CVE ID :CVE-2026-57458 Published : Oct. 9, 2026, 8:46 p.m. | 43 minutes ago Description :Vikunja is an open-source self-hosted task management platform. In version 2.3.0, a scoped API token limited to the `oauth.authorize` permission can call `POST /api/v1/oauth/authorize`, obtain an OAuth...

#Sicherheitslücke

Original-Artikel öffnen Zurück zur Übersicht

ARTICLEVIEW

CVE-2026-57458 - Vikunja: Scoped API token can mint unrestricted OAuth session credentials

VERWANDTEARTIKEL

CVE-2026-108264 - Wizarr: Authenticated Server-Side Template Injection (SSTI) in wizard step rendering leads to Remote Code Execution (RCE)

CVE-2026-62376 - Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access

CVE-2026-108263 - Astron Agent: Unsandboxed code-node leads to cross-tenant RCE

CVE-2026-108261 - TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment

CVE-2026-108259 - Tina: Code injection via unescaped Git branch name in generated client source

CVE-2026-107845 - Contao: Cross-site scripting in the comments bundle