Tina: Code injection via unescaped Git branch name in generated client source

CVE-2026-108259

### Summary `@tinacms/cli` inserts the raw Git branch value into the generated `client.ts` source without escaping or e

历史摘要 · 未重新核验 · GitHub Advisory

TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment

CVE-2026-108261

### Summary The TinaCMS admin builds its preview `` from the `/~/*` hash-router splat without checking that the value s

历史摘要 · 未重新核验 · GitHub Advisory

@tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS

CVE-2026-108260

### Summary `` renders a rich-text AST into the DOM and, for `a` nodes, assigns the node's URL straight to the anchor's

历史摘要 · 未重新核验 · GitHub Advisory

Shiny for Python has path traversal in bookmark restore

CVE-2026-108258

### Impact Shiny for Python's bookmark-restore path accepted a client-supplied `_state_id_` query-string value and join

历史摘要 · 未重新核验 · GitHub Advisory

Vikunja: Task relation deletion does not check read access to the other task, allowing cross-project relation removal

## Summary Deleting a task relation only requires write access on the base task. Unlike relation creation, it does not

历史摘要 · 未重新核验 · GitHub Advisory

Vikunja: Assignee email addresses disclosed to read-only project members via the task assignees endpoint

### Summary `TaskAssginee.ReadAll` returns assignee user objects without blanking the `Email` field, disclosing assignee

历史摘要 · 未重新核验 · GitHub Advisory

Vikunja: Cross-project task disclosure through subtask expansion

### Summary Vikunja lets a task in one project have a subtask that lives in a different project. When listing a project'

历史摘要 · 未重新核验 · GitHub Advisory

Vikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UID

### Summary Creating a task relation over CalDAV does not run the `TaskRelation.CanCreate` permission check that the RES

历史摘要 · 未重新核验 · GitHub Advisory

Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled

CVE-2026-107842

`ModuleSearch` decides whether to filter protected pages out of search results based on the current value of `contao.sea

历史摘要 · 未重新核验 · GitHub Advisory

Contao: The registration module re-sends activation mails

CVE-2026-107843

`ModuleRegistration::compile()` reaches its follow-up registration branch on **any** POST to a page carrying the module.

历史摘要 · 未重新核验 · GitHub Advisory

Contao: Cross-site request forgery in custom backend actions

CVE-2026-107848

`RequestTokenListener` is the only generic `REQUEST_TOKEN` validator in Contao and it only runs on POST. On the GET side

历史摘要 · 未重新核验 · GitHub Advisory

Contao: Path traversal in the images controller

CVE-2026-107844

`ImagesController` joins the user controlled `{path}` onto the configured image target directory with `Path::join()`, wh

历史摘要 · 未重新核验 · GitHub Advisory

Contao: Cross-site scripting in the comments bundle

CVE-2026-107845

An unauthenticated front end visitor can post a comment containing a XSS injection. The victim is any back end user who

历史摘要 · 未重新核验 · GitHub Advisory

Contao: Improper access control in the preview links module

CVE-2026-107850

`core-bundle/config/services.yaml` registers the preview access voter with the class `Contao\CoreBundle\Security\Voter\D

历史摘要 · 未重新核验 · GitHub Advisory

Contao: Improper access control in the table access voter

CVE-2026-107851

Due to a caching defect in the security voter that governs table-level access to Contao's Data Container (DCA) backend,

历史摘要 · 未重新核验 · GitHub Advisory

Vikunja: Planka migration retains an unbounded aggregate of attacker-served attachments and can OOM the API

CVE-2026-91970

# Planka migration retains an unbounded aggregate of attacker-served attachments and can OOM the API ## Summary The al

历史摘要 · 未重新核验 · GitHub Advisory

Vikunja: Unbounded CSV row cardinality permits API process termination

CVE-2026-91969

# Unbounded CSV row cardinality permits API process termination ## Summary The authenticated v2 CSV migration route ca

历史摘要 · 未重新核验 · GitHub Advisory

Vikunja: Unbounded nested task-filter recursion permits API process termination

CVE-2026-91968

# Unbounded nested task-filter recursion permits API process termination ## Summary Authenticated task-list routes acc

历史摘要 · 未重新核验 · GitHub Advisory

Vikunja: Denial of service via decompression bomb in the data import

CVE-2026-91979

### Summary Vikunja lets you export your data as a zip and import it back. The import doesn't limit how large the archiv

历史摘要 · 未重新核验 · GitHub Advisory

Vikunja: Link-share token can enumerate users through the v2 API

CVE-2026-91981

### Summary A link-share token, the credential you hand out to let someone view a shared project, can call the v2 user-s

历史摘要 · 未重新核验 · GitHub Advisory