Advisory Catalog

Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover

ageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud `getFileURL` Endpoint Leads to Remote Denial of Service

Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure

yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels

Vikunja: Link-share principal ID collision allows cross-account API token issuance and management

Vikunja: Scoped API token can mint unrestricted OAuth session credentials

Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITM

Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)

Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs

Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up

0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser

Nginx UI: Node Secret Credential Exposure via URL Query Parameter

Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are applied

Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL

Excelize: Unchecked pivot-cache field index in extractPivotTableFields causes unrecoverable panic

Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)

Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for days

Excelize: Nil-pointer dereference in GetSlicers when a worksheet has extLst present but no drawing element

Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks

Excelize: extractPart allocates attacker-controlled, unbounded and negative-sized buffers from CFB directory entries: remote panic / OOM DoS

Excelize ANCHORARRAY: mutually-referencing array formulas recurse unboundedly via re-entrant CalcCellValue, causing a fatal stack overflow

Excelize ColumnNameToNumber: int64 overflow yields an out-of-domain coordinate with nil error, causing negative slice index panic on r="0" rows

Excelize: Unbounded spinCount in agile decryption burns CPU during OpenFile

Excelize: Unbounded <col max> attribute is loaded with no MaxColumns check and expanded per-column by flatCols(), so any column mutator hangs or OOMs the process

Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query

Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding

External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration

SiYuan Agent Tools SSRF via DNS-Rebinding TOCTOU (Bypass of CheckHostSSRF)

SiYuan: 17 block metadata/content endpoints in kernel/api/block.go have zero publish-access filtering, reachable by anonymous publish-mode readers

Xray-core: Pinning a CA certificate via pinnedPeerCertSha256 can lead to the success of MITM attacks

SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class closed one day earlier at the adjacent route

Podman: Malformed Image can trick podman run into leaking host environment variables into the container

ZITADEL: MFA bypass via session reuse in Login V2

ZITADEL: Actions V1 sandbox escape: host file read via require()

Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS

Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery

Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplace

Klever-Go Account takeover: `kleverUpdateAccountPermission` authorizes on attacker-controlled `RecipientAddr` instead of the authenticated caller

Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS)

Klever-Go: /log controls global node logging

Cloudreve: Storage-quota TOCTOU race allows quota bypass and storage-based denial of service

Nuclei: Arbitrary Code Execution via Goja JavaScript Engine Vulnerability

Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist for

KubeEdge: Command Injection in NodeUpgradeJob - RCE on edge nodes via v1alpha2 API

KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join

OpenBao's Templated Policies Allow Privilege Escalation via Wildcard Characters

KubeEdge: ConfigUpdateJob updateFields enables remote shell injection and code execution on edge nodes

SIPGO: DoS via unvalidated WebSocket frame length

SIPGO: DoS via unvalidated Content-Length in the stream parser

nginx ignition has Unauthenticated Admin Account Creation via Onboarding Race Condition