GHSA-mp22-58ff-6fhrPublished
Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`
osv · CVE-2026-96628 · GO-2026-6806
Go: github.com/getarcaneapp/arcane/backend/v2
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
694615 source statements · aliases may refer to the same vulnerabilityGHSA-2j4c-ffch-9f23Published
Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks
osv · CVE-2026-107214 · GO-2026-6684
Go: github.com/xuri/excelize/v2
GO-2026-6715Published
Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes in code.vikunja.io/api
osv · CVE-2026-111917 · GHSA-4hv6-xc92-j86g
Go: code.vikunja.io/api
GO-2026-6745Published
Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2.6.0) in code.vikunja.io/api
osv · CVE-2026-111920 · GHSA-pjr3-86v4-5p7w
Go: code.vikunja.io/api
GHSA-qfwc-vx6f-3g6gPublished
Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to the share's permission level
osv · CVE-2026-91985 · GO-2026-6747
Go: code.vikunja.io/api
GHSA-m687-p538-r5hpPublished
Vikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted
osv · CVE-2026-111922 · GO-2026-6739
Go: code.vikunja.io/api
GO-2026-6739Published
Vikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted in code.vikunja.io/api
osv · CVE-2026-111922 · GHSA-m687-p538-r5hp
Go: code.vikunja.io/api
GHSA-vfxw-3x8p-2vjrPublished
Vikunja: Link-share token can enumerate users through the v2 API
osv · CVE-2026-91981 · GO-2026-6752
Go: code.vikunja.io/api
GHSA-xv7q-fvmc-jx96Published
Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover
osv · CVE-2026-62367 · GO-2026-6758
Go: code.vikunja.io/api
GO-2026-6701Published
Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd
osv · BIT-argo-cd-2026-55797 · CVE-2026-55797 · GHSA-j6cw-g6p4-7hch
Go: github.com/argoproj/argo-cd · Go: github.com/argoproj/argo-cd/v2 · Go: github.com/argoproj/argo-cd/v3
GHSA-w7jp-mf2v-8342Published
Vikunja: Denial of service via decompression bomb in the data import
osv · CVE-2026-91979 · GO-2026-6756
Go: code.vikunja.io/api
GHSA-m469-88xx-8rx2Published
Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords
osv · CVE-2026-91973 · GO-2026-6737
Go: code.vikunja.io/api
GHSA-v3p6-34mc-hj7vPublished
Vikunja: Scoped API token can mint unrestricted OAuth session credentials
osv · CVE-2026-57458 · GO-2026-6750
Go: code.vikunja.io/api
GHSA-rp3h-jf77-q9p4Published
containerd: Unpack DoS via repeated opaque whiteouts
osv · CVE-2026-95838 · GO-2026-6796
Go: github.com/containerd/containerd/v2 · Go: github.com/containerd/containerd · Go: github.com/containerd/containerd/v2
GHSA-r6w9-259g-gwrvPublished
Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access
osv · CVE-2026-62376 · GO-2026-6748
Go: code.vikunja.io/api
GHSA-pc5q-qfxp-ggqvPublished
Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass
osv · CVE-2026-104774 · GO-2026-6696
Go: github.com/corazawaf/coraza/v3
GHSA-g4qm-m288-5cp9Published
Coraza has Cookie Parser Confusion
osv · CVE-2026-107835 · GO-2026-6694
Go: github.com/corazawaf/coraza/v3
GO-2026-6694Published
Coraza has Cookie Parser Confusion in github.com/corazawaf/coraza
osv · CVE-2026-107835 · GHSA-g4qm-m288-5cp9
Go: github.com/corazawaf/coraza · Go: github.com/corazawaf/coraza/v2 · Go: github.com/corazawaf/coraza/v3
GHSA-wv6g-x823-wx9mPublished
Terragrunt catalog predictable temp symlink clobber
osv · CVE-2026-64672 · GO-2026-6768
Go: github.com/gruntwork-io/terragrunt
GHSA-mjcv-p78q-w5fwPublished
github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files
osv · CVE-2026-61801 · GO-2026-6686
Go: github.com/moby/sys/user
GHSA-jrq7-xrjx-pcfwPublished
Nginx UI: Auto backup name allows path traversal outside validated storage path
osv · CVE-2026-84320 · GO-2026-6788
Go: github.com/0xJacky/Nginx-UI
GHSA-p8v3-89rh-jxc7Published
Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are applied
osv · CVE-2026-107810 · GO-2026-6707
Go: github.com/0xJacky/Nginx-UI
GO-2026-6731Published
Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants in code.vikunja.io/api
osv · CVE-2026-111918 · GHSA-fprf-r6rv-xg99
Go: code.vikunja.io/api
GHSA-74w3-63xv-x9mvPublished
CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` plugin
osv · CVE-2026-62994 · GO-2026-6805
Go: github.com/coredns/coredns
GHSA-663m-7x7m-g4fwPublished
Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG Decoder
osv · CVE-2026-77622 · GO-2026-6777
Go: github.com/BishopFox/sliver
