CVE-2026-40103 - Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, Vikunja's scoped API token enforcement for custom project background routes is method-confused. A token with only projects.background can successfully delete a project... read CVE-2026-40103
Published: April 10, 2026; 1:17:13 PM -0400

V3.1: 5.4 MEDIUM

CVE-2025-66447 - Chamilo LMS is a learning management system. From 1.11.0 to 2.0-beta.1, anyone can trigger a malicious redirect through the use of the redirect parameter to /login. This vulnerability is fixed in 2.0-beta.2.
Published: April 10, 2026; 2:16:40 PM -0400

V3.1: 4.7 MEDIUM

CVE-2026-33618 - Chamilo LMS is a learning management system. Prior to .0.0-RC.3, the PlatformConfigurationController::decodeSettingArray() method uses PHP's eval() to parse platform settings from the database. An attacker with admin access (obtainable via Advisor... read CVE-2026-33618
Published: April 10, 2026; 3:16:22 PM -0400

CVE-2026-40226 - In nspawn in systemd 233 through 259 before 260, an escape-to-host action can occur via a crafted optional config file.
Published: April 10, 2026; 12:16:33 PM -0400

CVE-2026-22560 - An open redirect vulnerability in Rocket.Chat versions prior to 8.4.0 allows users to be redirected to arbitrary URLs by manipulating parameters within a SAML endpoint.
Published: April 10, 2026; 1:17:01 PM -0400

CVE-2026-40228 - In systemd 259, systemd-journald can send ANSI escape sequences to the terminals of arbitrary users when a "logger -p emerg" command is executed, if ForwardToWall=yes is set.
Published: April 10, 2026; 12:16:33 PM -0400

V3.1: 3.3 LOW

CVE-2026-35595 - Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the CanUpdate check at pkg/models/project_permissions.go:139-148 only requires CanWrite on the new parent project when changing parent_project_id. However, Vikunja's p... read CVE-2026-35595
Published: April 10, 2026; 1:17:02 PM -0400

CVE-2026-35596 - Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the hasAccessToLabel function contains a SQL operator precedence bug that allows any authenticated user to read any label that has at least one task association, regar... read CVE-2026-35596
Published: April 10, 2026; 1:17:03 PM -0400

CVE-2026-35597 - Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the TOTP failed-attempt lockout mechanism is non-functional due to a database transaction handling bug. When a TOTP validation fails, the login handler in pkg/routes/a... read CVE-2026-35597
Published: April 10, 2026; 1:17:03 PM -0400

V3.1: 7.5 HIGH

CVE-2026-35598 - Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the CalDAV GetResource and GetResourcesByList methods fetch tasks by UID from the database without verifying that the authenticated user has access to the task's proje... read CVE-2026-35598
Published: April 10, 2026; 1:17:03 PM -0400

CVE-2026-35599 - Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the addRepeatIntervalToTime function uses an O(n) loop that advances a date by the task's RepeatAfter duration until it exceeds the current time. By creating a repeati... read CVE-2026-35599
Published: April 10, 2026; 1:17:03 PM -0400

CVE-2026-35600 - Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, task titles are embedded directly into Markdown link syntax in overdue email notifications without escaping Markdown special characters. When rendered by goldmark and ... read CVE-2026-35600
Published: April 10, 2026; 1:17:03 PM -0400

CVE-2026-35601 - Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the CalDAV output generator builds iCalendar VTODO entries via raw string concatenation without applying RFC 5545 TEXT value escaping. User-controlled task titles cont... read CVE-2026-35601
Published: April 10, 2026; 1:17:03 PM -0400

CVE-2026-35602 - Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the Vikunja file import endpoint uses the attacker-controlled Size field from the JSON metadata inside the import zip instead of the actual decompressed file content l... read CVE-2026-35602
Published: April 10, 2026; 1:17:03 PM -0400

V3.1: 7.1 HIGH

CVE-2026-29063 - Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue... read CVE-2026-29063
Published: March 06, 2026; 2:16:21 PM -0500

V3.1: 9.8 CRITICAL

CVE-2026-31940 - Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, in main/lp/aicc_hacp.php, user-controlled request parameters are directly used to set the PHP session ID before loading global bootstrap. This leads to session fixation.... read CVE-2026-31940
Published: April 10, 2026; 2:16:41 PM -0400

V3.1: 8.8 HIGH

CVE-2026-31941 - Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, Chamilo LMS contains a Server-Side Request Forgery (SSRF) vulnerability in the Social Wall feature. The endpoint read_url_with_open_graph accepts a URL from the user via... read CVE-2026-31941
Published: April 10, 2026; 2:16:41 PM -0400

V3.1: 6.5 MEDIUM

CVE-2026-32892 - Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, Chamilo LMS contains an OS Command Injection vulnerability in the file move function. The move() function in fileManage.lib.php passes user-controlled path values direct... read CVE-2026-32892
Published: April 10, 2026; 2:16:41 PM -0400

V3.1: 8.8 HIGH

CVE-2025-15602 - Snipe-IT versions prior to 8.3.7 contain sensitive user attributes related to account privileges that are insufficiently protected against mass assignment. An authenticated, low-privileged user can craft a malicious API request to modify restricte... read CVE-2025-15602
Published: March 06, 2026; 12:16:24 PM -0500

V3.1: 8.8 HIGH

CVE-2026-32893 - Chamilo LMS is a learning management system. Prior to 2.0.0-RC.3, a Reflected Cross-Site Scripting (XSS) vulnerability in the exercise question list admin panel allows an attacker to execute arbitrary JavaScript in an authenticated teacher's brows... read CVE-2026-32893
Published: April 10, 2026; 2:16:41 PM -0400