kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path

CVE-2026-100352

## Summary kin-openapi guards against `NaN` and `Inf` values in its built-in schema visitor (`visitJSON`) by returning

历史摘要 · 未重新核验 · GitHub Advisory

Talos Linux: Support bundle does not redact registry credentials

CVE-2026-77564

### Summary When generating a support bundle with `talosctl support` the credentials entered for private registries are

历史摘要 · 未重新核验 · GitHub Advisory

KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication

CVE-2026-77524

## Summary A namespace admin who creates a `TriggerAuthentication` and a `ScaledObject` in their own namespace can make

历史摘要 · 未重新核验 · GitHub Advisory

Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks

CVE-2026-77459

### Impact Argo CD checks an Application's AppProject before it creates resources during a sync. That check covers dest

历史摘要 · 未重新核验 · GitHub Advisory

kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion

CVE-2026-100351

## Summary `openapi3filter.ValidationHandler.Middleware` validates requests with kin-openapi's legacy router, which sel

历史摘要 · 未重新核验 · GitHub Advisory

kin-openapi deepObject query decoding repeatedly compiles an invariant regular expression

CVE-2026-100350

### Summary `openapi3filter` decodes `deepObject`-style query parameters by looping over **every** key in the request's

历史摘要 · 未重新核验 · GitHub Advisory

Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service

CVE-2026-102748

### Summary Dgraph `v25.3.8` exposes a Zero HTTP administrative surface that is unauthenticated when port `6080` is rea

历史摘要 · 未重新核验 · GitHub Advisory

Vitess vttablet /twopcz reflected XSS

CVE-2026-104252

From: xylove21 To: security@vitess.io Subject: [Security Report] Vitess vttablet /twopcz reflected XSS Date: Tue, 24 Jun

历史摘要 · 未重新核验 · GitHub Advisory

kin-openapi spec loader panics on a self-referential additionalProperties $ref (nil-pointer DoS)

CVE-2026-100348

The defect ---------- Confirmed at HEAD (f0407d5, v0.144.0). openapi3/loader.go, inside resolveComponent's drill closure

历史摘要 · 未重新核验 · GitHub Advisory

kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static path

CVE-2026-100347

## Summary The `openapi3filter.ValidationHandler` (the exported, documented request-validation middleware) hard-wires th

历史摘要 · 未重新核验 · GitHub Advisory

Gotify: Insufficiently Protected Password Change endpoint

CVE-2026-102603

The password change endpoint (`POST /current/user/password`) in Gotify versions <= 2.9.1 does not require knowledge of t

历史摘要 · 未重新核验 · GitHub Advisory

Vikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted

## Summary Vikunja ships with `cors.origins` defaulting to `http://127.0.0.1:*` and `http://localhost:*`, and sends `Ac

历史摘要 · 未重新核验 · GitHub Advisory

Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check

## Summary A project member with Write permission can delete an admin-tier link share on that project. The deletion aut

历史摘要 · 未重新核验 · GitHub Advisory

Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2...

## Description ### Summary In Vikunja v2.6.0 the project-permission engine resolves a user's effective permission on a

历史摘要 · 未重新核验 · GitHub Advisory

Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed

## Summary A collaborator removed from a project keeps a **live, automatic feed** of that project's contents, because n

历史摘要 · 未重新核验 · GitHub Advisory

Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants

### Summary In Vikunja v2.6.0 the task position recalculation that runs when a saved filter view is created fails open

历史摘要 · 未重新核验 · GitHub Advisory

Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes

### Summary Vikunja v2.6.0 introduced server-side sessions with revocation semantics: `DELETE /api/v2/user/sessions/{id

历史摘要 · 未重新核验 · GitHub Advisory

Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage

CVE-2026-107805

## Summary In Nginx UI versions 2.5.0 through 2.5.x, the node-signature authentication path staged an attacker-controll

历史摘要 · 未重新核验 · GitHub Advisory

Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout

CVE-2026-107804

## Summary In Nginx UI versions 2.2.0 through 2.5.x, the official bundled reverse-proxy topology did not preserve the e

历史摘要 · 未重新核验 · GitHub Advisory

Vikunja: Task relation deletion does not check read access to the other task, allowing cross-project relation removal

## Summary Deleting a task relation only requires write access on the base task. Unlike relation creation, it does not

历史摘要 · 未重新核验 · GitHub Advisory