Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed

## Summary A collaborator removed from a project keeps a **live, automatic feed** of that project's contents, because n

历史摘要 · 未重新核验 · GitHub Advisory

Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants

### Summary In Vikunja v2.6.0 the task position recalculation that runs when a saved filter view is created fails open

历史摘要 · 未重新核验 · GitHub Advisory

Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes

### Summary Vikunja v2.6.0 introduced server-side sessions with revocation semantics: `DELETE /api/v2/user/sessions/{id

历史摘要 · 未重新核验 · GitHub Advisory

Vikunja: Task relation deletion does not check read access to the other task, allowing cross-project relation removal

## Summary Deleting a task relation only requires write access on the base task. Unlike relation creation, it does not

历史摘要 · 未重新核验 · GitHub Advisory

Vikunja: Assignee email addresses disclosed to read-only project members via the task assignees endpoint

### Summary `TaskAssginee.ReadAll` returns assignee user objects without blanking the `Email` field, disclosing assignee

历史摘要 · 未重新核验 · GitHub Advisory

Vikunja: Cross-project task disclosure through subtask expansion

### Summary Vikunja lets a task in one project have a subtask that lives in a different project. When listing a project'

历史摘要 · 未重新核验 · GitHub Advisory

pyload-ng: getUserData/get_userdata exposed at Perms.ANY allow any authenticated account to brute-force the administrator password

## Summary `Api.getUserData` (legacy) and `Api.get_userdata` are declared with `@permission(Perms.ANY)` and are reachab

历史摘要 · 未重新核验 · GitHub Advisory

pyLoad: Rate-Limit Bypass and Audit-Log Spoofing via Trusted Client-Controlled `X-Forwarded-For` Header

## Summary pyLoad determines the "client IP" used for its rate-limiting decorator and for its security/audit logging by

历史摘要 · 未重新核验 · GitHub Advisory

pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's session

An admin who revokes a user's privileges through the REST API does not actually revoke them, because the session carryin

历史摘要 · 未重新核验 · GitHub Advisory

pyLoad: Api.set_user_permission never invalidates the target's session

### Summary An admin who revokes or downgrades a non-admin user's permissions through pyLoad's own documented `/api/` RP

历史摘要 · 未重新核验 · GitHub Advisory

pyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=)

### Summary `UnTar._safe_extractall` — the hardening added for GHSA-mvwx-582f-56r7 — validates member **names** and sym

历史摘要 · 未重新核验 · GitHub Advisory

[原创]CVE-2020-6507利用链

CVE-2020-6507

[原创]CVE-2020-6507利用链

历史摘要 · 未重新核验 · 看雪

CVE-2026-39821：Go idna 纯 ASCII 标签解码漏报

CVE-2026-39821

CVE-2026-39821：Go idna 纯 ASCII 标签解码漏报

历史摘要 · 未重新核验 · 先知社区

Unpatched AhsayCBS Vulnerabilities Exploited in the Wild

CVE-2026-105133 · CVE-2026-105134

The flaws, CVE-2026-105133 and CVE-2026-105134, allow attackers to bypass authentication and inject OS commands. The pos

历史摘要 · 未重新核验 · SecurityWeek

From Reactive Containment to Proactive Assurance: Lessons from OpenAI, Anthropic, and Google Agent Security Incidents

In 2026, cybersecurity evaluations involving OpenAI, Anthropic, and Google agents reached real systems outside their aut

历史摘要 · 未重新核验 · arXiv cs.CR

Improved Local Leakage Resilience of Shamir Secret Sharing and Worst-Case Optimal Polynomial Intersection

We study two problems: Local Leakage Resilience (LLR) for Shamir secret sharing, and worst-case Optimal Polynomial Inter

历史摘要 · 未重新核验 · arXiv cs.CR

ReSI: Recursive Safety Improvement toward Resistant and Resilient AI

Recursive self-improvement, the participation of AI systems in improving their own capabilities, is beginning to move fr

历史摘要 · 未重新核验 · arXiv cs.CR

Verification with Transfer: Exact Information Frontiers and Their Price in Calls

A verifier that accepts or rejects whole answers reveals little: under a flat prior over $k$-bit answers, zero error nee

历史摘要 · 未重新核验 · arXiv cs.CR

Secure Aggregate Encryption with Identity-Based Authentication for Multi-Vendor FPGA Cloud Deployment

Secure deployment of FPGA bitstreams in heterogeneous multi-vendor cloud infrastructures requires scalable authorization

历史摘要 · 未重新核验 · arXiv cs.CR

Local Sensitivity in Exponential Selection: Failure Modes and Valid Calibrations

Selection is a task that chooses one element from a finite public candidate range to maximize a data-dependent score. In

历史摘要 · 未重新核验 · arXiv cs.CR