Live Threat Intelligence Radar

CVE-2026-111865 is a medium severity vulnerability in THU-MIG yoloe affecting the eval function in ultralytics/nn/autobackend.py. It involves improper neutralization of directives in dynamically evaluated code due to manipulation of certain arguments. The attack requires local access and no official patch or versioning information is available.

CVE-2026-110882 is a missing authorization vulnerability in Cozy Vision Technologies Pvt. Ltd.'s SMS Alert Order Notifications plugin. The flaw allows exploitation due to incorrectly configured access control security levels, potentially enabling unauthorized actions that impact the integrity of the system. The vulnerability affects versions from 0 up to 4.0.1. It has a medium severity rating with a CVSS score of 4.3.

Fleet versions prior to 4.83.0 have a denial of service vulnerability caused by improper handling of gzip-compressed request bodies. Unauthenticated attackers can send small, highly compressed requests to unauthenticated endpoints, which expand during decompression and exhaust server memory, leading to a crash of the Fleet instance.

Fleet versions before 4.89.0 have an unbounded recursion vulnerability in the Apple MDM enrollment property list parsing. This flaw allows unauthenticated attackers to send a crafted binary plist payload to enrollment endpoints, causing exponential resource consumption that crashes the server. The vulnerability can lead to denial of service by exhausting CPU and memory resources.

Vikunja versions from 2.2.0 up to but not including 2.7.0 have a permissive Cross-Origin Resource Sharing (CORS) policy that trusts all localhost and 127.0.0.1 ports with credentials. This misconfiguration allows an attacker controlling a page on any localhost port to send credentialed requests to the token refresh endpoint and obtain the bearer JWT token, potentially taking over the logged-in user's account.

Vikunja versions from 0.13.0 up to but not including 2.7.0 have an incorrect authorization vulnerability. This flaw allows project members with Write permission to delete admin-level link shares due to improper permission checks on share deletion. Attackers can exploit this by sending DELETE requests with sequential share IDs to revoke admin shares and invalidate share sessions.

Vikunja 2.6.0 has an improper privilege management vulnerability in the getProjectAccessForUser function. This flaw causes the system to resolve a user's effective project permission as the maximum permission over the project tree, overriding explicit lower-permission settings on sub-projects. As a result, a collaborator with write access on a parent project but only read access on a child project can improperly modify the child project's tasks and content.

Vikunja versions from 0.22.0 up to but not including 2.7.0 have a vulnerability where removed collaborators continue to receive project data via webhooks they created. This improper access revocation allows former collaborators to access task titles and descriptions, including new content created after their access was revoked.

Vikunja versions from 1.0.0-rc0 up to but not including 2.7.0 contain an improper authorization vulnerability in the RecalculateTaskPositions function. This flaw allows authenticated users who have no accessible projects to write task_positions rows for all tasks across the instance. Exploitation can involve deleting the user's Inbox after changing the default_project_id, then creating empty-filter saved filters to maintain cross-tenant references and increase write operations, potentially leading to denial of service.

Vikunja versions 2.3.0 up to but not including 2.7.0 have a session validation vulnerability where WebSocket access remains active after session revocation. This occurs because the handleAuth function does not verify the JWT sid claim against the sessions table. An attacker with a stolen access token can maintain or open WebSocket connections to /api/v2/ws even after the session is deleted or TOTP enrollment is performed, allowing continued receipt of notifications including comments, tasks, and project content.