Reserved but Public CVEs

CVE-2026-52823 is an authenticated cross-site request forgery vulnerability in Kimai affecting timesheet state-changing API endpoints. The flaw stems from the use of GET requests for operations that change application state, specifically stopping a running timesheet and restarting a historical timesheet to create a new record. Because these actions can be triggered through a victim's authenticated browser session, an attacker can cause unintended server-side changes without the user's intent. The issue was corrected by removing the vulnerable GET routes and requiring PATCH for the affected operations.

CVE-2026-52823First seen Jul 14, 2026

CVE-2026-52827 is a two-factor authentication bypass vulnerability in Kimai affecting versions prior to 2.59.0. After successful primary credential verification, the application issues a pre-2FA session that should remain restricted until TOTP verification is completed. Due to improper authentication enforcement on REST API endpoints, this pre-2FA session is accepted by /api/* routes as fully authenticated. As a result, a user session that is still in the two-factor authentication flow can access protected API functionality without completing the second authentication factor.

CVE-2026-52827First seen Jul 14, 2026

CVE-2026-55372 is a pre-authentication server-side request forgery vulnerability in NukeViet. The issue arises from insufficient validation of client-supplied forwarded headers, specifically X-Forwarded-Host and X-Forwarded-Proto, which are consumed by server_info_update() when constructing an outbound cURL request. Because these values are not properly normalized and constrained before use, an unauthenticated attacker can influence the destination of a server-initiated request. The vulnerable behavior permits blind SSRF against attacker-selected internal or external targets. Available details indicate the request behavior is constrained by a fixed request path, use of the HEAD method, and absence of reflected response content, which limits exploitability beyond network reachability and limited side effects such as cached header poisoning.

CVE-2026-55372First seen Jul 14, 2026

CVE-2026-52819 is an authorization bypass vulnerability in Kimai affecting the GET /api/timesheets list endpoint. A user with the ROLE_TEAMLEAD role and the view_other_timesheet permission can retrieve timesheet records belonging to users for whom they are not actually the responsible team lead. The flaw is caused by insufficient authorization enforcement in the timesheet listing logic, where requests targeting other users are not properly validated against the expected per-user access control requirement. In the fixed version, TimesheetController::cgetAction() is protected with an access_user permission check so that unauthorized requests for target users are rejected.

CVE-2026-52819First seen Jul 14, 2026

CVE-2026-52826 is an improper authorization vulnerability in Kimai affecting project, customer, and activity rate edit endpoints. The flaw allows an authenticated user to update a rate record associated with a parent object outside the user’s authorized scope by submitting a request that combines a parent object identifier the user is permitted to access with a rate identifier belonging to a different, unauthorized parent object. The vulnerable behavior indicates insufficient server-side validation that the rate being edited is actually owned by the project, customer, or activity referenced by the request. This results in an authorization bypass across object boundaries and breaks intended tenant or team-based isolation for billing-related configuration data.

CVE-2026-52826First seen Jul 14, 2026

CVE-2026-52821 is an improper authorization vulnerability in Kimai. An authenticated user granted create_activity permission can create activities under projects outside their authorized scope through preset project creation routes. The flaw is caused by missing or insufficient authorization validation in controller flows responsible for activity creation and preset project handling, allowing object creation to proceed without enforcing the expected project- or customer-level edit authorization checks.

CVE-2026-52821First seen Jul 14, 2026

CVE-2026-61668 is an improper certificate validation vulnerability in the DIRAC pilot wrapper. During retrieval of second-stage pilot code over HTTPS, SSL/TLS certificate validation is explicitly disabled. As a result, the pilot wrapper does not properly authenticate the remote endpoint before accepting and executing the downloaded code. This creates a trust-boundary failure in the pilot bootstrap process and exposes the second-stage download path to tampering by an attacker positioned to intercept or redirect network traffic. Successful exploitation can lead to execution of attacker-supplied code within the pilot execution context.

CVE-2026-61668First seen Jul 14, 2026

CVE-2026-52822 is an improper authorization vulnerability in Kimai affecting timesheet creation through restart and duplication workflows. Authenticated users whose access to a project or activity has been revoked can still create new timesheet entries associated with those unauthorized project and activity combinations. The flaw is caused by insufficient authorization enforcement during new timesheet creation paths, specifically where access checks for the referenced project and activity were not properly applied. The issue was addressed by updating authorization logic in TimesheetVoter::canStart() to enforce team access validation for project and activity during new timesheet creation, including restart and duplication operations.

