GHSA-88f6-4rjv-x774Published
Vikunja: TOTP secret is readable after enrollment, no step-up auth
osv · CVE-2026-91982 · GO-2026-6722
Go: code.vikunja.io/api
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
694541 source statements · aliases may refer to the same vulnerabilityGHSA-v3ph-cgqh-r8p5Published
FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module
osv · CVE-2026-82416 · GO-2026-6797
Go: github.com/dunglas/frankenphp
GHSA-33rr-wq23-g6ggPublished
Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs
osv · CVE-2026-107809 · GO-2026-6703
Go: github.com/0xJacky/Nginx-UI
GHSA-76pm-mq2q-9gcrPublished
Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image)
osv · CVE-2026-84317 · GO-2026-6779
Go: github.com/0xJacky/Nginx-UI
GHSA-vvcv-vpph-h844Published
Vikunja: Link-share principal ID collision allows cross-account API token issuance and management
osv · CVE-2026-68581 · GO-2026-6753
Go: code.vikunja.io/api
GHSA-39p5-2wrr-xh29Published
Vikunja: Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway project
osv · CVE-2026-91980 · GO-2026-6713
Go: code.vikunja.io/api
GHSA-cf23-7qxj-xmhrPublished
Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image)
osv · CVE-2026-84316 · GO-2026-6782
Go: github.com/0xJacky/Nginx-UI
GHSA-mm27-mwq9-fr5gPublished
GitHub CLI allows attestation verification bypass through unescaped regex metacharacters
osv · CVE-2026-64655 · GO-2026-6767
Go: github.com/cli/cli/v2
GHSA-5r62-gj48-897xPublished
Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context
osv · CVE-2026-84319 · GO-2026-6774
Go: github.com/0xJacky/Nginx-UI
GHSA-vc32-4gwf-77xpPublished
Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools
osv · CVE-2026-84360 · GO-2026-6799
Go: github.com/0xJacky/Nginx-UI
GHSA-9h23-53f4-q947Published
Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout
osv · CVE-2026-107804 · GO-2026-6724
Go: github.com/0xJacky/Nginx-UI
GHSA-r7x5-4969-99p7Published
Excelize: Nil-pointer dereference in GetSlicers when a worksheet has extLst present but no drawing element
osv · CVE-2026-107213 · GO-2026-6687
Go: github.com/xuri/excelize/v2
GHSA-wq92-8x3r-fm38Published
Vikunja: Planka migration retains an unbounded aggregate of attacker-served attachments and can OOM the API
osv · CVE-2026-91970 · GO-2026-6757
Go: code.vikunja.io/api
GHSA-j3hg-9rp3-5hw9Published
Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage
osv · CVE-2026-107805 · GO-2026-6734
Go: github.com/0xJacky/Nginx-UI
GHSA-w39f-h553-h2mxPublished
Vikunja: Cross-tenant task-position rows can be injected into arbitrary project views via the unvalidated project_view_id in the task position endpoint (v1 and v2)
osv · CVE-2026-91984 · GO-2026-6755
Go: code.vikunja.io/api
GHSA-662p-52hx-cmh2Published
Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITM
osv · CVE-2026-107812 · GO-2026-6705
Go: github.com/0xJacky/Nginx-UI
GHSA-h246-wpgf-vmq5Published
Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up
osv · CVE-2026-107813 · GO-2026-6706
Go: github.com/0xJacky/Nginx-UI
GHSA-4fjg-2h4q-fwg3Published
GitHub CLI allows path traversal through unescaped request URL components
osv · CVE-2026-64653 · GO-2026-6765
Go: github.com/cli/cli/v2
GHSA-q7pc-356p-hggcPublished
SFTPGo: Denial of service via malformed SSH channel request
osv · CVE-2026-77375 · GO-2026-6792
Go: github.com/drakkan/sftpgo/v2
GHSA-xxc3-xpmc-vmvrPublished
Vikunja: Unbounded nested task-filter recursion permits API process termination
osv · CVE-2026-91968 · GO-2026-6759
Go: code.vikunja.io/api
GHSA-mp22-58ff-6fhrPublished
Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`
osv · CVE-2026-96628 · GO-2026-6806
Go: github.com/getarcaneapp/arcane/backend/v2
GHSA-2j4c-ffch-9f23Published
Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks
osv · CVE-2026-107214 · GO-2026-6684
Go: github.com/xuri/excelize/v2
GO-2026-6715Published
Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes in code.vikunja.io/api
osv · CVE-2026-111917 · GHSA-4hv6-xc92-j86g
Go: code.vikunja.io/api
GO-2026-6745Published
Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2.6.0) in code.vikunja.io/api
osv · CVE-2026-111920 · GHSA-pjr3-86v4-5p7w
Go: code.vikunja.io/api
GHSA-qfwc-vx6f-3g6gPublished
Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to the share's permission level
osv · CVE-2026-91985 · GO-2026-6747
Go: code.vikunja.io/api
GHSA-m687-p538-r5hpPublished
Vikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted
osv · CVE-2026-111922 · GO-2026-6739
Go: code.vikunja.io/api
GO-2026-6739Published
Vikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted in code.vikunja.io/api
osv · CVE-2026-111922 · GHSA-m687-p538-r5hp
Go: code.vikunja.io/api
GHSA-vfxw-3x8p-2vjrPublished
Vikunja: Link-share token can enumerate users through the v2 API
osv · CVE-2026-91981 · GO-2026-6752
Go: code.vikunja.io/api
GHSA-xv7q-fvmc-jx96Published
Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover
osv · CVE-2026-62367 · GO-2026-6758
Go: code.vikunja.io/api
GO-2026-6701Published
Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd
osv · BIT-argo-cd-2026-55797 · CVE-2026-55797 · GHSA-j6cw-g6p4-7hch
Go: github.com/argoproj/argo-cd · Go: github.com/argoproj/argo-cd/v2 · Go: github.com/argoproj/argo-cd/v3
GHSA-w7jp-mf2v-8342Published
Vikunja: Denial of service via decompression bomb in the data import
osv · CVE-2026-91979 · GO-2026-6756
Go: code.vikunja.io/api
GHSA-m469-88xx-8rx2Published
Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords
osv · CVE-2026-91973 · GO-2026-6737
Go: code.vikunja.io/api
GHSA-v3p6-34mc-hj7vPublished
Vikunja: Scoped API token can mint unrestricted OAuth session credentials
osv · CVE-2026-57458 · GO-2026-6750
Go: code.vikunja.io/api
GHSA-rp3h-jf77-q9p4Published
containerd: Unpack DoS via repeated opaque whiteouts
osv · CVE-2026-95838 · GO-2026-6796
Go: github.com/containerd/containerd/v2 · Go: github.com/containerd/containerd · Go: github.com/containerd/containerd/v2
GHSA-r6w9-259g-gwrvPublished
Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access
osv · CVE-2026-62376 · GO-2026-6748
Go: code.vikunja.io/api
GHSA-pc5q-qfxp-ggqvPublished
Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass
osv · CVE-2026-104774 · GO-2026-6696
Go: github.com/corazawaf/coraza/v3
GHSA-g4qm-m288-5cp9Published
Coraza has Cookie Parser Confusion
osv · CVE-2026-107835 · GO-2026-6694
Go: github.com/corazawaf/coraza/v3
GO-2026-6694Published
Coraza has Cookie Parser Confusion in github.com/corazawaf/coraza
osv · CVE-2026-107835 · GHSA-g4qm-m288-5cp9
Go: github.com/corazawaf/coraza · Go: github.com/corazawaf/coraza/v2 · Go: github.com/corazawaf/coraza/v3
GHSA-wv6g-x823-wx9mPublished
Terragrunt catalog predictable temp symlink clobber
osv · CVE-2026-64672 · GO-2026-6768
Go: github.com/gruntwork-io/terragrunt
GHSA-mjcv-p78q-w5fwPublished
github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files
osv · CVE-2026-61801 · GO-2026-6686
Go: github.com/moby/sys/user
GHSA-jrq7-xrjx-pcfwPublished
Nginx UI: Auto backup name allows path traversal outside validated storage path
osv · CVE-2026-84320 · GO-2026-6788
Go: github.com/0xJacky/Nginx-UI
GHSA-p8v3-89rh-jxc7Published
Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are applied
osv · CVE-2026-107810 · GO-2026-6707
Go: github.com/0xJacky/Nginx-UI
GO-2026-6731Published
Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants in code.vikunja.io/api
osv · CVE-2026-111918 · GHSA-fprf-r6rv-xg99
Go: code.vikunja.io/api
GHSA-74w3-63xv-x9mvPublished
CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` plugin
osv · CVE-2026-62994 · GO-2026-6805
Go: github.com/coredns/coredns
GHSA-663m-7x7m-g4fwPublished
Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG Decoder
osv · CVE-2026-77622 · GO-2026-6777
Go: github.com/BishopFox/sliver
GHSA-pw5q-rjx4-7f7pPublished
Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)
osv · CVE-2026-96627 · GO-2026-6807
Go: github.com/getarcaneapp/arcane/backend/v2
GHSA-637c-6jxx-4rwmPublished
KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication
osv · CVE-2026-77524 · GO-2026-6776
Go: github.com/kedacore/keda · Go: github.com/kedacore/keda/v2
GHSA-6gcq-wc29-5xf2Published
Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)
osv · CVE-2026-107826 · GO-2026-6693
Go: github.com/corazawaf/coraza/v3
GO-2026-6693Published
Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash) in github.com/corazawaf/coraza
osv · CVE-2026-107826 · GHSA-6gcq-wc29-5xf2
Go: github.com/corazawaf/coraza · Go: github.com/corazawaf/coraza/v2 · Go: github.com/corazawaf/coraza/v3
GHSA-jw42-f3rr-4cc3Published
Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for days
osv · CVE-2026-107212 · GO-2026-6685
Go: github.com/xuri/excelize/v2
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.