Security Advisories

high2026-10-09

Vikunja: Unbounded image decode on avatar and project-background uploads enables decode/resize amplification

go-vikunja/vikunja · GHSA-4vh2-39rq-rq8j · CVE-2026-91971

medium2026-10-09

Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords

go-vikunja/vikunja · GHSA-m469-88xx-8rx2 · CVE-2026-91973

medium2026-10-09

Vikunja: API token scopes bypassed via task expand parameter (comments, reactions, time entry counts)

go-vikunja/vikunja · GHSA-9rg3-v78m-26q8 · CVE-2026-91983

medium2026-10-09

Vikunja: Cross-tenant task-position rows can be injected into arbitrary project views via the unvalidated project_view_id in the task position endpoint (v1 and v2)

go-vikunja/vikunja · GHSA-w39f-h553-h2mx · CVE-2026-91984

high2026-10-09

Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to the share's permission level

go-vikunja/vikunja · GHSA-qfwc-vx6f-3g6g · CVE-2026-91985

medium2026-10-09

Vikunja: TOTP secret is readable after enrollment, no step-up auth

go-vikunja/vikunja · GHSA-88f6-4rjv-x774 · CVE-2026-91982

high2026-10-09

Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited

go-vikunja/vikunja · GHSA-6rvj-qwjf-3m4q · CVE-2026-91972

high2026-10-09

Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access

go-vikunja/vikunja · GHSA-r6w9-259g-gwrv · CVE-2026-62376

high2026-10-09

Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover

go-vikunja/vikunja · GHSA-xv7q-fvmc-jx96 · CVE-2026-62367

critical2026-10-09

Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite

0xjacky/nginx-ui · GHSA-p393-cf76-4jmr · CVE-2026-107806

high2026-10-09

ageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud `getFileURL` Endpoint Leads to Remote Denial of Service

luskaner/agelanserver · GHSA-4jfq-pmq9-257h · CVE-2026-107839

high2026-10-09

Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure

go-vikunja/vikunja · GHSA-32r8-5843-4qw2 · CVE-2026-76216

high2026-10-09

yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels

jhaals/yopass · GHSA-6r69-c6wg-7g8m · CVE-2026-107840

medium2026-10-09

pacioli: A submit consent marker licensed cancellation of caller-named pre-existing documents

john-broadway/pacioli · GHSA-3hj7-6vmj-h8v4 · CVE-2026-107841

critical2026-10-09

Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)

go-vikunja/vikunja · GHSA-rj9j-8772-4h6c · CVE-2026-68582

high2026-10-09

Vikunja: Link-share principal ID collision allows cross-account API token issuance and management

go-vikunja/vikunja · GHSA-vvcv-vpph-h844 · CVE-2026-68581

high2026-10-09

Vikunja: Scoped API token can mint unrestricted OAuth session credentials

go-vikunja/vikunja · GHSA-v3p6-34mc-hj7v · CVE-2026-57458

high2026-10-09

pyload-ng: getUserData/get_userdata exposed at Perms.ANY allow any authenticated account to brute-force the administrator password

pyload/pyload · GHSA-68w4-83fh-f2w8

medium2026-10-09

pyLoad: Rate-Limit Bypass and Audit-Log Spoofing via Trusted Client-Controlled `X-Forwarded-For` Header

pyload/pyload · GHSA-9q47-3cm2-2rp8

high2026-10-09

pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's session

pyload/pyload · GHSA-jq7h-wrvp-3rgx