Go Advisories.

Vikunja: Planka migration retains an unbounded aggregate of attacker-served attachments and can OOM the API

• Denial of service

>=2.5.0, <2.6.0 · fixed in 2.6.0

Vikunja: Unbounded CSV row cardinality permits API process termination

• Denial of service

>=2.5.0, <2.6.0 · fixed in 2.6.0

Vikunja: Unbounded nested task-filter recursion permits API process termination

• Denial of service

>=2.5.0, <2.6.0 · fixed in 2.6.0

Vikunja: Denial of service via decompression bomb in the data import

• Denial of service
• CWE-409

<2.6.0 · fixed in 2.6.0

Vikunja: Link-share token can enumerate users through the v2 API

• Information disclosure
• Broken access control

<2.6.0 · fixed in 2.6.0

Vikunja: Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway project

• Information disclosure
• Broken access control

<2.6.0 · fixed in 2.6.0

Vikunja: Unbounded image decode on avatar and project-background uploads enables decode/resize amplification

• Denial of service

<2.6.0 · fixed in 2.6.0

Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords

• Authentication bypass

<2.6.0 · fixed in 2.6.0

Vikunja: API token scopes bypassed via task expand parameter (comments, reactions, time entry counts)

• Broken access control

>=1.0.0, <2.6.0 · fixed in 2.6.0

Vikunja: Cross-tenant task-position rows can be injected into arbitrary project views via the unvalidated project_view_id in the task position endpoint (v1 and v2)

• Broken access control

<2.6.0 · fixed in 2.6.0

Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to the share's permission level

• Information disclosure
• Broken access control

<2.6.0 · fixed in 2.6.0

Vikunja: TOTP secret is readable after enrollment, no step-up auth

• Information disclosure
• Hard-coded credentials

<2.6.0 · fixed in 2.6.0

Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited

• Authentication bypass

<2.6.0 · fixed in 2.6.0

Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access

• Information disclosure
• Weak cryptography or TLS

<2.4.0 · fixed in 2.4.0

Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover

• Authentication bypass
• CWE-345

>=1.0.0, <2.4.0 · fixed in 2.4.0

Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite

• Code injection

>=1.9.10-0.20260421071512-7864e378f5cf, <1.9.10-0.20260728074146-a467ed652591 · fixed in 1.9.10-0.20260728074146-a467ed652591

ageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud `getFileURL` Endpoint Leads to Remote Denial of Service

• Denial of service

<1.8.2-0.20260809203301-1dd40166a593 · fixed in 1.8.2-0.20260809203301-1dd40166a593

Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure

• Broken access control
• Memory corruption

<2.5.0 · fixed in 2.5.0

yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels

• Denial of service

<0.0.0-20260727191436-61e31ead04a4 · fixed in 0.0.0-20260727191436-61e31ead04a4

Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)

• Broken access control

>=0.24.0, <2.4.0 · fixed in 2.4.0

Vikunja: Link-share principal ID collision allows cross-account API token issuance and management

• Broken access control

>=0.22.0, <2.4.0 · fixed in 2.4.0

Vikunja: Scoped API token can mint unrestricted OAuth session credentials

• Privilege escalation

>=2.3.0, <2.4.0 · fixed in 2.4.0

Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITM

• CWE-494

>=1.9.10-0.20250517140552-daee3ac7ade1, <1.9.10-0.20260728114330-580585516dd8 · fixed in 1.9.10-0.20260728114330-580585516dd8

Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)

• Authentication bypass
• CWE-305

>=1.9.10-0.20250517140552-daee3ac7ade1, <1.9.10-0.20260728074558-95cd21b70814 · fixed in 1.9.10-0.20260728074558-95cd21b70814

Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs

• Cross-site request forgery (CSRF)

>=1.9.10-0.20250517140552-daee3ac7ade1, <1.9.10-0.20260728074433-a3999bd78a3b · fixed in 1.9.10-0.20260728074433-a3999bd78a3b

Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up

• Broken access control

>=1.9.10-0.20250517140552-daee3ac7ade1, <1.9.10-0.20260728074433-a3999bd78a3b · fixed in 1.9.10-0.20260728074433-a3999bd78a3b

0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser

• Information disclosure
• Broken access control

>=1.9.10-0.20250517140552-daee3ac7ade1, <1.9.10-0.20260728091109-0ecbd106c37b · fixed in 1.9.10-0.20260728091109-0ecbd106c37b

Nginx UI: Node Secret Credential Exposure via URL Query Parameter

• Information disclosure
• CWE-598

>=1.9.10-0.20250517140552-daee3ac7ade1, <1.9.10-0.20260728074433-a3999bd78a3b · fixed in 1.9.10-0.20260728074433-a3999bd78a3b

Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are applied

• Path traversal
• CWE-61

>=1.9.10-0.20250517140552-daee3ac7ade1, <1.9.10-0.20260728074146-a467ed652591 · fixed in 1.9.10-0.20260728074146-a467ed652591

Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL

• Command injection

>=2.11.0, <=2.14.21 · no fixed version yet

HTTP/2 server crash due to HPACK encoder race in net/http

• Race condition

<0.60.0 · fixed in 0.60.0

HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http

• HTTP request smuggling

<1.26.9 || >=1.27.0-0, <1.27.2 · fixed in 1.26.9, 1.27.2

Double flow control refund on HTTP/2 server streams in net/http

• CWE-675

<0.60.0 · fixed in 0.60.0

Excessive CPU consumption from repeated initial window changes in net/http

• CWE-405

<0.60.0 · fixed in 0.60.0

HTTP/2 transport accepts malformed framing-related headers in net/http

• HTTP request smuggling

<0.60.0 · fixed in 0.60.0

Lack of limit on size of parsed Range headers in net/http

• Denial of service

<1.26.9 || >=1.27.0-0, <1.27.2 · fixed in 1.26.9, 1.27.2

Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart

• Denial of service

<1.26.9 || >=1.27.0-0, <1.27.2 · fixed in 1.26.9, 1.27.2

Reject malformed ECH outer extension references in crypto/tls

• CWE-405

<1.26.9 || >=1.27.0-0, <1.27.2 · fixed in 1.26.9, 1.27.2

HTTP/1 client connection desynchronization after CONNECT rejection in net/http

• HTTP request smuggling

<1.26.9 || >=1.27.0-0, <1.27.2 · fixed in 1.26.9, 1.27.2

Root.Mkdir(All) can follow junctions out of the root on Windows in os

• CWE-1386

<1.26.9 || >=1.27.0-0, <1.27.2 · fixed in 1.26.9, 1.27.2

HTTP/2 server memory exhaustion due to Trailer headers in net/http

• CWE-405

<0.60.0 · fixed in 0.60.0

Checksum database bypass for golang.org/toolchain in cmd/go

• CWE-354

<1.26.9 || >=1.27.0-0, <1.27.2 · fixed in 1.26.9, 1.27.2

Checksum bypass for golang.org/fips140 in cmd/go

• CWE-354

<1.26.9 || >=1.27.0-0, <1.27.2 · fixed in 1.26.9, 1.27.2

Recognize yield as regexp preceder keyword in html/template

• Cross-site scripting (XSS)

<1.26.9 || >=1.27.0-0, <1.27.2 · fixed in 1.26.9, 1.27.2

Reset context tracking on consecutive template expressions in html/template

• Cross-site scripting (XSS)

<1.26.9 || >=1.27.0-0, <1.27.2 · fixed in 1.26.9, 1.27.2

amqp091-go: Pre-negotiation frame limit is not enforced to 4KB

• Denial of service

<1.14.0 · fixed in 1.14.0

Excelize: Unchecked pivot-cache field index in extractPivotTableFields causes unrecoverable panic

• CWE-129

>=2.8.1, <2.11.1-0.20261003002531-6258dcebc4e2 · fixed in 2.11.1-0.20261003002531-6258dcebc4e2

Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor

• Denial of service

>=3.0.0, <3.8.0 · fixed in 3.8.0

Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection

• CWE-20
• CWE-436

>=3.0.4, <3.8.1 · fixed in 3.8.1

Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion

• Denial of service

>=3.0.0, <3.8.0 · fixed in 3.8.0

Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules

• CWE-20
• CWE-436

<3.8.1 · fixed in 3.8.1

Coraza has Cookie Parser Confusion

• CWE-436

<3.8.1 · fixed in 3.8.1

Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations

• CWE-20
• CWE-436

>=3.0.0, <3.8.0 · fixed in 3.8.0

Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass

• CWE-172
• CWE-193

>=3.0.0, <3.8.0 · fixed in 3.8.0

Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)

• Denial of service

>=3.0.0, <3.8.1 · fixed in 3.8.1

Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection

• CWE-20
• CWE-436

>=3.0.0, <3.8.1 · fixed in 3.8.1

Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for days

• Denial of service

>=2.1.0, <2.11.1-0.20260930021559-01a9ff32fb3c · fixed in 2.11.1-0.20260930021559-01a9ff32fb3c

Excelize: Nil-pointer dereference in GetSlicers when a worksheet has extLst present but no drawing element

• Memory corruption

>=2.9.0, <2.11.1-0.20260929015830-8ffeb07ec9a3 · fixed in 2.11.1-0.20260929015830-8ffeb07ec9a3

Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks

• CWE-248

>=2.3.1, <2.11.1-0.20260915055537-22f76f9acb94 · fixed in 2.11.1-0.20260915055537-22f76f9acb94

Excelize: extractPart allocates attacker-controlled, unbounded and negative-sized buffers from CFB directory entries: remote panic / OOM DoS

• Denial of service

>=2.3.1, <2.11.1-0.20260912113515-5f636f9dcde5 · fixed in 2.11.1-0.20260912113515-5f636f9dcde5