Advisory Catalog

Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed

Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants

Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes

Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage

Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout

Vikunja: Task relation deletion does not check read access to the other task, allowing cross-project relation removal

Vikunja: Assignee email addresses disclosed to read-only project members via the task assignees endpoint

Vikunja: Cross-project task disclosure through subtask expansion

Vikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UID

Vikunja: Planka migration retains an unbounded aggregate of attacker-served attachments and can OOM the API

Vikunja: Unbounded CSV row cardinality permits API process termination

Vikunja: Unbounded nested task-filter recursion permits API process termination

Vikunja: Denial of service via decompression bomb in the data import

Vikunja: Link-share token can enumerate users through the v2 API

Vikunja: Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway project

Vikunja: Unbounded image decode on avatar and project-background uploads enables decode/resize amplification

Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords

Vikunja: API token scopes bypassed via task expand parameter (comments, reactions, time entry counts)

Vikunja: Cross-tenant task-position rows can be injected into arbitrary project views via the unvalidated project_view_id in the task position endpoint (v1 and v2)

Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to the share's permission level

Vikunja: TOTP secret is readable after enrollment, no step-up auth

Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited

Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access

Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover

Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite

ageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud `getFileURL` Endpoint Leads to Remote Denial of Service

Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure

yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels

Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)

Vikunja: Link-share principal ID collision allows cross-account API token issuance and management

Vikunja: Scoped API token can mint unrestricted OAuth session credentials

Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITM

Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)

Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs

Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up

0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser

Nginx UI: Node Secret Credential Exposure via URL Query Parameter

Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are applied

Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL

Root.Mkdir(All) can follow junctions out of the root on Windows in os

HTTP/1 client connection desynchronization after CONNECT rejection in net/http

HTTP/2 server memory exhaustion due to Trailer headers in net/http

HTTP/2 transport accepts malformed framing-related headers in net/http

Double flow control refund on HTTP/2 server streams in net/http

Lack of limit on size of parsed Range headers in net/http

Excessive CPU consumption from repeated initial window changes in net/http

HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http

Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart

Checksum bypass for golang.org/fips140 in cmd/go

Checksum database bypass for golang.org/toolchain in cmd/go