CVE-2026-52822First seen Jul 14, 2026

CVE-2026-52825 is an improper authorization vulnerability in Kimai affecting team member and team activity assignment functionality. The flaw allows an authenticated user with the Teamlead role to expand a team's effective scope beyond intended authorization boundaries by assigning users or activities that are outside the Teamlead's permitted management or visibility scope. The vulnerable behavior stems from missing or insufficient authorization checks when processing references to users, customers, projects, and activities during team assignment operations. As a result, downstream access-control and visibility logic may trust illegitimate team relationships created through these APIs.

CVE-2026-52825First seen Jul 14, 2026

CVE-2026-48118 is an unauthenticated reflected cross-site scripting vulnerability in the NukeViet Comment module. The issue is exposed through the status_comment parameter, whose decoded content can be reflected into the rendered page without sufficient output encoding. The vulnerability is compounded by an anti-forgery mechanism that derives the comment checkss token from a session-independent value rather than a per-user session value, allowing crafted links to be generated in a way that can be delivered across users. As a result, an attacker can cause arbitrary HTML or JavaScript to execute in a victim’s browser within the security context of the affected NukeViet site.

CVE-2026-48118First seen Jul 14, 2026

CVE-2026-54064 is a stored cross-site scripting vulnerability in NukeViet affecting the News module. The issue stems from multiple anti-XSS filter bypasses involving weaknesses in the Request::filterAttr() and Request::unhtmlentities() routines. These weaknesses allow crafted input to evade attribute and javascript: scheme filtering, including through handling flaws involving ASCII control characters and HTML entity decoding. An authenticated low-privileged user with permission to post news content can inject malicious script into stored content, which is then rendered and executed in the browsers of users who view the affected pages, including administrative users.

CVE-2026-54064First seen Jul 14, 2026

CVE-2026-54065 is a path traversal vulnerability in the NukeViet Edit Comment administrative function. The flaw arises from insufficient validation of the attach parameter, allowing a crafted path to traverse directories and reference files outside the intended uploads location but still within the application root. An authenticated administrator can abuse this behavior to delete arbitrary files accessible through the vulnerable code path. Deletion of critical application files can break core functionality and render the installation unusable.

CVE-2026-54065First seen Jul 14, 2026

CVE-2026-52820 is an authorization flaw in Kimai affecting the Timesheet API PATCH and POST endpoints. An authenticated user who is permitted to edit their own timesheets can exploit a query-builder logic issue involving an OR-bypass to assign their own timesheet entries to projects outside their authorized team scope. The vulnerable behavior fails to properly enforce team-based access controls when project associations are modified, allowing unauthorized reassignment of timesheets and disclosure of restricted project-related metadata in API responses. The issue was addressed by changing FormTrait so that project data is only forwarded for new timesheets and by adding a TimesheetTeamAccessValidator to validate team access when project or activity values change.

CVE-2026-52820First seen Jul 14, 2026

CVE-2026-49259 is a stored cross-site scripting vulnerability in NukeViet CMS 4.x through 4.5.08. A low-privileged authenticated user can inject malicious JavaScript through profile display name fields. The flaw is triggered when the attacker’s crafted display name is later incorporated into the Reply functionality for comments, where user-controlled data is passed into an inline JavaScript handler without safe JavaScript-context encoding. Because the application relies on HTML entity encoding rather than proper JavaScript string encoding, an attacker can break out of the intended context and execute script in the victim’s browser when the Reply link is clicked.

CVE-2026-49259First seen Jul 14, 2026

CVE-2026-49992 is an authenticated cross-site request forgery vulnerability in Kimai affecting default team creation and related assignment endpoints. The issue allows state-changing actions to be triggered through vulnerable GET-based administrative routes, enabling unauthorized creation or reuse of teams, assignment of the victim user as teamlead, and rebinding of projects, customers, or activities to teams. Successful exploitation depends on inducing a logged-in user with sufficient permissions to load attacker-controlled content, after which Kimai processes the forged requests as if they were initiated intentionally by the authenticated victim. The flaw can alter authorization structure and team-based object relationships in a persistent manner.

CVE-2026-49992First seen Jul 14, 2026

CVE-2026-49865 is a server-side request forgery vulnerability in Kimai affecting invoice PDF preview and generation. The issue arises when attacker-controlled Markdown content rendered into invoices includes image URLs that are processed through the Markdown-to-HTML rendering pipeline and then fetched by mPDF during PDF generation. By supplying crafted remote image references in invoice-rendered Markdown fields, an attacker can induce the Kimai server to initiate outbound requests to arbitrary destinations, including internal network resources that are not directly reachable by the attacker.

CVE-2026-49865First seen Jul 11, 2026

CVE-2026-54174 is an integrity verification flaw in melange and apko in which package verification does not fully protect the package data section. As a result, verification of the package control section can still succeed even if the package payload has been substituted. This creates a gap between what is authenticated and what is ultimately installed, allowing tampering with package contents without detection during normal verification.

