| RHSA-2026:80394 |
Red Hat Hardened Images RPMs bug fix and enhancement update
|
Red Hat |
2026‑10‑11 |
Low |
| RHSA-2026:80330 |
Red Hat Hardened Images RPMs bug fix and enhancement update
|
Red Hat |
2026‑10‑11 |
Low |
| GHSA-MRVP-7WMX-5M4H |
Contao: Path traversal in the images controller
|
GitHub |
2026‑10‑09 |
Medium |
| GHSA-MFXH-VP55-7GC6 |
Contao: The registration module re-sends activation mails
|
GitHub |
2026‑10‑09 |
Medium |
| GHSA-M687-P538-R5HP |
Vikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted
|
GitHub |
2026‑10‑09 |
High |
| GHSA-M469-88XX-8RX2 |
Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords
|
GitHub |
2026‑10‑09 |
Medium |
| GHSA-JQ7H-WRVP-3RGX |
pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's session
|
GitHub |
2026‑10‑09 |
High |
| GHSA-J3HG-9RP3-5HW9 |
Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage
|
GitHub |
2026‑10‑09 |
High |
| GHSA-HJX8-QV73-F7CM |
Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed
|
GitHub |
2026‑10‑09 |
Medium |
| GHSA-G38J-7V97-X298 |
Vikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UID
|
GitHub |
2026‑10‑09 |
Medium |
| GHSA-FPRF-R6RV-XG99 |
Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants
|
GitHub |
2026‑10‑09 |
Medium |
| GHSA-FMMF-XQ98-G327 |
Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check
|
GitHub |
2026‑10‑09 |
Medium |
| GHSA-C42Q-QVC3-J6VG |
@tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS
|
GitHub |
2026‑10‑09 |
High |
| GHSA-9RG3-V78M-26Q8 |
Vikunja: API token scopes bypassed via task expand parameter (comments, reactions, time entry counts)
|
GitHub |
2026‑10‑09 |
Medium |
| GHSA-9Q47-3CM2-2RP8 |
pyLoad: Rate-Limit Bypass and Audit-Log Spoofing via Trusted Client-Controlled `X-Forwarded-For` Header
|
GitHub |
2026‑10‑09 |
Medium |
| GHSA-9H23-53F4-Q947 |
Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout
|
GitHub |
2026‑10‑09 |
Medium |
| GHSA-9FF2-P842-45WQ |
Contao: Cross-site request forgery in custom backend actions
|
GitHub |
2026‑10‑09 |
Low |
| GHSA-8WVG-R2J4-3737 |
Vikunja: Assignee email addresses disclosed to read-only project members via the task assignees endpoint
|
GitHub |
2026‑10‑09 |
Medium |
| GHSA-88F6-4RJV-X774 |
Vikunja: TOTP secret is readable after enrollment, no step-up auth
|
GitHub |
2026‑10‑09 |
Medium |
| GHSA-889W-M37P-88M5 |
pyLoad: Api.set_user_permission never invalidates the target's session
|
GitHub |
2026‑10‑09 |
High |