CVE-2026-77564 is a low-severity vulnerability in Talos Linux where sensitive authentication information is stored in cleartext within support bundles generated by talosctl. This affects versions prior to 1.12.9 and between 1.13.0 and before 1.13.3. Improper sharing of these support bundles could lead to unintended disclosure of private registry credentials. Versions 1.12.9 and 1.13.3 and later redact sensitive data, and Talos 1.14 and later additionally encrypt support bundles by default to reduce exposure risk.
A race condition vulnerability in Nezha Monitoring versions 2.2.7 through 2.2.10 allows a RoleMember to cause a nil pointer dereference in the ServiceSentinel worker. This leads to a panic that terminates the dashboard process, disrupting the web interface, REST API, and agent connections for all tenants. The issue affects availability only and does not expose or modify data. Fixed in version 2.2.11 and later.
Vitess contains a reflected cross-site scripting (XSS) vulnerability in the twopczHandler of the vttablet component. The vulnerability arises because the Action and dtid form values are reflected into the HTML response without proper HTML escaping. This flaw allows an attacker to craft URLs that execute JavaScript in the operator's browser with same-origin access to sensitive debug endpoints. The issue affects all released versions up to the current latest releases and was fixed only on the main development branch as of June 2026. No official CVE or advisory existed at the time of reporting.
CVE-2026-77459 is a critical authorization vulnerability in Argo CD affecting versions from 2.10.0 onward. It allows users with write access to Git repositories backing Applications to create PreDelete and PostDelete hooks that bypass AppProject authorization checks. These hooks run with the application-controller's credentials on the destination cluster during Application deletion, potentially enabling unauthorized creation of cluster-scoped or namespace-scoped resources. The vulnerability is patched in Argo CD versions 3.3.15 and later, including 3.4.10, 3.5.4, and 3.6.0-rc2. Versions 2.x and 3.0 through 3.2 are out of support and will not receive patches. Mitigations include restricting write access to Git repositories, limiting who can delete Applications, and tightening the application-controller's Kubernetes permissions.
CVE-2026-82416 is a race condition vulnerability in FrankenPHP when running in worker mode with PHP's session extension loaded as a shared module rather than statically linked. This causes session IDs to leak between concurrent requests, leading to cross-user session exposure and session hijacking. The issue arises because session state reset code is compiled out when the session extension is shared, allowing stale session IDs to persist across requests. Builds with the session extension statically linked are not affected. The vulnerability results in users being intermittently logged out or served sessions belonging to other users.
CVE-2026-103028 is an authorization vulnerability in drakkan sftpgo versions 2.5.0 up to but not including 2.7.6. It allows an authenticated user with copy permissions to bypass file pattern filters that are intended to restrict access to certain files. By copying files denied by filters to permitted names or locations, the user can read contents of files that should be inaccessible according to the configured filters. Other access controls such as home directory restrictions, virtual folder layouts, and per-directory permissions remain enforced. There is no administrative privilege escalation or cross-account access.
### Summary
A flaw in the SSH service allows an authenticated client to crash the server by sending a malformed protocol message while opening a channel.
### Impact
Any user able to authenticate over SSH can trigger an unhandled error condition that aborts the server process. This results in a denial of service affecting all connected users until the service is restarted. No confidentiality or integrity impact has been identified; the issue is limited to availability.
Gotify server versions prior to 3.0.0 have a vulnerability in the password change endpoint that allows an attacker with a valid client token to change a user's password without knowing the current password. This flaw requires administrator intervention or direct database access to recover the account. The issue is fixed in Gotify 3.0.0, which requires re-authentication with the current password to change it.
CVE-2026-84312 is an improper authentication vulnerability in the Casdoor SSO flow of 0xJacky nginx-ui. The OAuth state parameter is hard-coded and not validated against a per-session value, enabling login CSRF attacks. An attacker can force a victim's browser to authenticate as the attacker, potentially leading to unauthorized access and data exfiltration. The vulnerability affects versions prior to 2.4.1. A patch is available that implements proper state parameter generation and validation similar to the OIDC flow.
CVE-2026-84360 is an authentication bypass vulnerability in 0xJacky's nginx-ui product that allows OTP-enabled users to bypass the intended secure session requirement for high-impact Nginx configuration changes. The vulnerability arises because the MCP endpoints, which allow configuration mutations, require only ordinary authentication rather than the stricter secure session. This enables an attacker with valid JWT authentication but without a secure session to modify Nginx configuration via the /mcp and /mcp_message endpoints. The issue was verified with a proof-of-concept demonstrating successful configuration changes without step-up authentication.
