The CVE-2026-57862 record indicates a server-side request forgery (SSRF) vulnerability in Kanboard 1.2.52 and prior. The vulnerability allows authenticated users to bypass SSRF protections by supplying hexadecimal IP address notation in user-controlled URLs through the web link creation feature. The cURL library resolves and connects to internal network resources such as cloud instance metadata services, [truncated]
CVE-2026-58660 is a high-severity vulnerability in Kanboard, a project management software, that allows authenticated users to move tasks from private projects they are not a member of. This issue arises from a missing ownership check in the BoardAjaxController save() method, which is used by the kanban board drag-and-drop endpoint. The vulnerability has a CVSS score of 7.2 and was fixed in commit 564cc30.
