Threat database

Certifi removed the GLOBALTRUST root certificates starting in version 2024.7.4 due to long-standing compliance issues. These certificates were included from version 2021.5.30 up to but not including 2024.7.4. The removal aligns with similar actions taken by Mozilla. This vulnerability has a CVSS score of 7.5, indicating high severity, primarily due to the potential for integrity impact. A patch is available to address this issue.

Vikunja versions 0.22.0 through 2.3.0 contain a vulnerability in API token management where the system fails to validate the principal type. This allows a link-share JWT with a numeric ID matching a user's ID to be treated as that user, enabling an authenticated attacker to manage the target user's API tokens. The issue is fixed in version 2.4.0.

Vikunja versions 0.24.0 through 2.3.0 have a broken object level authorization (BOLA) vulnerability in the task-collection API endpoint. This flaw allows holders of any project share link to read kanban bucket titles and user information (username, name, id) from other tenants across the instance. The vulnerability does not disclose task contents outside the share's own project. It also enables an existence oracle for project/view IDs. The issue is fixed in version 2.4.0.

CVE-2026-59523 is a missing authorization vulnerability in NSquared Simply Schedule Appointments up to version 1.6.11.11. This flaw allows attackers to bypass access control security levels, potentially leading to unauthorized information disclosure and modification. The vulnerability is rated medium severity with a CVSS score of 6.5. No official patch or remediation guidance is currently available.

Portabilis i-Diario version 1.5.0 contains a cross-site scripting (XSS) vulnerability in the /justificativas-de-falta endpoint via the Justificativa argument. This vulnerability allows remote attackers to inject malicious scripts. The issue is classified as medium severity with a CVSS score of 3.5. The vendor was notified but has not responded, and no patch or remediation guidance is currently available. Public exploit details have been disclosed, but no known exploits in the wild have been reported.

Portabilis i-Diario version 1.5.0 contains a cross-site scripting (XSS) vulnerability in the /conteudos endpoint. The vulnerability arises from improper handling of the filter[by_description] parameter, allowing remote attackers to inject malicious scripts. The vulnerability has a medium severity rating with a CVSS score of 3.5. The vendor was notified but has not responded or provided a patch. Public exploit details are available, but no confirmed exploitation in the wild has been reported.

A security update for the pcs packages in Red Hat Enterprise Linux 9.2 addresses a denial-of-service vulnerability in the python-tornado component related to HTTP cookie parsing (CVE-2024-52804). The pcs packages provide command-line configuration for Pacemaker and Corosync utilities. This issue has been rated as important by Red Hat Product Security. The update is available for multiple Red Hat Enterprise Linux 9.2 variants including High Availability and Resilient Storage on various architectures.

A vulnerability in FinalWire AIRDA Extreme, AIDA64 Engineer, AIDA64 Business, and AIDA64 Network Audit version 7.00.6700 and earlier allows a local attacker to escalate privileges via specific DeviceIoControl calls related to memory management components.