GO-2026-6786Published
TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover in github.com/0xJacky/Nginx-UI
osv · CVE-2026-84313 · GHSA-gfrc-g87h-7h5w
Go: github.com/0xJacky/Nginx-UI
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
694614 source statements · aliases may refer to the same vulnerabilityGO-2026-6788Published
Nginx UI: Auto backup name allows path traversal outside validated storage path in github.com/0xJacky/Nginx-UI
osv · CVE-2026-84320 · GHSA-jrq7-xrjx-pcfw
Go: github.com/0xJacky/Nginx-UI
GO-2026-6747Published
Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to the share's permission level in code.vikunja.io/api
osv · CVE-2026-91985 · GHSA-qfwc-vx6f-3g6g
Go: code.vikunja.io/api
GO-2026-6782Published
Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image) in github.com/0xJacky/Nginx-UI
osv · CVE-2026-84316 · GHSA-cf23-7qxj-xmhr
Go: github.com/0xJacky/Nginx-UI
GO-2026-6770Published
Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation in github.com/containers/podman
osv · CVE-2026-94603 · GHSA-2cvf-wqm6-wr9g
Go: github.com/containers/podman · Go: github.com/containers/podman/v2 · Go: github.com/containers/podman/v3
GO-2026-6750Published
Vikunja: Scoped API token can mint unrestricted OAuth session credentials in code.vikunja.io/api
osv · CVE-2026-57458 · GHSA-v3p6-34mc-hj7v
Go: code.vikunja.io/api
GO-2026-6767Published
GitHub CLI allows attestation verification bypass through unescaped regex metacharacters in github.com/cli/cli
osv · CVE-2026-64655 · GHSA-mm27-mwq9-fr5g
Go: github.com/cli/cli · Go: github.com/cli/cli/v2
GO-2026-6749Published
Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA) in code.vikunja.io/api
osv · CVE-2026-68582 · GHSA-rj9j-8772-4h6c
Go: code.vikunja.io/api
GO-2026-6758Published
Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover in code.vikunja.io/api
osv · CVE-2026-62367 · GHSA-xv7q-fvmc-jx96
Go: code.vikunja.io/api
GO-2026-6775Published
Nginx UI OTP secure-session step-up is missing on sensitive mutation routes in github.com/0xJacky/Nginx-UI
osv · CVE-2026-84315 · GHSA-5v7c-xpfp-p65m
Go: github.com/0xJacky/Nginx-UI
GO-2026-6776Published
KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication in github.com/kedacore/keda
osv · CVE-2026-77524 · GHSA-637c-6jxx-4rwm
Go: github.com/kedacore/keda · Go: github.com/kedacore/keda/v2
GO-2026-6688Published
Mutually-referencing array formulas recurse unboundedly, causing a fatal stack overflow in github.com/xuri/excelize
osv · CVE-2026-107216 · GHSA-wp2g-vpjj-g53r
Go: github.com/xuri/excelize/v2
GO-2026-6687Published
Nil-pointer dereference in GetSlicers when a worksheet has extLst present but no drawing element in github.com/xuri/excelize
osv · CVE-2026-107213 · GHSA-r7x5-4969-99p7
Go: github.com/xuri/excelize/v2
GO-2026-6714Published
Vikunja: Cross-project task disclosure through subtask expansion in code.vikunja.io/api
osv · GHSA-3hc7-r24j-rpwc
Go: code.vikunja.io/api
GO-2026-6700Published
Pre-negotiation frame limit is not enforced to 4KB in github.com/rabbitmq/amqp091-go
osv · CVE-2026-107386 · GHSA-w6r9-248c-frg8
Go: github.com/rabbitmq/amqp091-go
GO-2026-6705Published
Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITM in github.com/0xJacky/Nginx-UI
osv · CVE-2026-107812 · GHSA-662p-52hx-cmh2
Go: github.com/0xJacky/Nginx-UI
GO-2026-6707Published
Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are applied in github.com/0xJacky/Nginx-UI
osv · CVE-2026-107810 · GHSA-p8v3-89rh-jxc7
