Tina: Code injection via unescaped Git branch name in generated client source
CVE-2026-108259
### Summary `@tinacms/cli` inserts the raw Git branch value into the generated `client.ts` source without escaping or e
#severity:high
共收录 5417 条相关情报。
← 返回所有主题@tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS
CVE-2026-108260
### Summary `` renders a rich-text AST into the DOM and, for `a` nodes, assigns the node's URL straight to the anchor's
Vikunja: Planka migration retains an unbounded aggregate of attacker-served attachments and can OOM the API
CVE-2026-91970
# Planka migration retains an unbounded aggregate of attacker-served attachments and can OOM the API ## Summary The al
Vikunja: Unbounded CSV row cardinality permits API process termination
CVE-2026-91969
# Unbounded CSV row cardinality permits API process termination ## Summary The authenticated v2 CSV migration route ca
Vikunja: Unbounded nested task-filter recursion permits API process termination
CVE-2026-91968
# Unbounded nested task-filter recursion permits API process termination ## Summary Authenticated task-list routes acc
Vikunja: Denial of service via decompression bomb in the data import
CVE-2026-91979
### Summary Vikunja lets you export your data as a zip and import it back. The import doesn't limit how large the archiv
Vikunja: Unbounded image decode on avatar and project-background uploads enables decode/resize amplification
CVE-2026-91971
### Summary The 50-megapixel decode guard exists only on the task-attachment preview path. Avatar and project-background
Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to the share's permission level
CVE-2026-91985
## Summary A user who has only read permission on a project can call the single link-share read endpoint and receive th
Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited
CVE-2026-91972
### Summary `registerAPIRoutesV2` never applies the unconditional pre-auth rate-limit floor (`unauthRateLimit()`) to the
Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access
CVE-2026-62376
### Summary Vikunja stores password-reset, email-confirmation, and account-deletion tokens in the `user_tokens` table i
Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover
CVE-2026-62367
## Summary With the per-provider OIDC `emailfallback` option enabled, Vikunja links an SSO login to a pre-existing **lo
ageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud `getFileURL` Endpoint Leads to Remote Denial of Service
CVE-2026-107839
### Summary The AoE3 `POST /game/cloud/getFileURL` handler in `luskaner/ageLANServer`'s bundled game server decodes an a
Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure
CVE-2026-76216
## Summary Vikunja's `web.Auth` interface (`pkg/web/web.go`, single method `GetID() int64`) is satisfied by BOTH `*user.
yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels
CVE-2026-107840
The Prometheus metrics middleware in pkg/server/server.go used r.Method directly as a label value on request counter and
Vikunja: Link-share principal ID collision allows cross-account API token issuance and management
CVE-2026-68581
Executive Summary Vikunja accepts both regular-user JSON Web Tokens (JWTs) and link-share JWTs through its generic auth
Vikunja: Scoped API token can mint unrestricted OAuth session credentials
CVE-2026-57458
## Summary A scoped API token can bypass its declared permissions by using the OAuth authorization flow to mint normal
EIPStackGroup OpENer v2.3 / master commit 76b95cf contains a buffer overflow in the...
CVE-2026-75350
EIPStackGroup OpENer v2.3 / master commit 76b95cf contains a buffer overflow in the GetAttributeList() implementation fo
EIPStackGroup OpENer v2.3 and master up to commit 76b95cf contain an expired pointer dereference...
CVE-2026-75347
EIPStackGroup OpENer v2.3 and master up to commit 76b95cf contain an expired pointer dereference vulnerability in the Et
AstronRPA through 1.1.6 contains a download of code without integrity check vulnerability that...
CVE-2026-108160
AstronRPA through 1.1.6 contains a download of code without integrity check vulnerability that allows network attackers
AstronRPA through 1.1.6 contains a cross-site scripting vulnerability in the desktop client's...
CVE-2026-108159
AstronRPA through 1.1.6 contains a cross-site scripting vulnerability in the desktop client's smart-component chat that