GHSA-7PXR-59RR-HQJ2 Microsoft.OpenApi.YamlReader vulnerable to denial of service via YAML alias expansion

Impact A small YAML OpenAPI document containing nested anchors and aliases can cause uncontrolled resource consumption in Microsoft.OpenApi.YamlReader and Microsoft.OpenApi.Readers. The issue affects OpenAPI document parsing through the public YAML reader APIs and can cause the parsing process to...

GHSA-XPF3-P7GM-7756 BBOT's Symlink guard bypass in unarchive module allows planting symlinks during extraction

BBOT's unarchive module rejects archives containing symlink entries before extraction, but for zip and 7z archives it failed to detect symlinks whose listing carries a DOS-attribute prefix before the unix mode, as produced by legacy versions of p7zip. Such an archive, downloaded and extracted...

GHSA-M6WQ-39M7-9XPP Metalama allows local code execution through DLL planting in shared temporary directories

Summary Metalama loaded and executed compile-time assemblies, auxiliary executable tools, and embedded helper assemblies from predictable temporary directories. On Linux and macOS the default cache location was the world-writable system temporary directory Path.GetTempPath, i.e. /tmp, and...

GHSA-856C-92HV-3VXX Apprise forwards configured auth headers across cross-origin HTTP redirects

Summary Apprise's HTTP-based notification plugins and its HTTP attachment / config loaders apprise/attachment/http.py, apprise/config/http.py follow HTTP 3xx redirects by default and re-send the user-configured auth headers and query parameters on the redirected request. If an operator-configured...

GHSA-4J9V-H7PP-725H Microsoft Security Advisory CVE-2026-70035 - .NET and Visual Studio Remote Code Execution Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.WindowsDesktop.App.Runtime WPF. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Restrictive XAML and...

GHSA-MF4X-W4GH-4656 Microsoft Security Advisory CVE-2026-70186 - ASP.NET Core Denial of Service Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.Server.Kestrel.Core. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. An unauthenticated...

GHSA-C27M-942F-RCFH Microsoft Security Advisory CVE-2026-87697 - .NET and Visual Studio Remote Code Execution Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.WindowsDesktop.App.Runtime WPF. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. WPF XPS synthetic...

GHSA-QJPX-JQM5-H2C4 Microsoft Security Advisory CVE-2026-96230 - ASP.NET Core Remote Code Execution Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.Components.WebAssembly.Server. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. The Blazor...

GHSA-VRRP-6V32-2P8G Microsoft Security Advisory CVE-2026-70179 - ASP.NET Core Elevation of Privilege Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.Authentication.Negotiate. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. ASP.NET Core...

GHSA-F63G-MX39-3R38 Microsoft Security Advisory CVE-2026-85363 - .NET and Visual Studio Remote Code Execution Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.WindowsDesktop.App.Runtime WPF. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Attacker-controlled X...

GHSA-C399-9853-6JMJ Microsoft Security Advisory CVE-2026-96959 - .NET and Visual Studio Denial of Service Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Xml; System.Private.Xml. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Signed XM...

GHSA-4W5F-7JP2-W48G Microsoft Security Advisory CVE-2026-83520 - .NET and Visual Studio Remote Code Execution Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.WindowsDesktop.App.Runtime WPF. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Restrictive XAML and...

GHSA-F749-VHGX-39H6 Microsoft Security Advisory CVE-2026-70174 - .NET and Visual Studio Remote Code Execution Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.WindowsDesktop.App.Runtime WPF. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. WPF XPS hyperlink...

GHSA-F8QH-MQG4-9939 Microsoft Security Advisory CVE-2026-96232 - .NET and Visual Studio Information Disclosure Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.WindowsDesktop.App.Runtime WPF. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Restrictive XAML and...

GHSA-FQ6X-PVR9-888R Microsoft Security Advisory CVE-2026-96234 - .NET and Visual Studio Information Disclosure Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.WindowsDesktop.App.Runtime WPF. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Restrictive XAML and...

GHSA-5QR9-XXM9-6CMQ Microsoft Security Advisory CVE-2026-96229 - .NET and Visual Studio Information Disclosure Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.WindowsDesktop.App.Runtime WPF. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Restrictive XAML and...

GHSA-G44W-H65V-4CW9 Microsoft Security Advisory CVE-2026-96235 - .NET and Visual Studio Remote Code Execution Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.WindowsDesktop.App.Runtime WPF. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Crafted WPF...