CVE-2026-84316 is an improper input validation vulnerability in 0xJacky's nginx-ui that allows authenticated users to bypass directive validation by placing blocked directives after a semicolon on the same line. This bypass affects all guarded write paths that call the validator, enabling injection of dangerous nginx directives such as js_import, load_module, and user root. On deployments with njs or perl modules enabled, this leads to code execution in the nginx worker process, potentially as root. The vulnerability requires authentication via node secret or user JWT and has been demonstrated on version 2.3.11 of the official Docker image. The issue stems from the validator splitting config content by newlines and only inspecting the first token per line, while nginx parses multiple directives separated by semicolons on the same line.
CVE-2026-84319 is a vulnerability in 0xJacky's nginx-ui that allows a secondary authenticated user to bypass restricted directive validation in the MCP configuration interface. While the HTTP API blocks restricted Nginx directives such as load_module, js_import, and js_content, the MCP interface permits writing and applying equivalent restricted configurations. This enables execution of attacker-controlled NJS scripts within the Nginx worker context, potentially modifying runtime behavior including responses and routing. The vulnerability affects versions prior to 2.4.1. The CVSS score is 8.3 (high severity).
CVE-2026-84317 is an improper input validation vulnerability in the 0xJacky nginx-ui product. The vulnerability arises because the MCP tool 'nginx_config_add' does not enforce validation on user-supplied nginx configuration content, unlike other config-write paths. This allows an authenticated user to inject dangerous nginx directives such as 'js_*', 'perl_*', 'load_module', and 'user root', potentially leading to nginx code execution with root privileges if the njs/perl modules are available. The issue is due to an incomplete hardening patch that missed adding validation to the 'nginx_config_add' path. A proof of concept demonstrates remote code execution via JavaScript in the nginx worker running as root. The vulnerability affects versions prior to 2.4.1 and has a CVSS 3.1 score of 8.8 (high severity).
0xJacky nginx-ui versions prior to 2.4.1 contain an improper authentication vulnerability (CWE-287) in the two-factor authentication enrollment endpoints. The endpoints for enrolling TOTP and WebAuthn passkeys require only a valid JWT and are not protected by a secure session middleware, allowing an attacker with a stolen JWT to bind their own second factor to a victim's account without re-authentication. This enables persistent account takeover that survives password resets and locks out legitimate users.
CVE-2026-84321 is a medium severity vulnerability in 0xJacky's nginx-ui prior to version 2.4.1 involving insufficient session expiration. Standalone short tokens used for WebSocket and explicit-token authentication remain valid in cache even after administrative revocation. If the associated user account is re-enabled before the cache entry expires, the stale short token can be reused to authenticate successfully.
CVE-2026-84314 is an improper authorization vulnerability in 0xJacky's nginx-ui that allows any authenticated user to change any other user's password without requiring two-factor authentication (2FA). The vulnerable endpoint POST /api/users/:id lacks the RequireSecureSession middleware, unlike other sensitive operations that enforce 2FA. This flaw enables an attacker to take over the initial admin account by changing its password, effectively locking out the legitimate admin user.
CVE-2026-84320 is a path traversal vulnerability in 0xJacky's nginx-ui affecting versions prior to 2.4.3. The issue arises because the auto-backup filename is constructed from a user-controlled name without sanitizing path separators or '..' components, allowing an authenticated user to escape the intended backup storage directory. This bypasses the administrator-defined backup path boundary, potentially enabling backup archives and sensitive encrypted key files to be written outside authorized directories with the privileges of the nginx-ui process.
CVE-2026-84318 is a vulnerability in 0xJacky's nginx-ui where the MCP tool 'nginx_config_add' writes nginx configuration files without validating them, unlike the REST API which blocks dangerous directives. This allows an authenticated attacker to bypass security checks and write config files with blocked directives such as 'perl' or 'user root', leading to remote code execution on servers with certain nginx modules loaded. The vulnerability affects versions from 2.0.0-rc.6 up to but not including 2.4.1.
CVE-2026-84315 is a missing authorization vulnerability in 0xJacky's nginx-ui version prior to 2.4.1. The application uses a short-lived OTP/passkey "secure session" token to enforce step-up authorization for sensitive operations for users with 2FA enabled. However, several sensitive authenticated mutation routes are not protected by this step-up middleware, allowing an attacker with a valid authenticated JWT/session but without a fresh OTP secure-session token to perform unauthorized sensitive actions.
Vikunja's API has a permissive Cross-Origin Resource Sharing (CORS) policy that trusts all localhost origins by default, combined with sending Access-Control-Allow-Credentials: true. This allows any page served from localhost on any port to make credentialed cross-origin requests and read responses, including the token refresh endpoint that returns a bearer token in the response body. This token grants full API access for the logged-in user. The default configuration appends localhost origins to the allowed list rather than replacing them, causing production deployments to inadvertently trust all localhost origins. An attacker controlling a page on localhost can exploit this to obtain a valid access token without user interaction.