Go: github.com/0xJacky/Nginx-UI
GO-2026-6708Published
Nginx UI: Node Secret Credential Exposure via URL Query Parameter in github.com/0xJacky/Nginx-UI
osv · CVE-2026-107807 · GHSA-pvgv-gcp7-v38g
Go: github.com/0xJacky/Nginx-UI
GO-2026-6704Published
Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass) in github.com/0xJacky/Nginx-UI
osv · CVE-2026-107808 · GHSA-45gv-9wjv-xh7p
Go: github.com/0xJacky/Nginx-UI
GO-2026-6781Published
Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCE in github.com/0xJacky/Nginx-UI
osv · CVE-2026-84318 · GHSA-9jww-cxg5-rj9m
Go: github.com/0xJacky/Nginx-UI
GO-2026-6755Published
Vikunja: Cross-tenant task-position rows can be injected into arbitrary project views via the unvalidated project_view_id in the task position endpoint (v1 and v2) in code.vikunja.io/api
osv · CVE-2026-91984 · GHSA-w39f-h553-h2mx
Go: code.vikunja.io/api
GO-2026-6706Published
Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up in github.com/0xJacky/Nginx-UI
osv · CVE-2026-107813 · GHSA-h246-wpgf-vmq5
Go: github.com/0xJacky/Nginx-UI
GO-2026-6695Published
Panic via unchecked pivot-cache field index in github.com/xuri/excelize/v2
osv · CVE-2026-107211 · GHSA-mx22-3794-2vpv
Go: github.com/xuri/excelize/v2
GO-2026-6805Published
CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` plugin in github.com/coredns/coredns
osv · CVE-2026-62994 · GHSA-74w3-63xv-x9mv
Go: github.com/coredns/coredns
GO-2026-6807Published
Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check) in github.com/getarcaneapp/arcane/backend
osv · CVE-2026-96627 · GHSA-pw5q-rjx4-7f7p
Go: github.com/getarcaneapp/arcane/backend · Go: github.com/getarcaneapp/arcane/backend/v2
GO-2026-6806Published
Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof` in github.com/getarcaneapp/arcane/backend
osv · CVE-2026-96628 · GHSA-mp22-58ff-6fhr
Go: github.com/getarcaneapp/arcane/backend · Go: github.com/getarcaneapp/arcane/backend/v2
GO-2026-6797Published
FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module in github.com/dunglas/frankenphp
osv · CVE-2026-82416 · GHSA-v3ph-cgqh-r8p5
Go: github.com/dunglas/frankenphp
GO-2026-6791Published
containerd CRI plugin: Checkpoint restore bypasses destination security context in github.com/containerd/containerd
osv · CVE-2026-95837 · GHSA-p7v4-vr35-mj6f
Go: github.com/containerd/containerd · Go: github.com/containerd/containerd/v2
GO-2026-6759Published
Vikunja: Unbounded nested task-filter recursion permits API process termination in code.vikunja.io/api
osv · CVE-2026-91968 · GHSA-xxc3-xpmc-vmvr
Go: code.vikunja.io/api
GO-2026-6802Published
SFTPGo source-side file-pattern filter bypass during copy operations in github.com/drakkan/sftpgo
osv · CVE-2026-103028 · GHSA-wwv9-g5x4-966q
Go: github.com/drakkan/sftpgo · Go: github.com/drakkan/sftpgo/v2
GO-2026-6794Published
Nezha Monitoring: Whole-instance DoS in Nezha dashboard: a member can crash the process for every tenant in github.com/nezhahq/nezha
osv · CVE-2026-100394 · GHSA-qjpp-gffx-2wm9
Go: github.com/nezhahq/nezha
GO-2026-6796Published
containerd: Unpack DoS via repeated opaque whiteouts in github.com/containerd/containerd
osv · CVE-2026-95838 · GHSA-rp3h-jf77-q9p4
Go: github.com/containerd/containerd · Go: github.com/containerd/containerd/v2
GO-2026-6746Published
Vikunja: Unbounded CSV row cardinality permits API process termination in code.vikunja.io/api
osv · CVE-2026-91969 · GHSA-pqf9-h8g4-8gmh
Go: code.vikunja.io/api
GO-2026-6754Published