GHSA-VRV5-2JG9-4MMR Microsoft Security Advisory CVE-2026-96222 - .NET Spoofing Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Xml. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. KeyInfoX509Data can accept...

GHSA-2J93-M82W-73J2 Microsoft Security Advisory CVE-2026-96231 - .NET and Visual Studio Elevation of Privilege Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.NETCore.App.Runtime; System.Private.CoreLib. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Unix...

GHSA-2MXG-PRVG-9JFG Microsoft Security Advisory CVE-2026-85790 - .NET Information Disclosure Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.Native.Quic.MsQuic.Schannel. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Various vulnerabilities ...

GHSA-WXXW-5CVC-53J7 Microsoft Security Advisory CVE-2026-66822 - .NET and Visual Studio Information Disclosure Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in System.Net.Http. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. SocketsHttpHandler can retain a...

GHSA-RV87-CCXW-8GGF Microsoft Security Advisory CVE-2026-88092 - ASP.NET Core Security Feature Bypass Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.Server.Kestrel.Core. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. An aborted Kestrel...

GHSA-4MPW-CPWJ-HXXJ Microsoft Security Advisory CVE-2026-70197 - .NET and Visual Studio Remote Code Execution Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in System.Net.Sockets. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. On Windows, reusing a SocketAsyncEventArgs...

GHSA-3RXQ-G8RJ-R2CF Microsoft Security Advisory CVE-2026-69651 - .NET and Visual Studio Denial of Service Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Xml; System.Private.Xml. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Signed XM...

GHSA-7HQP-7C5M-4VQ6 Microsoft Security Advisory CVE-2026-96960 - .NET and Visual Studio Denial of Service Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Xml; System.Private.Xml. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Signed XM...

GHSA-87VJ-4HQV-22P9 Microsoft Security Advisory CVE-2026-96233 - .NET and Visual Studio Denial of Service Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in System.Runtime. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. DateTime Hebrew-number parsing can read outside...

GHSA-86XP-94PG-8R6R Microsoft Security Advisory CVE-2026-92707 - ASP.NET Core Denial of Service Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.SignalR.Protocols.MessagePack; MessagePack; MessagePack.Annotations; MessagePackAnalyzer. This advisory also provides guidance on what developers can do to update...

GHSA-2FMV-RV2C-59X7 Microsoft Security Advisory CVE-2026-70162 - .NET Denial of Service Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Pkcs. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. On Windows,...

GHSA-R955-8Q5J-3H83 Microsoft Security Advisory CVE-2026-96958 - .NET and Visual Studio Denial of Service Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Xml; System.Private.Xml. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Signed XM...

GHSA-846F-F764-76MX Microsoft Security Advisory CVE-2026-84008 - .NET Denial of Service Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Pkcs. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. SignedCms.CheckSignature can...

GHSA-MC4Q-93X5-F6HJ Microsoft Security Advisory CVE-2026-58280 - .NET and Visual Studio Denial of Service Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Xml and System.Private.Xml. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Signed...

GHSA-FQPQ-CX42-9JMM Microsoft Security Advisory CVE-2026-70194 - .NET and Visual Studio Security Feature Bypass Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in System.Net.Security. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. .NET 11 post-handshake TLS client...

GHSA-494H-XX7X-5FRH Microsoft Security Advisory CVE-2026-70183 - ASP.NET Core Security Feature Bypass Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.Components.Authorization. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A stale...

GHSA-5GJQ-3F94-RCF7 Microsoft Security Advisory CVE-2026-105016 - Microsoft QUIC Remote Code Execution Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft QUIC as used by .NET 8.0, .NET 9.0, .NET 10.0, and .NET 11 RC2 on Windows. This advisory also provides guidance on what developers can do to update their applications to remov...

GHSA-W5QQ-QRPP-RF4C Microsoft Security Advisory CVE-2026-70181 - ASP.NET Core Denial of Service Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.WebUtilities. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. FileBufferingReadStream...

GHSA-X3VP-85CM-Q97R Microsoft Security Advisory CVE-2026-70175 - ASP.NET Core Elevation of Privilege Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.Identity and Microsoft.AspNetCore.Identity.UI. This advisory also provides guidance on what developers can do to update their applications to remove this...