CVE-2026-54174First seen Jun 13, 2026

CVE-2026-53639 is an insecure direct object reference vulnerability in Sylius Shop Payment Request API endpoints. The flaw allows access control to be bypassed when payment requests or related orders are referenced using identifiers such as a payment request hash or an order token value without sufficient ownership validation. An attacker who knows or obtains a valid payment request hash can retrieve payment request information and derive the associated order token, which can then be used to access full order details. The affected functionality also permits unauthorized modification of redirect-related payment request fields, including values used to control post-payment navigation. In addition, the payment-request creation endpoint for shop orders allows unauthorized access to orders based solely on token-based reference data rather than verified authorization context.

CVE-2026-53639First seen Jul 10, 2026

CVE-2026-53769 is an authorization flaw in Avo affecting the direct attachment upload endpoint. The endpoint does not enforce server-side upload authorization, allowing an authenticated user to bypass field-level upload policy checks and record update restrictions when adding or replacing attachments. In affected deployments, the vulnerable behavior permits attachment operations that should be denied by application policy, including direct upload flows and key-based or Trix-style attachment handling that result in blob creation and returned attachment references.

CVE-2026-53769First seen Jul 10, 2026

CVE-2026-52775 is an authenticated SQL injection vulnerability in YesWiki affecting the reactions API. The flaw is present in ReactionManager::deleteUserReaction(), where user-controlled idreaction and id values supplied through URL path parameters can reach a database deletion path without proper escaping or parameterization in one code branch. The vulnerable logic differs from a protected branch that correctly handles parameters, creating an injection condition in the alternate path. Successful exploitation allows an authenticated attacker to manipulate backend SQL queries and interact with application data beyond the intended scope of the API operation.

CVE-2026-52775First seen Jun 14, 2026

CVE-2026-52770 is an unauthenticated SQL injection vulnerability in YesWiki's public Bazar entry-listing API functionality. The flaw affects numeric filtering parameters in the `query` and `queries` inputs, where attacker-controlled values are not safely constrained before being incorporated into SQL logic. This allows an external attacker to inject boolean SQL expressions through publicly reachable Bazar API endpoints and use differences in application responses to infer backend database information. The issue is a classic SQL injection condition in application-layer request handling for public data-listing features.

CVE-2026-52770First seen Jun 14, 2026

CVE-2026-49836 is a path traversal vulnerability in psd-tools affecting SmartObject handling when applications process untrusted PSD or PSB files and extract embedded smart objects. The flaw allows attacker-controlled smart-object filenames to influence the destination path used during extraction, enabling writes outside the intended output directory. A related issue affects external-kind smart objects, where filesystem paths referenced by the document can be resolved in an unsafe manner, allowing arbitrary readable local files to be accessed and their contents written to an attacker-controlled destination. The vulnerability arises from insufficient sanitization and confinement of file paths during SmartObject save and open operations.

CVE-2026-49836First seen Jul 10, 2026

CVE-2026-52767 is an unauthenticated signature-verification bypass in YesWiki affecting ActivityPub-enabled functionality. The flaw is in HttpSignatureService::verifySignature(), where a loose boolean negation is applied to the return value of openssl_verify(). Because openssl_verify() can return -1 on verification error, this logic can incorrectly treat a verification failure as a successful verification. As a result, crafted ActivityPub requests can bypass signature validation and be accepted as authentic. The issue enables unauthorized processing of federated Create, Update, and Delete actions against bazar entries associated with ActivityPub-enabled forms.

CVE-2026-52767First seen Jun 14, 2026

CVE-2026-52772 is a stored cross-site scripting vulnerability in YesWiki Bazar form-field templates. The issue is caused by unsafe Twig raw output handling for form field metadata, specifically field labels and hints, in both HTML attribute contexts and label rendering contexts. Because untrusted content is rendered without appropriate escaping or sanitization, a user able to edit form definitions can persist malicious script content in template-rendered fields. When affected Bazar forms are later viewed, the payload executes in the security context of the YesWiki application origin.

CVE-2026-52772First seen Jun 14, 2026

CVE-2026-48987 is an unbounded memory growth vulnerability in pyLoad's EventManager component affecting the getEvents API path. The flaw arises because repeated requests using distinct UUID values cause the application to create and retain new Client instances without adequate cleanup or limits. Because inactive clients are not purged during get_events processing, an authenticated attacker can continuously expand server-side state and drive memory usage upward. This can exhaust available memory and destabilize or terminate the pyLoad process, resulting in denial of service.

CVE-2026-48987First seen Jul 10, 2026