Kovah Linkace vulnerabilities

• kovah linkace LinkAce vulnerable to stored XSS via 'javascript:' URI in Bulk Link API CVE-2026-49436 7.3 HighAugust 20, 2026
• kovah linkace LinkAce: IDOR in Update Policies Allows Any Authenticated User to Overwrite Other Users' Links, Lists, Tags, and Notes CVE-2026-45342 7.1 HighMay 28, 2026
• kovah linkace LinkAce - Stored XSS via Unsanitized SSO User's Name Rendered in Admin Audit Log Allows Session Hijacking CVE-2026-45343 8.5 HighMay 28, 2026
• kovah linkace LinkAce: Setup database password newline injection enables pre-auth RCE on uninitialized instances CVE-2026-45344 8.1 HighMay 28, 2026
• kovah linkace LinkAce: Password Reset Poisoning via X-Forwarded-Host Header Injection Leading to Account Takeover CVE-2026-40905 8.1 HighApril 21, 2026
• kovah linkace LinkAce has SSRF via CheckLinksCommand - Link URL Update Bypasses laravel-html-meta Protection CVE-2026-35516 5.0 MediumApril 7, 2026
• kovah linkace LinkAce discloses private notesto unauthorized authenticated users via the web link detail page CVE-2026-33954 6.5 MediumMarch 27, 2026
• kovah linkace LinkAce's SSRF protection can be bypassed via internal hostname resolution in LinkAce CVE-2026-33953 8.5 HighMarch 27, 2026
• kovah linkace LinkAce has a Cross-User Tag/List Attachment IDOR in processTaxonomy() CVE-2026-30954 5.3 MediumMarch 10, 2026
• kovah linkace LinkAce affected by SSRF via link creation: NoPrivateIpRule not applied to LinkStoreRequest CVE-2026-30953 7.7 HighMarch 10, 2026
• kovah linkace LinkAce: Stored XSS in Atom Feed via CDATA Escape in List Description CVE-2026-27458 8.7 HighFebruary 21, 2026
• kovah linkace LinkAce: Stored XSS Vulnerability in Link Title Field Through Social Media Sharing Feature CVE-2025-62722 8.7 HighNovember 4, 2025
• kovah linkace LinkAce: Authorization Bypass Allows Unauthorized Access to All Private Links, Lists, and Tags CVE-2025-62721 7.1 HighNovember 4, 2025
• kovah linkace LinkAce: Data Exfiltration via Export Functions Allow Access to All Users' Private Links CVE-2025-62720 7.1 HighNovember 4, 2025
• kovah linkace LinkAce: Limited Server-Side Request Forgery (SSRF) in Keyword Fetching Functionality CVE-2025-62719 2.3 LowNovember 4, 2025
• kovah linkace LinkAce Vulnerable to Stored XSS on the Audit Page CVE-2025-59424 Public exploit 7.3 HighSeptember 18, 2025
• kovah linkace LinkAce has a Stored One Click XSS vulnerability CVE-2025-53838 8.4 HighSeptember 8, 2025
• kovah linkace File Upload Vulnerability Leading to XSS in LinkAce v1.15.5 CVE-2024-56508 7.6 HighDecember 27, 2024
• kovah linkace Reflected Cross-Site Scripting (XSS) Vulnerability in LinkAce CVE-2024-56507 4.6 MediumDecember 27, 2024