Vikunja: Task relation deletion does not check read access to the other task, allowing cross-project relation removal in code.vikunja.io/api
osv · GHSA-w2ch-4xgr-22ww
Go: code.vikunja.io/api
GO-2026-6792Published
SFTPGo: Denial of service via malformed SSH channel request in github.com/drakkan/sftpgo
osv · CVE-2026-77375 · GHSA-q7pc-356p-hggc
Go: github.com/drakkan/sftpgo · Go: github.com/drakkan/sftpgo/v2
GO-2026-6772Published
Gotify: Insufficiently Protected Password Change endpoint in github.com/gotify/server
osv · CVE-2026-102603 · GHSA-3hcj-9m7p-wwm9
Go: github.com/gotify/server · Go: github.com/gotify/server/v2 · Go: github.com/gotify/server/v3
GO-2026-6757Published
Vikunja: Planka migration retains an unbounded aggregate of attacker-served attachments and can OOM the API in code.vikunja.io/api
osv · CVE-2026-91970 · GHSA-wq92-8x3r-fm38
Go: code.vikunja.io/api
GO-2026-6756Published
Vikunja: Denial of service via decompression bomb in the data import in code.vikunja.io/api
osv · CVE-2026-91979 · GHSA-w7jp-mf2v-8342
Go: code.vikunja.io/api
GO-2026-6766Published
GitHub CLI partially discloses authentication tokens in `gh auth status` output in github.com/cli/cli
osv · CVE-2026-64652 · GHSA-cg6r-mpgc-h9mm
Go: github.com/cli/cli · Go: github.com/cli/cli/v2
GO-2026-6716Published
ageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud `getFileURL` Endpoint Leads to Remote Denial of Service in github.com/luskaner/ageLANServer/server
osv · CVE-2026-107839 · GHSA-4jfq-pmq9-257h
Go: github.com/luskaner/ageLANServer/server
GO-2026-6773Published
Casdoor SSO callback uses a constant state parameter (login CSRF) in github.com/0xJacky/Nginx-UI
osv · CVE-2026-84312 · GHSA-44xr-mrhh-qm78
Go: github.com/0xJacky/Nginx-UI
GO-2026-6771Published
Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint in github.com/0xJacky/Nginx-UI
osv · CVE-2026-84314 · GHSA-2gc7-j998-5xx6
Go: github.com/0xJacky/Nginx-UI
GO-2026-6723Published
Vikunja: Assignee email addresses disclosed to read-only project members via the task assignees endpoint in code.vikunja.io/api
osv · GHSA-8wvg-r2j4-3737
Go: code.vikunja.io/api
GO-2026-6713Published
Vikunja: Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway project in code.vikunja.io/api
osv · CVE-2026-91980 · GHSA-39p5-2wrr-xh29
Go: code.vikunja.io/api
GO-2026-6711Published
Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure in code.vikunja.io/api
osv · CVE-2026-76216 · GHSA-32r8-5843-4qw2
Go: code.vikunja.io/api
GO-2026-6702Published
0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser in github.com/0xJacky/Nginx-UI
osv · CVE-2026-107811 · GHSA-32gc-wf3m-78w9
Go: github.com/0xJacky/Nginx-UI
GO-2026-6737Published
Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords in code.vikunja.io/api
osv · CVE-2026-91973 · GHSA-m469-88xx-8rx2
Go: code.vikunja.io/api
GO-2026-6724Published
Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout in github.com/0xJacky/Nginx-UI
osv · CVE-2026-107804 · GHSA-9h23-53f4-q947
Go: github.com/0xJacky/Nginx-UI
GO-2026-6684Published
Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks in github.com/xuri/excelize
osv · CVE-2026-107214 · GHSA-2j4c-ffch-9f23
Go: github.com/360EntSecGroup-Skylar/excelize/v2 · Go: github.com/xuri/excelize/v2
GO-2026-6686Published
Possible DoS via unbounded parsing of user and group database files in github.com/moby/sys/user
osv · CVE-2026-61801 · GHSA-mjcv-p78q-w5fw
Go: github.com/moby/sys/user
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.