GHSA-w2ch-4xgr-22wwPublished
Vikunja: Task relation deletion does not check read access to the other task, allowing cross-project relation removal
osv · GO-2026-6754
Go: code.vikunja.io/api
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
694615 source statements · aliases may refer to the same vulnerabilityGHSA-p7v4-vr35-mj6fPublished
containerd CRI plugin: Checkpoint restore bypasses destination security context
osv · CVE-2026-95837 · GO-2026-6791
Go: github.com/containerd/containerd/v2 · Go: github.com/containerd/containerd/v2
GHSA-wwv9-g5x4-966qPublished
SFTPGo source-side file-pattern filter bypass during copy operations
osv · CVE-2026-103028 · GO-2026-6802
Go: github.com/drakkan/sftpgo/v2
GHSA-6r69-c6wg-7g8mPublished
yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels
osv · CVE-2026-107840 · GO-2026-6720
Go: github.com/jhaals/yopass
GHSA-pvgv-gcp7-v38gPublished
Nginx UI: Node Secret Credential Exposure via URL Query Parameter
osv · CVE-2026-107807 · GO-2026-6708
Go: github.com/0xJacky/Nginx-UI
GHSA-5v7c-xpfp-p65mPublished
Nginx UI OTP secure-session step-up is missing on sensitive mutation routes
osv · CVE-2026-84315 · GO-2026-6775
Go: github.com/0xJacky/Nginx-UI
GHSA-cg6r-mpgc-h9mmPublished
GitHub CLI partially discloses authentication tokens in `gh auth status` output
osv · CVE-2026-64652 · GO-2026-6766
Go: github.com/cli/cli/v2
GHSA-wq4w-vwvq-q3x9Published
Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable
osv · CVE-2026-84321 · GO-2026-6801
Go: github.com/0xJacky/Nginx-UI
GHSA-9jww-cxg5-rj9mPublished
Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCE
osv · CVE-2026-84318 · GO-2026-6781
Go: github.com/0xJacky/Nginx-UI
GHSA-x26q-wvhg-fh4mPublished
Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations
osv · CVE-2026-107825 · GO-2026-6699
Go: github.com/corazawaf/coraza/v3
GO-2026-6699Published
Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations in github.com/corazawaf/coraza
osv · CVE-2026-107825 · GHSA-x26q-wvhg-fh4m
Go: github.com/corazawaf/coraza · Go: github.com/corazawaf/coraza/v2 · Go: github.com/corazawaf/coraza/v3
GHSA-wp2g-vpjj-g53rPublished
Excelize ANCHORARRAY: mutually-referencing array formulas recurse unboundedly via re-entrant CalcCellValue, causing a fatal stack overflow
osv · CVE-2026-107216 · GO-2026-6688
Go: github.com/xuri/excelize/v2
GHSA-x2q3-8cjh-766fPublished
Excelize: extractPart allocates attacker-controlled, unbounded and negative-sized buffers from CFB directory entries: remote panic / OOM DoS
osv · CVE-2026-107215 · GO-2026-6689
Go: github.com/xuri/excelize/v2
GHSA-mx22-3794-2vpvPublished
Excelize: Unchecked pivot-cache field index in extractPivotTableFields causes unrecoverable panic
osv · CVE-2026-107211 · GO-2026-6695
Go: github.com/xuri/excelize/v2
GHSA-6rvj-qwjf-3m4qPublished
Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited
osv · CVE-2026-91972 · GO-2026-6721
Go: code.vikunja.io/api
GO-2026-6730Published
Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check in code.vikunja.io/api
osv · CVE-2026-111921 · GHSA-fmmf-xq98-g327
Go: code.vikunja.io/api
GHSA-9rg3-v78m-26q8Published
Vikunja: API token scopes bypassed via task expand parameter (comments, reactions, time entry counts)
osv · CVE-2026-91983 · GO-2026-6726
Go: code.vikunja.io/api
GHSA-rp9v-7xv3-r6g3Published
Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor
osv · CVE-2026-107834 · GO-2026-6697
Go: github.com/corazawaf/coraza/v3
GO-2026-6697Published
Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor in github.com/corazawaf/coraza
osv · CVE-2026-107834 · GHSA-rp9v-7xv3-r6g3
Go: github.com/corazawaf/coraza · Go: github.com/corazawaf/coraza/v2 · Go: github.com/corazawaf/coraza/v3
GHSA-4vh2-39rq-rq8jPublished
Vikunja: Unbounded image decode on avatar and project-background uploads enables decode/resize amplification
osv · CVE-2026-91971 · GO-2026-6717
Go: code.vikunja.io/api
GHSA-w6r9-248c-frg8Published
amqp091-go: Pre-negotiation frame limit is not enforced to 4KB
osv · CVE-2026-107386 · GO-2026-6700
Go: github.com/rabbitmq/amqp091-go
GHSA-4jfq-pmq9-257hPublished
ageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud `getFileURL` Endpoint Leads to Remote Denial of Service
osv · CVE-2026-107839 · GO-2026-6716
Go: github.com/luskaner/ageLANServer/server
GHSA-2gc7-j998-5xx6Published
Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint
osv · CVE-2026-84314 · GO-2026-6771
Go: github.com/0xJacky/Nginx-UI
GHSA-3hcj-9m7p-wwm9Published
Gotify: Insufficiently Protected Password Change endpoint
