CVE-2026-111908Published
phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta BOLA in FAQ Update via REST API
cve-program ·
Vendor product: phpMyFAQ · Vendor product: phpMyFAQ
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
694625 source statements · aliases may refer to the same vulnerabilityCVE-2026-111930Published
Coder from 2.26.0 before 2.34.8 Information Disclosure via Workspace ACL Endpoint
cve-program ·
Vendor product: coder
CVE-2026-111868Published
datastax pulsar-jms PulsarObjectMessage.java decode deserialization
cve-program ·
Vendor product: pulsar-jms
GO-2026-6765Published
GitHub CLI allows path traversal through unescaped request URL components in github.com/cli/cli
osv · CVE-2026-64653 · GHSA-4fjg-2h4q-fwg3
Go: github.com/cli/cli · Go: github.com/cli/cli/v2
GO-2026-6801Published
Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable in github.com/0xJacky/Nginx-UI
osv · CVE-2026-84321 · GHSA-wq4w-vwvq-q3x9
Go: github.com/0xJacky/Nginx-UI
GO-2026-6779Published
Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image) in github.com/0xJacky/Nginx-UI
osv · CVE-2026-84317 · GHSA-76pm-mq2q-9gcr
Go: github.com/0xJacky/Nginx-UI
GO-2026-6799Published
Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools in github.com/0xJacky/Nginx-UI
osv · CVE-2026-84360 · GHSA-vc32-4gwf-77xp
Go: github.com/0xJacky/Nginx-UI
GO-2026-6741Published
Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite in github.com/0xJacky/Nginx-UI
osv · CVE-2026-107806 · GHSA-p393-cf76-4jmr
Go: github.com/0xJacky/Nginx-UI
GO-2026-6722Published
Vikunja: TOTP secret is readable after enrollment, no step-up auth in code.vikunja.io/api
osv · CVE-2026-91982 · GHSA-88f6-4rjv-x774
Go: code.vikunja.io/api
GO-2026-6726Published
Vikunja: API token scopes bypassed via task expand parameter (comments, reactions, time entry counts) in code.vikunja.io/api
osv · CVE-2026-91983 · GHSA-9rg3-v78m-26q8
Go: code.vikunja.io/api
GO-2026-6732Published
Vikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UID in code.vikunja.io/api
osv · GHSA-g38j-7v97-x298
Go: code.vikunja.io/api
GO-2026-6717Published
Vikunja: Unbounded image decode on avatar and project-background uploads enables decode/resize amplification in code.vikunja.io/api
osv · CVE-2026-91971 · GHSA-4vh2-39rq-rq8j
Go: code.vikunja.io/api
GO-2026-6689Published
Panic and memory exhaustion via unbounded CFB stream allocation in github.com/xuri/excelize
osv · CVE-2026-107215 · GHSA-x2q3-8cjh-766f
Go: github.com/360EntSecGroup-Skylar/excelize/v2 · Go: github.com/xuri/excelize/v2
GO-2026-6753Published
Vikunja: Link-share principal ID collision allows cross-account API token issuance and management in code.vikunja.io/api
osv · CVE-2026-68581 · GHSA-vvcv-vpph-h844
Go: code.vikunja.io/api
GO-2026-6734Published
Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage in github.com/0xJacky/Nginx-UI
osv · CVE-2026-107805 · GHSA-j3hg-9rp3-5hw9
Go: github.com/0xJacky/Nginx-UI
GO-2026-6752Published
Vikunja: Link-share token can enumerate users through the v2 API in code.vikunja.io/api
osv · CVE-2026-91981 · GHSA-vfxw-3x8p-2vjr
Go: code.vikunja.io/api
GO-2026-6696Published
Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass in github.com/corazawaf/coraza
osv · CVE-2026-104774 · GHSA-pc5q-qfxp-ggqv
Go: github.com/corazawaf/coraza · Go: github.com/corazawaf/coraza/v2 · Go: github.com/corazawaf/coraza/v3
