Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure

CVE-2026-76216

## Summary Vikunja's `web.Auth` interface (`pkg/web/web.go`, single method `GetID() int64`) is satisfied by BOTH `*user.

历史摘要 · 未重新核验 · GitHub Advisory

yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels

CVE-2026-107840

The Prometheus metrics middleware in pkg/server/server.go used r.Method directly as a label value on request counter and

历史摘要 · 未重新核验 · GitHub Advisory

Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)

CVE-2026-68582

## Summary The task-collection endpoint `GET /api/v1/projects/{project}/views/{view}/tasks` loads the requested project

历史摘要 · 未重新核验 · GitHub Advisory

Vikunja: Link-share principal ID collision allows cross-account API token issuance and management

CVE-2026-68581

Executive Summary Vikunja accepts both regular-user JSON Web Tokens (JWTs) and link-share JWTs through its generic auth

历史摘要 · 未重新核验 · GitHub Advisory

Vikunja: Scoped API token can mint unrestricted OAuth session credentials

CVE-2026-57458

## Summary A scoped API token can bypass its declared permissions by using the OAuth authorization flow to mint normal

历史摘要 · 未重新核验 · GitHub Advisory

Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITM

CVE-2026-107812

## Summary The self-upgrade downloads the release binary and its checksum (`*.tar.gz` and `*.tar.gz.digest`) through the

历史摘要 · 未重新核验 · GitHub Advisory

Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)

CVE-2026-107808

## Summary nginx-ui supports two second-factor methods — TOTP (OTP) and WebAuthn passkeys — and reports an account as 2

历史摘要 · 未重新核验 · GitHub Advisory

Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs

CVE-2026-107809

## Summary Nginx-UI v2.4.3 stores the API JWT in a browser cookie named `token` and the `AuthRequired` middleware accept

历史摘要 · 未重新核验 · GitHub Advisory

Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up

CVE-2026-107813

## Summary Incomplete fix of GHSA-5v7c-xpfp-p65m: the secure-session (OTP step-up) requirement added to the nginx, cert

历史摘要 · 未重新核验 · GitHub Advisory

0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser

CVE-2026-107811

Summary 0xJacky/nginx-ui contains a high-severity trust-boundary failure between ordinary users and cluster node credent

历史摘要 · 未重新核验 · GitHub Advisory

Nginx UI: Node Secret Credential Exposure via URL Query Parameter

CVE-2026-107807

## 1. Vulnerability Summary nginx-ui's `Node.Secret` is a master credential that bypasses all JWT/password authenticati

历史摘要 · 未重新核验 · GitHub Advisory

Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are applied

CVE-2026-107810

### Summary An authenticated user who can create and restore a backup can craft a valid backup archive that causes the r

历史摘要 · 未重新核验 · GitHub Advisory

Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL

CVE-2026-55797

### Impact Argo CD runs a shell command in the repo-server when it clones or fetches an SSH Git repository that has a p

历史摘要 · 未重新核验 · GitHub Advisory

Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding

CVE-2026-41510

## Root Cause File: `internal/corazawaf/transaction.go`, lines 770–808 (since commit 2fd87b89, PR #812, 2023-06-14) ``

历史摘要 · 未重新核验 · GitHub Advisory

Coraza: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling

CVE-2026-41508

## Root Cause File: `internal/bodyprocessors/multipart.go` (since commit `3347961b`, PR #1453 *"feat: ignore unexpected

历史摘要 · 未重新核验 · GitHub Advisory

Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fields

CVE-2026-41504

## Root Cause File: `internal/auditlog/formats.go` — multiple sites write attacker-influenced bytes into the Native aud

历史摘要 · 未重新核验 · GitHub Advisory

External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration

CVE-2026-26287

## Summary A bug in the `webhook` generator initialization order incorrectly cleared the label-enforcement flag (`Enforc

历史摘要 · 未重新核验 · GitHub Advisory

Snowflake drivers writes sensitive information to logs

CVE-2026-86597

Insertion of sensitive information into log files in the Snowflake Python, Go, JDBC, Node.js, PHP PDO, and ODBC drivers

历史摘要 · 未重新核验 · GitHub Advisory

gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled

CVE-2026-73802

### Summary act_runner appends workflow-controlled `jobs..container.options` directly to the Docker HostConfig for the

历史摘要 · 未重新核验 · GitHub Advisory

SiYuan Agent Tools SSRF via DNS-Rebinding TOCTOU (Bypass of CheckHostSSRF)

# Security Advisory — SiYuan Agent Tools SSRF via DNS-Rebinding TOCTOU (Bypass of `CheckHostSSRF`) | Field | Value | |-

历史摘要 · 未重新核验 · GitHub Advisory