osv · CVE-2026-102603 · GO-2026-6772
Go: github.com/gotify/server/v2 · Go: github.com/gotify/server/v3
GHSA-45gv-9wjv-xh7pPublished
Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)
osv · CVE-2026-107808 · GO-2026-6704
Go: github.com/0xJacky/Nginx-UI
GHSA-qjpp-gffx-2wm9Published
Nezha Monitoring: Whole-instance DoS in Nezha dashboard: a member can crash the process for every tenant
osv · CVE-2026-100394 · GO-2026-6794
Go: github.com/nezhahq/nezha
GHSA-32gc-wf3m-78w9Published
0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser
osv · CVE-2026-107811 · GO-2026-6702
Go: github.com/0xJacky/Nginx-UI
GHSA-rj9j-8772-4h6cPublished
Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)
osv · CVE-2026-68582 · GO-2026-6749
Go: code.vikunja.io/api
GHSA-pqf9-h8g4-8gmhPublished
Vikunja: Unbounded CSV row cardinality permits API process termination
osv · CVE-2026-91969 · GO-2026-6746
Go: code.vikunja.io/api
GHSA-p393-cf76-4jmrPublished
Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite
osv · CVE-2026-107806 · GO-2026-6741
Go: github.com/0xJacky/Nginx-UI
GHSA-88f6-4rjv-x774Published
Vikunja: TOTP secret is readable after enrollment, no step-up auth
osv · CVE-2026-91982 · GO-2026-6722
Go: code.vikunja.io/api
GHSA-v3ph-cgqh-r8p5Published
FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module
osv · CVE-2026-82416 · GO-2026-6797
Go: github.com/dunglas/frankenphp
GHSA-33rr-wq23-g6ggPublished
Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs
osv · CVE-2026-107809 · GO-2026-6703
Go: github.com/0xJacky/Nginx-UI
GHSA-76pm-mq2q-9gcrPublished
Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image)
osv · CVE-2026-84317 · GO-2026-6779
Go: github.com/0xJacky/Nginx-UI
GHSA-vvcv-vpph-h844Published
Vikunja: Link-share principal ID collision allows cross-account API token issuance and management
osv · CVE-2026-68581 · GO-2026-6753
Go: code.vikunja.io/api
GHSA-39p5-2wrr-xh29Published
Vikunja: Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway project
osv · CVE-2026-91980 · GO-2026-6713
Go: code.vikunja.io/api
GHSA-cf23-7qxj-xmhrPublished
Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image)
osv · CVE-2026-84316 · GO-2026-6782
Go: github.com/0xJacky/Nginx-UI
GHSA-mm27-mwq9-fr5gPublished
GitHub CLI allows attestation verification bypass through unescaped regex metacharacters
osv · CVE-2026-64655 · GO-2026-6767
Go: github.com/cli/cli/v2
GHSA-5r62-gj48-897xPublished
Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context
osv · CVE-2026-84319 · GO-2026-6774
Go: github.com/0xJacky/Nginx-UI
GHSA-vc32-4gwf-77xpPublished
Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools
osv · CVE-2026-84360 · GO-2026-6799
Go: github.com/0xJacky/Nginx-UI
GHSA-9h23-53f4-q947Published
Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout
osv · CVE-2026-107804 · GO-2026-6724
Go: github.com/0xJacky/Nginx-UI
GHSA-r7x5-4969-99p7Published
Excelize: Nil-pointer dereference in GetSlicers when a worksheet has extLst present but no drawing element
osv · CVE-2026-107213 · GO-2026-6687
Go: github.com/xuri/excelize/v2
GHSA-wq92-8x3r-fm38Published
Vikunja: Planka migration retains an unbounded aggregate of attacker-served attachments and can OOM the API
osv · CVE-2026-91970 · GO-2026-6757
Go: code.vikunja.io/api
GHSA-j3hg-9rp3-5hw9Published
Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage
osv · CVE-2026-107805 · GO-2026-6734
Go: github.com/0xJacky/Nginx-UI
GHSA-w39f-h553-h2mxPublished
Vikunja: Cross-tenant task-position rows can be injected into arbitrary project views via the unvalidated project_view_id in the task position endpoint (v1 and v2)
osv · CVE-2026-91984 · GO-2026-6755
Go: code.vikunja.io/api
GHSA-662p-52hx-cmh2Published
Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITM
osv · CVE-2026-107812 · GO-2026-6705
Go: github.com/0xJacky/Nginx-UI
GHSA-h246-wpgf-vmq5Published
Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up
osv · CVE-2026-107813 · GO-2026-6706
Go: github.com/0xJacky/Nginx-UI
GHSA-4fjg-2h4q-fwg3Published
GitHub CLI allows path traversal through unescaped request URL components
osv · CVE-2026-64653 · GO-2026-6765
Go: github.com/cli/cli/v2
GHSA-q7pc-356p-hggcPublished
SFTPGo: Denial of service via malformed SSH channel request
osv · CVE-2026-77375 · GO-2026-6792
Go: github.com/drakkan/sftpgo/v2
GHSA-xxc3-xpmc-vmvrPublished
Vikunja: Unbounded nested task-filter recursion permits API process termination
osv · CVE-2026-91968 · GO-2026-6759
Go: code.vikunja.io/api
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.