GO-2026-6720Published
yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels in github.com/jhaals/yopass
osv · CVE-2026-107840 · GHSA-6r69-c6wg-7g8m
Go: github.com/jhaals/yopass
GO-2026-6703Published
Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs in github.com/0xJacky/Nginx-UI
osv · CVE-2026-107809 · GHSA-33rr-wq23-g6gg
Go: github.com/0xJacky/Nginx-UI
GO-2026-6721Published
Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited in code.vikunja.io/api
osv · CVE-2026-91972 · GHSA-6rvj-qwjf-3m4q
Go: code.vikunja.io/api
GO-2026-6774Published
Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context in github.com/0xJacky/Nginx-UI
osv · CVE-2026-84319 · GHSA-5r62-gj48-897x
Go: github.com/0xJacky/Nginx-UI
GO-2026-6748Published
Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access in code.vikunja.io/api
osv · CVE-2026-62376 · GHSA-r6w9-259g-gwrv
Go: code.vikunja.io/api
GO-2026-6777Published
Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG Decoder in github.com/bishopfox/sliver
osv · CVE-2026-77622 · GHSA-663m-7x7m-g4fw
Go: github.com/bishopfox/sliver
GO-2026-6768Published
Terragrunt catalog predictable temp symlink clobber in github.com/gruntwork-io/terragrunt
osv · CVE-2026-64672 · GHSA-wv6g-x823-wx9m
Go: github.com/gruntwork-io/terragrunt
GO-2026-6786Published
TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover in github.com/0xJacky/Nginx-UI
osv · CVE-2026-84313 · GHSA-gfrc-g87h-7h5w
Go: github.com/0xJacky/Nginx-UI
GO-2026-6788Published
Nginx UI: Auto backup name allows path traversal outside validated storage path in github.com/0xJacky/Nginx-UI
osv · CVE-2026-84320 · GHSA-jrq7-xrjx-pcfw
Go: github.com/0xJacky/Nginx-UI
GO-2026-6747Published
Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to the share's permission level in code.vikunja.io/api
osv · CVE-2026-91985 · GHSA-qfwc-vx6f-3g6g
Go: code.vikunja.io/api
GO-2026-6782Published
Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image) in github.com/0xJacky/Nginx-UI
osv · CVE-2026-84316 · GHSA-cf23-7qxj-xmhr
Go: github.com/0xJacky/Nginx-UI
GO-2026-6770Published
Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation in github.com/containers/podman
osv · CVE-2026-94603 · GHSA-2cvf-wqm6-wr9g
Go: github.com/containers/podman · Go: github.com/containers/podman/v2 · Go: github.com/containers/podman/v3
GO-2026-6750Published
Vikunja: Scoped API token can mint unrestricted OAuth session credentials in code.vikunja.io/api
osv · CVE-2026-57458 · GHSA-v3p6-34mc-hj7v
Go: code.vikunja.io/api
GO-2026-6767Published
GitHub CLI allows attestation verification bypass through unescaped regex metacharacters in github.com/cli/cli
osv · CVE-2026-64655 · GHSA-mm27-mwq9-fr5g
Go: github.com/cli/cli · Go: github.com/cli/cli/v2
GO-2026-6749Published
Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA) in code.vikunja.io/api
osv · CVE-2026-68582 · GHSA-rj9j-8772-4h6c
Go: code.vikunja.io/api
GO-2026-6758Published
Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover in code.vikunja.io/api
osv · CVE-2026-62367 · GHSA-xv7q-fvmc-jx96
Go: code.vikunja.io/api
GO-2026-6775Published
Nginx UI OTP secure-session step-up is missing on sensitive mutation routes in github.com/0xJacky/Nginx-UI
osv · CVE-2026-84315 · GHSA-5v7c-xpfp-p65m
Go: github.com/0xJacky/Nginx-UI
