Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants

### Summary In Vikunja v2.6.0 the task position recalculation that runs when a saved filter view is created fails open

历史摘要 · 未重新核验 · GitHub Advisory

Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes

### Summary Vikunja v2.6.0 introduced server-side sessions with revocation semantics: `DELETE /api/v2/user/sessions/{id

历史摘要 · 未重新核验 · GitHub Advisory

Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage

CVE-2026-107805

## Summary In Nginx UI versions 2.5.0 through 2.5.x, the node-signature authentication path staged an attacker-controll

历史摘要 · 未重新核验 · GitHub Advisory

Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout

CVE-2026-107804

## Summary In Nginx UI versions 2.2.0 through 2.5.x, the official bundled reverse-proxy topology did not preserve the e

历史摘要 · 未重新核验 · GitHub Advisory

Tina: Code injection via unescaped Git branch name in generated client source

CVE-2026-108259

### Summary `@tinacms/cli` inserts the raw Git branch value into the generated `client.ts` source without escaping or e

历史摘要 · 未重新核验 · GitHub Advisory

TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment

CVE-2026-108261

### Summary The TinaCMS admin builds its preview `` from the `/~/*` hash-router splat without checking that the value s

历史摘要 · 未重新核验 · GitHub Advisory

@tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS

CVE-2026-108260

### Summary `` renders a rich-text AST into the DOM and, for `a` nodes, assigns the node's URL straight to the anchor's

历史摘要 · 未重新核验 · GitHub Advisory

Shiny for Python has path traversal in bookmark restore

CVE-2026-108258

### Impact Shiny for Python's bookmark-restore path accepted a client-supplied `_state_id_` query-string value and join

历史摘要 · 未重新核验 · GitHub Advisory

Vikunja: Task relation deletion does not check read access to the other task, allowing cross-project relation removal

## Summary Deleting a task relation only requires write access on the base task. Unlike relation creation, it does not

历史摘要 · 未重新核验 · GitHub Advisory

Vikunja: Assignee email addresses disclosed to read-only project members via the task assignees endpoint

### Summary `TaskAssginee.ReadAll` returns assignee user objects without blanking the `Email` field, disclosing assignee

历史摘要 · 未重新核验 · GitHub Advisory

Vikunja: Cross-project task disclosure through subtask expansion

### Summary Vikunja lets a task in one project have a subtask that lives in a different project. When listing a project'

历史摘要 · 未重新核验 · GitHub Advisory

Vikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UID

### Summary Creating a task relation over CalDAV does not run the `TaskRelation.CanCreate` permission check that the RES

历史摘要 · 未重新核验 · GitHub Advisory

Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled

CVE-2026-107842

`ModuleSearch` decides whether to filter protected pages out of search results based on the current value of `contao.sea

历史摘要 · 未重新核验 · GitHub Advisory

Contao: The registration module re-sends activation mails

CVE-2026-107843

`ModuleRegistration::compile()` reaches its follow-up registration branch on **any** POST to a page carrying the module.

历史摘要 · 未重新核验 · GitHub Advisory

Contao: Cross-site request forgery in custom backend actions

CVE-2026-107848

`RequestTokenListener` is the only generic `REQUEST_TOKEN` validator in Contao and it only runs on POST. On the GET side

历史摘要 · 未重新核验 · GitHub Advisory

Contao: Path traversal in the images controller

CVE-2026-107844

`ImagesController` joins the user controlled `{path}` onto the configured image target directory with `Path::join()`, wh

历史摘要 · 未重新核验 · GitHub Advisory

Contao: Cross-site scripting in the comments bundle

CVE-2026-107845

An unauthenticated front end visitor can post a comment containing a XSS injection. The victim is any back end user who

历史摘要 · 未重新核验 · GitHub Advisory

Contao: Improper access control in the preview links module

CVE-2026-107850

`core-bundle/config/services.yaml` registers the preview access voter with the class `Contao\CoreBundle\Security\Voter\D

历史摘要 · 未重新核验 · GitHub Advisory

Contao: Improper access control in the table access voter

CVE-2026-107851

Due to a caching defect in the security voter that governs table-level access to Contao's Data Container (DCA) backend,

历史摘要 · 未重新核验 · GitHub Advisory

Vikunja: Planka migration retains an unbounded aggregate of attacker-served attachments and can OOM the API

CVE-2026-91970

# Planka migration retains an unbounded aggregate of attacker-served attachments and can OOM the API ## Summary The al

历史摘要 · 未重新核验 · GitHub Advisory