GHSA-334F-VVP4-7G6P Microsoft Security Advisory CVE-2026-70159 - ASP.NET Core Denial of Service Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.SignalR.Common and Microsoft.AspNetCore.SignalR.Core. This advisory also provides guidance on what developers can do to update their applications to remove this...

GHSA-FMMF-XQ98-G327 Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check

Summary A project member with Write permission can delete an admin-tier link share on that project. The deletion authorization check reads the permission from an object populated only with URL IDs, rather than from the stored share. Its zero value is Read, so the check falls through to project...

GHSA-FPRF-R6RV-XG99 Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants

Summary In Vikunja v2.6.0 the task position recalculation that runs when a saved filter view is created fails open when the requesting user has no accessible projects. Instead of aborting, the search that feeds the recalculation loses its project scope entirely and returns every task in the...

GHSA-J3HG-9RP3-5HW9 Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage

Summary In Nginx UI versions 2.5.0 through 2.5.x, the node-signature authentication path staged an attacker-controlled request body in a temporary file and synchronized it to disk before validating the body digest and cryptographic signature. An unauthenticated remote client that can reach the AP...

GHSA-9H23-53F4-Q947 Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout

Summary In Nginx UI versions 2.2.0 through 2.5.x, the official bundled reverse-proxy topology did not preserve the external client identity used by Gin. The backend treated the local proxy peer as the client because no trusted proxy was configured, while the proxy supplied the actual address in...

GHSA-X34J-47HF-4XG7 TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment

Summary The TinaCMS admin builds its preview from the // hash-router splat without checking that the value stays same-origin. A fragment with a doubled slash ///attacker.example/p becomes the protocol-relative URL //attacker.example/p, so the admin frames an external site. That same unvalidated...

GHSA-8WVG-R2J4-3737 Vikunja: Assignee email addresses disclosed to read-only project members via the task assignees endpoint

Summary TaskAssginee.ReadAll returns assignee user objects without blanking the Email field, disclosing assignee email addresses to any read-only project member. Every sibling path that returns user objects obfuscates the email; this one does not. Details pkg/models/taskassignees.go lines 306-344...

GHSA-3HC7-R24J-RPWC Vikunja: Cross-project task disclosure through subtask expansion

Summary Vikunja lets a task in one project have a subtask that lives in a different project. When listing a project's tasks, an option pulls in those subtasks ?expand%5B%5D=subtasks. The main listing is correctly filtered to the projects the caller can access, but the subtask expansion is not: it...

GHSA-G38J-7V97-X298 Vikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UID

Summary Creating a task relation over CalDAV does not run the TaskRelation.CanCreate permission check that the REST API enforces. An attacker can attach a relation to any task whose UID they know, including tasks in projects they have no access to. The identical operation over REST is correctly...

GHSA-X2RP-9QF7-2FMQ Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled

ModuleSearch decides whether to filter protected pages out of search results based on the current value of contao.search.indexprotected, but the authorisation data lives per row in tlsearch. Turning the setting off removes the filter without removing the rows, so protected pages that were indexed...

GHSA-9FF2-P842-45WQ Contao: Cross-site request forgery in custom backend actions

RequestTokenListener is the only generic REQUESTTOKEN validator in Contao and it only runs on POST. On the GET side the guard is local and declarative, and it only fires when an act parameter is present. Every back end action dispatched through a different parameter therefore has no CSRF protecti...

GHSA-628F-V4F6-P37R Contao: Cross-site scripting in the comments bundle

An unauthenticated front end visitor can post a comment containing a XSS injection. The victim is any back end user who opens the Comments module, and moderation makes exposure certain rather than preventing it. No Content-Security-Policy header is sent on the Contao back end, so nothing mitigate...

GHSA-Q6WP-FR43-GM9V Contao: Improper access control in the preview links module

core-bundle/config/services.yaml registers the preview access voter with the class Contao\CoreBundle\Security\Voter\DataContainer\PreviewAccessVoter, but the class shipped on disk is named PreviewVoter. Symfony resolves the class with getReflectionClass$class, false, gets null, silently skips the...

GHSA-5974-GFQC-WRCM Contao: Improper access control in the table access voter

Due to a caching defect in the security voter that governs table-level access to Contao's Data Container DCA backend, a low-privileged, non-admin backend user can obtain unauthorized read, create, update, and delete access to database tables outside their assigned module permissions. This include...