GO-2026-6776Published
KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication in github.com/kedacore/keda
osv · CVE-2026-77524 · GHSA-637c-6jxx-4rwm
Go: github.com/kedacore/keda · Go: github.com/kedacore/keda/v2
GO-2026-6688Published
Mutually-referencing array formulas recurse unboundedly, causing a fatal stack overflow in github.com/xuri/excelize
osv · CVE-2026-107216 · GHSA-wp2g-vpjj-g53r
Go: github.com/xuri/excelize/v2
GO-2026-6687Published
Nil-pointer dereference in GetSlicers when a worksheet has extLst present but no drawing element in github.com/xuri/excelize
osv · CVE-2026-107213 · GHSA-r7x5-4969-99p7
Go: github.com/xuri/excelize/v2
GO-2026-6714Published
Vikunja: Cross-project task disclosure through subtask expansion in code.vikunja.io/api
osv · GHSA-3hc7-r24j-rpwc
Go: code.vikunja.io/api
GO-2026-6700Published
Pre-negotiation frame limit is not enforced to 4KB in github.com/rabbitmq/amqp091-go
osv · CVE-2026-107386 · GHSA-w6r9-248c-frg8
Go: github.com/rabbitmq/amqp091-go
GO-2026-6705Published
Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITM in github.com/0xJacky/Nginx-UI
osv · CVE-2026-107812 · GHSA-662p-52hx-cmh2
Go: github.com/0xJacky/Nginx-UI
GO-2026-6707Published
Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are applied in github.com/0xJacky/Nginx-UI
osv · CVE-2026-107810 · GHSA-p8v3-89rh-jxc7
Go: github.com/0xJacky/Nginx-UI
GO-2026-6708Published
Nginx UI: Node Secret Credential Exposure via URL Query Parameter in github.com/0xJacky/Nginx-UI
osv · CVE-2026-107807 · GHSA-pvgv-gcp7-v38g
Go: github.com/0xJacky/Nginx-UI
GO-2026-6704Published
Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass) in github.com/0xJacky/Nginx-UI
osv · CVE-2026-107808 · GHSA-45gv-9wjv-xh7p
Go: github.com/0xJacky/Nginx-UI
GO-2026-6781Published
Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCE in github.com/0xJacky/Nginx-UI
osv · CVE-2026-84318 · GHSA-9jww-cxg5-rj9m
Go: github.com/0xJacky/Nginx-UI
GO-2026-6755Published
Vikunja: Cross-tenant task-position rows can be injected into arbitrary project views via the unvalidated project_view_id in the task position endpoint (v1 and v2) in code.vikunja.io/api
osv · CVE-2026-91984 · GHSA-w39f-h553-h2mx
Go: code.vikunja.io/api
GO-2026-6706Published
Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up in github.com/0xJacky/Nginx-UI
osv · CVE-2026-107813 · GHSA-h246-wpgf-vmq5
Go: github.com/0xJacky/Nginx-UI
GO-2026-6695Published
Panic via unchecked pivot-cache field index in github.com/xuri/excelize/v2
osv · CVE-2026-107211 · GHSA-mx22-3794-2vpv
Go: github.com/xuri/excelize/v2
GO-2026-6805Published
CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` plugin in github.com/coredns/coredns
osv · CVE-2026-62994 · GHSA-74w3-63xv-x9mv
Go: github.com/coredns/coredns
GO-2026-6807Published
Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check) in github.com/getarcaneapp/arcane/backend
osv · CVE-2026-96627 · GHSA-pw5q-rjx4-7f7p
Go: github.com/getarcaneapp/arcane/backend · Go: github.com/getarcaneapp/arcane/backend/v2
GO-2026-6806Published
Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof` in github.com/getarcaneapp/arcane/backend
osv · CVE-2026-96628 · GHSA-mp22-58ff-6fhr
Go: github.com/getarcaneapp/arcane/backend · Go: github.com/getarcaneapp/arcane/backend/v2
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.