjaxController Missing Ownership Check via Drag-and-Drop

VERWANDTEARTIKEL

CVE-2026-62948 - OpenWrt odhcpd/LuCI: unauthenticated DHCPv6 client can inject lease-file lines via FQDN hostname → stored XSS in the LuCI admin UI

CVE-2026-59258 - immich < 3.0.3 Shared Album Editor Ownership Takeover via updateUser

CVE-2026-62389 - ws < 8.21.1 Default maxFragments Allows Memory Exhaustion DoS

CVE-2026-53517 - Better Auth OAuth Provider: Refresh Token Rotation Race Condition Allows Concurrent Replay and Token Family Forking

CVE-2026-58658 - GPUStack Unauthenticated Information Disclosure via Worker Endpoints

CVE-2026-58659 - PyTorch Lightning Arbitrary Code Execution via _instantiator Hyperparameter