Security fixes and advisories that landed overnight. This round lists new vendor notices and public disclosures. Items are grouped by vendor and ordered by priority for quick scanning. Updated 09 Nov 2026 01:30 GMT.
Top items
NIST
CVE-2026-123531
Vikunja from 1.0.0 before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated users to bypass service.maxitemsperpage by sending page=0 to /api/v1 list endpoints. Attackers can self-register and repeatedly request page=0 to force unbounded SQL queries, memory materialisation, and per-row query fan-out, degrading availability for other users.
- Published: 08 Nov 2026 02:16 GMT
- CVEs: Not stated in the advisory excerpt
- Notes: Allows authenticated users to bypass service.maxitemsperpage via page=0
