Advisory Catalog

Vikunja: Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway project

Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords

Vikunja: API token scopes bypassed via task expand parameter (comments, reactions, time entry counts)

Vikunja: Cross-tenant task-position rows can be injected into arbitrary project views via the unvalidated project_view_id in the task position endpoint (v1 and v2)

Vikunja: TOTP secret is readable after enrollment, no step-up auth

amqp091-go: Pre-negotiation frame limit is not enforced to 4KB

Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor

Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection

Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion

Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules

Coraza has Cookie Parser Confusion

Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations

Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass

Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection

github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files

Excelize: RIGHT() on supplementary-plane text slices with a negative index and panics

Excelize: Panic in cellInRange on a worksheet with an empty mergeCell ref

Excelize: a row whose earlier cell has a higher column reference than its last cell panics index out of range on almost every worksheet read API

Excelize: GetConditionalFormats indexes conditional-formatting rule sub-elements with no length or nil check

Excelize: A Zip64 uncompressed-size of 2^63 panics OpenFile/OpenReader

Excelize: GetStyle panics on a negative fillId, borderId or fontId in styles.xml

Coraza: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling

Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fields

SiYuan: TLS Private Keys Readable via getFile (Incomplete Blocklist)

SiYuan: /history/*path and /repo/diff/*path potentially exposing historical snapshots of data/.siyuan/publishAccess.json and data/templates/*

SiYuan MCP asset.upload Reads Arbitrary Absolute File Paths (Workspace Boundary Bypass)

Anubis: Policy bypass via client controlled X-Original-URI header

SiYuan: The reference filter for getRefIDs checks visibility but not the password tier, disclosing that password-protected documents reference a given block

SiYuan: getBookmarkLabels returns every bookmark label in the workspace to anonymous readers, with no publish-access filtering

SiYuan: getUniqueFilename passes an unvalidated client-supplied path to the filesystem, giving anonymous readers an existence oracle over the entire host filesystem

SiYuan: Outline state for any document, including documents forbidden to readers, is returned by /api/storage/getOutlineStorage with no access check

SiYuan discloses an administrator's open documents and search terms to anonymous readers

OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full

OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation

Containerd has image-pull DoS via crafted OCI index graph amplification

Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces

Dozzle label filters do not restrict container event and statistics streams

podman quadlet install --replace does not fully replace the old file

Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle

Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant_id filter

Cloudreve: SSRF guard bypass: checkIP does not decode IPv6-transition wrappers (NAT64, IPv4-compatible, 6to4) reaching internal and cloud-metadata addresses

Gardener: Authorization Bypass via Group Subject Injection

Nuclei: Environment Variable Disclosure via Response-Derived Data in DAST/Fuzz Mode

Nuclei: Local File Read via Workflow File-Protocol Gate Bypass

Nuclei: Local File Read via MySQL Client Sandbox Bypass

Nuclei: Arbitrary Command Execution via DAST Code Signature Bypass

Tinyauth: Unauthenticated login attempts can trigger global login lockdown denial of service

Tinyauth: User enumeration attack by timing oracle

KubeEdge: Unbounded allocation in viaduct packer enables authenticated remote DoS against CloudHub

OpenBao Skips Stricter Deny Policy for LIST operations