GHSA-pw5q-rjx4-7f7pPublished
Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)
osv · CVE-2026-96627 · GO-2026-6807
Go: github.com/getarcaneapp/arcane/backend/v2
GHSA-637c-6jxx-4rwmPublished
KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication
osv · CVE-2026-77524 · GO-2026-6776
Go: github.com/kedacore/keda · Go: github.com/kedacore/keda/v2
GHSA-6gcq-wc29-5xf2Published
Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)
osv · CVE-2026-107826 · GO-2026-6693
Go: github.com/corazawaf/coraza/v3
GO-2026-6693Published
Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash) in github.com/corazawaf/coraza
osv · CVE-2026-107826 · GHSA-6gcq-wc29-5xf2
Go: github.com/corazawaf/coraza · Go: github.com/corazawaf/coraza/v2 · Go: github.com/corazawaf/coraza/v3
GHSA-jw42-f3rr-4cc3Published
Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for days
osv · CVE-2026-107212 · GO-2026-6685
Go: github.com/xuri/excelize/v2
GHSA-hjx8-qv73-f7cmPublished
Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed
osv · CVE-2026-111919 · GO-2026-6733
Go: code.vikunja.io/api
GO-2026-6733Published
Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed in code.vikunja.io/api
osv · CVE-2026-111919 · GHSA-hjx8-qv73-f7cm
Go: code.vikunja.io/api
GHSA-3c6w-j9xm-8h2hPublished
Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion
osv · CVE-2026-107833 · GO-2026-6690
Go: github.com/corazawaf/coraza/v3
GO-2026-6690Published
Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion in github.com/corazawaf/coraza
osv · CVE-2026-107833 · GHSA-3c6w-j9xm-8h2h
Go: github.com/corazawaf/coraza · Go: github.com/corazawaf/coraza/v2 · Go: github.com/corazawaf/coraza/v3
CVE-2026-112397Published
Pillow: Out-of-bounds access in _imagingmorph on a zero-width image
cve-program ·
Vendor product: Pillow
CVE-2026-112402Published
Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform
cve-program ·
Vendor product: Pillow
CVE-2026-111892Published
phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Rate Limiting on Password-Reset Endpoints
cve-program ·
Vendor product: phpMyFAQ
CVE-2026-111924Published
Fleet before 4.83.0 Denial of Service via Unbounded Gzip Decompression
cve-program ·
Vendor product: fleet
CVE-2026-111919Published
Vikunja 0.22.0 before 2.7.0 Improper Access Revocation via Webhooks
cve-program ·
Vendor product: vikunja
CVE-2026-111913Published
Admidio 5.0.0 before 5.0.16 Authorization Bypass via pdfl Mode in lists_show.php
cve-program ·
Vendor product: admidio
CVE-2026-111908Published
phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta BOLA in FAQ Update via REST API
cve-program ·
Vendor product: phpMyFAQ · Vendor product: phpMyFAQ
CVE-2026-111930Published
Coder from 2.26.0 before 2.34.8 Information Disclosure via Workspace ACL Endpoint
cve-program ·
Vendor product: coder
CVE-2026-111868Published
datastax pulsar-jms PulsarObjectMessage.java decode deserialization
cve-program ·
Vendor product: pulsar-jms
GO-2026-6765Published
GitHub CLI allows path traversal through unescaped request URL components in github.com/cli/cli
osv · CVE-2026-64653 · GHSA-4fjg-2h4q-fwg3
Go: github.com/cli/cli · Go: github.com/cli/cli/v2
GO-2026-6801Published
Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable in github.com/0xJacky/Nginx-UI
osv · CVE-2026-84321 · GHSA-wq4w-vwvq-q3x9
Go: github.com/0xJacky/Nginx-UI
GO-2026-6779Published
Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image) in github.com/0xJacky/Nginx-UI
osv · CVE-2026-84317 · GHSA-76pm-mq2q-9gcr
Go: github.com/0xJacky/Nginx-UI
GO-2026-6799Published
Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools in github.com/0xJacky/Nginx-UI
osv · CVE-2026-84360 · GHSA-vc32-4gwf-77xp
Go: github.com/0xJacky/Nginx-UI
GO-2026-6741Published
Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite in github.com/0xJacky/Nginx-UI
osv · CVE-2026-107806 · GHSA-p393-cf76-4jmr
Go: github.com/0xJacky/Nginx-UI
GO-2026-6722Published
Vikunja: TOTP secret is readable after enrollment, no step-up auth in code.vikunja.io/api
osv · CVE-2026-91982 · GHSA-88f6-4rjv-x774
Go: code.vikunja.io/api
GO-2026-6726Published
Vikunja: API token scopes bypassed via task expand parameter (comments, reactions, time entry counts) in code.vikunja.io/api
osv · CVE-2026-91983 · GHSA-9rg3-v78m-26q8
Go: code.vikunja.io/api
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.