GHSA-hjx8-qv73-f7cmPublished
Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed
osv · CVE-2026-111919 · GO-2026-6733
Go: code.vikunja.io/api
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
694541 source statements · aliases may refer to the same vulnerabilityGO-2026-6733Published
Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed in code.vikunja.io/api
osv · CVE-2026-111919 · GHSA-hjx8-qv73-f7cm
Go: code.vikunja.io/api
GHSA-3c6w-j9xm-8h2hPublished
Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion
osv · CVE-2026-107833 · GO-2026-6690
Go: github.com/corazawaf/coraza/v3
GO-2026-6690Published
Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion in github.com/corazawaf/coraza
osv · CVE-2026-107833 · GHSA-3c6w-j9xm-8h2h
Go: github.com/corazawaf/coraza · Go: github.com/corazawaf/coraza/v2 · Go: github.com/corazawaf/coraza/v3
CVE-2026-112397Published
Pillow: Out-of-bounds access in _imagingmorph on a zero-width image
cve-program ·
Vendor product: Pillow
CVE-2026-112402Published
Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform
cve-program ·
Vendor product: Pillow
CVE-2026-111892Published
phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Rate Limiting on Password-Reset Endpoints
cve-program ·
Vendor product: phpMyFAQ
CVE-2026-111924Published
Fleet before 4.83.0 Denial of Service via Unbounded Gzip Decompression
cve-program ·
Vendor product: fleet
CVE-2026-111919Published
Vikunja 0.22.0 before 2.7.0 Improper Access Revocation via Webhooks
cve-program ·
Vendor product: vikunja
CVE-2026-111913Published
Admidio 5.0.0 before 5.0.16 Authorization Bypass via pdfl Mode in lists_show.php
cve-program ·
Vendor product: admidio
CVE-2026-111908Published
phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta BOLA in FAQ Update via REST API
cve-program ·
Vendor product: phpMyFAQ · Vendor product: phpMyFAQ
CVE-2026-111930Published
Coder from 2.26.0 before 2.34.8 Information Disclosure via Workspace ACL Endpoint
cve-program ·
Vendor product: coder
CVE-2026-111868Published
datastax pulsar-jms PulsarObjectMessage.java decode deserialization
cve-program ·
Vendor product: pulsar-jms
GO-2026-6765Published
GitHub CLI allows path traversal through unescaped request URL components in github.com/cli/cli
osv · CVE-2026-64653 · GHSA-4fjg-2h4q-fwg3
Go: github.com/cli/cli · Go: github.com/cli/cli/v2
GO-2026-6801Published
Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable in github.com/0xJacky/Nginx-UI
osv · CVE-2026-84321 · GHSA-wq4w-vwvq-q3x9
Go: github.com/0xJacky/Nginx-UI
GO-2026-6779Published
Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image) in github.com/0xJacky/Nginx-UI
osv · CVE-2026-84317 · GHSA-76pm-mq2q-9gcr
Go: github.com/0xJacky/Nginx-UI
GO-2026-6799Published
Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools in github.com/0xJacky/Nginx-UI
osv · CVE-2026-84360 · GHSA-vc32-4gwf-77xp
Go: github.com/0xJacky/Nginx-UI
GO-2026-6741Published
Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite in github.com/0xJacky/Nginx-UI
osv · CVE-2026-107806 · GHSA-p393-cf76-4jmr
Go: github.com/0xJacky/Nginx-UI
GO-2026-6722Published
Vikunja: TOTP secret is readable after enrollment, no step-up auth in code.vikunja.io/api
osv · CVE-2026-91982 · GHSA-88f6-4rjv-x774
Go: code.vikunja.io/api
GO-2026-6726Published
Vikunja: API token scopes bypassed via task expand parameter (comments, reactions, time entry counts) in code.vikunja.io/api
osv · CVE-2026-91983 · GHSA-9rg3-v78m-26q8
Go: code.vikunja.io/api
GO-2026-6732Published
Vikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UID in code.vikunja.io/api
osv · GHSA-g38j-7v97-x298
Go: code.vikunja.io/api
GO-2026-6717Published
Vikunja: Unbounded image decode on avatar and project-background uploads enables decode/resize amplification in code.vikunja.io/api
osv · CVE-2026-91971 · GHSA-4vh2-39rq-rq8j
Go: code.vikunja.io/api
GO-2026-6689Published
Panic and memory exhaustion via unbounded CFB stream allocation in github.com/xuri/excelize
osv · CVE-2026-107215 · GHSA-x2q3-8cjh-766f
Go: github.com/360EntSecGroup-Skylar/excelize/v2 · Go: github.com/xuri/excelize/v2
GO-2026-6753Published
Vikunja: Link-share principal ID collision allows cross-account API token issuance and management in code.vikunja.io/api
osv · CVE-2026-68581 · GHSA-vvcv-vpph-h844
Go: code.vikunja.io/api
GO-2026-6734Published
Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage in github.com/0xJacky/Nginx-UI
osv · CVE-2026-107805 · GHSA-j3hg-9rp3-5hw9
Go: github.com/0xJacky/Nginx-UI
GO-2026-6752Published
Vikunja: Link-share token can enumerate users through the v2 API in code.vikunja.io/api
osv · CVE-2026-91981 · GHSA-vfxw-3x8p-2vjr
Go: code.vikunja.io/api
GO-2026-6696Published
Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass in github.com/corazawaf/coraza
osv · CVE-2026-104774 · GHSA-pc5q-qfxp-ggqv
Go: github.com/corazawaf/coraza · Go: github.com/corazawaf/coraza/v2 · Go: github.com/corazawaf/coraza/v3
GO-2026-6720Published
yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels in github.com/jhaals/yopass
osv · CVE-2026-107840 · GHSA-6r69-c6wg-7g8m
Go: github.com/jhaals/yopass
GO-2026-6703Published
Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs in github.com/0xJacky/Nginx-UI
osv · CVE-2026-107809 · GHSA-33rr-wq23-g6gg
Go: github.com/0xJacky/Nginx-UI
GO-2026-6721Published
Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited in code.vikunja.io/api
osv · CVE-2026-91972 · GHSA-6rvj-qwjf-3m4q
Go: code.vikunja.io/api
GO-2026-6774Published
Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context in github.com/0xJacky/Nginx-UI
osv · CVE-2026-84319 · GHSA-5r62-gj48-897x
Go: github.com/0xJacky/Nginx-UI
GO-2026-6748Published
Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access in code.vikunja.io/api
osv · CVE-2026-62376 · GHSA-r6w9-259g-gwrv
Go: code.vikunja.io/api
GO-2026-6777Published
Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG Decoder in github.com/bishopfox/sliver
osv · CVE-2026-77622 · GHSA-663m-7x7m-g4fw
Go: github.com/bishopfox/sliver
GO-2026-6768Published
Terragrunt catalog predictable temp symlink clobber in github.com/gruntwork-io/terragrunt
osv · CVE-2026-64672 · GHSA-wv6g-x823-wx9m
Go: github.com/gruntwork-io/terragrunt
GO-2026-6786Published
TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover in github.com/0xJacky/Nginx-UI
osv · CVE-2026-84313 · GHSA-gfrc-g87h-7h5w
Go: github.com/0xJacky/Nginx-UI
GO-2026-6788Published
Nginx UI: Auto backup name allows path traversal outside validated storage path in github.com/0xJacky/Nginx-UI
osv · CVE-2026-84320 · GHSA-jrq7-xrjx-pcfw
Go: github.com/0xJacky/Nginx-UI
GO-2026-6747Published
Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to the share's permission level in code.vikunja.io/api
osv · CVE-2026-91985 · GHSA-qfwc-vx6f-3g6g
Go: code.vikunja.io/api
GO-2026-6782Published
Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image) in github.com/0xJacky/Nginx-UI
osv · CVE-2026-84316 · GHSA-cf23-7qxj-xmhr
Go: github.com/0xJacky/Nginx-UI
GO-2026-6770Published
Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation in github.com/containers/podman
osv · CVE-2026-94603 · GHSA-2cvf-wqm6-wr9g
Go: github.com/containers/podman · Go: github.com/containers/podman/v2 · Go: github.com/containers/podman/v3
GO-2026-6750Published
Vikunja: Scoped API token can mint unrestricted OAuth session credentials in code.vikunja.io/api
osv · CVE-2026-57458 · GHSA-v3p6-34mc-hj7v
Go: code.vikunja.io/api
GO-2026-6767Published
GitHub CLI allows attestation verification bypass through unescaped regex metacharacters in github.com/cli/cli
osv · CVE-2026-64655 · GHSA-mm27-mwq9-fr5g
Go: github.com/cli/cli · Go: github.com/cli/cli/v2
GO-2026-6749Published
Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA) in code.vikunja.io/api
osv · CVE-2026-68582 · GHSA-rj9j-8772-4h6c
Go: code.vikunja.io/api
GO-2026-6758Published
Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover in code.vikunja.io/api
osv · CVE-2026-62367 · GHSA-xv7q-fvmc-jx96
Go: code.vikunja.io/api
GO-2026-6775Published
Nginx UI OTP secure-session step-up is missing on sensitive mutation routes in github.com/0xJacky/Nginx-UI
osv · CVE-2026-84315 · GHSA-5v7c-xpfp-p65m
Go: github.com/0xJacky/Nginx-UI
GO-2026-6776Published
KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication in github.com/kedacore/keda
osv · CVE-2026-77524 · GHSA-637c-6jxx-4rwm
Go: github.com/kedacore/keda · Go: github.com/kedacore/keda/v2
GO-2026-6688Published
Mutually-referencing array formulas recurse unboundedly, causing a fatal stack overflow in github.com/xuri/excelize
osv · CVE-2026-107216 · GHSA-wp2g-vpjj-g53r
Go: github.com/xuri/excelize/v2
GO-2026-6687Published
Nil-pointer dereference in GetSlicers when a worksheet has extLst present but no drawing element in github.com/xuri/excelize
osv · CVE-2026-107213 · GHSA-r7x5-4969-99p7
Go: github.com/xuri/excelize/v2
GO-2026-6714Published
Vikunja: Cross-project task disclosure through subtask expansion in code.vikunja.io/api
osv · GHSA-3hc7-r24j-rpwc
Go: code.vikunja.io/api
GO-2026-6700Published
Pre-negotiation frame limit is not enforced to 4KB in github.com/rabbitmq/amqp091-go
osv · CVE-2026-107386 · GHSA-w6r9-248c-frg8
Go: github.com/rabbitmq/amqp091-go
GO-2026-6705Published
Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITM in github.com/0xJacky/Nginx-UI
osv · CVE-2026-107812 · GHSA-662p-52hx-cmh2
Go: github.com/0xJacky/Nginx-UI
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.