CVE-2026-107224 is an integer overflow vulnerability in the qax-os excelize library affecting versions from 2.1.0 through 2.11.0. It arises from improper handling of Zip64 uncompressed sizes that, when set to values with the high bit set, cast to negative int64 values. This bypasses unzip size guards and leads to a panic due to a negative capacity passed to Go's make function, causing a runtime error and crashing the calling goroutine. The vulnerability can be triggered by a crafted 159-byte archive without authentication.
CVE-2026-107223 is a high-severity vulnerability in the qax-os excelize Go library for handling Microsoft Excel spreadsheets. Versions from 2.1.0 through 2.11.0 are affected. The flaw arises because the library's flatCols function expands column ranges without validating the Min and Max column indices against the worksheet's column limit. An attacker can craft a worksheet with an excessively large column max attribute, causing the library to allocate excessive memory and CPU during column mutation operations, potentially leading to out-of-memory conditions. No official fix or patch is currently available.
CVE-2026-107222 is a medium severity vulnerability in the qax-os excelize Go library versions 2.7.0 through 2.11.0. It involves improper validation of array indexes during conditional-format extraction, which can cause out-of-range indexing or nil dereferences when processing malformed worksheet rules. This can lead to a panic that terminates an unprotected process. No fixed version is currently available.
CVE-2026-107221 is an out-of-bounds write vulnerability in the qax-os excelize library affecting versions from 2.0.0 up to and including 2.11.0. The flaw occurs in the checkRow function when processing spreadsheet rows with cells that are not sorted by column in the XML, causing an index out of range panic and process crash. This affects worksheet API calls such as GetCellValue, GetCellFormula, CalcCellValue, GetMergeCells, and SetCellValue. The vulnerability leads to an unauthenticated denial of service via a deterministic panic. A fix involves correcting the sizing of internal data structures to handle unordered cells properly.
CVE-2026-107220 is an out-of-bounds read vulnerability in the qax-os excelize Go library versions 2.7.1 through 2.11.0. The issue occurs when processing a crafted worksheet containing an empty mergeCell ref, leading to an empty cached rectangle slice being passed without length checks. This causes an out-of-bounds slice access in cellInRange, resulting in a panic during cell operations. No fix is currently available.
CVE-2026-107219 is an uncontrolled resource consumption vulnerability in the qax-os excelize library. The vulnerability arises because the library processes the spinCount parameter from an encrypted file's EncryptionInfo stream without bounds, causing excessive CPU usage during key derivation. This leads to a denial of service by making file opening operations take an excessive amount of time. The vulnerability affects versions from 2.3.1 through 2.11.0. It impacts availability only and does not affect confidentiality or integrity. Legitimate files use a much lower spinCount, so normal usage is not impacted significantly.
CVE-2026-107218 is a medium severity vulnerability in the Go library excelize (versions 2.10.1 through 2.11.0) used for reading and writing Microsoft Excel spreadsheets. The issue arises from improper validation of array indices in the RIGHT function, which inconsistently uses UTF-16 code-unit counts and Unicode code-point counts when slicing strings. This mismatch can cause a negative index panic during formula evaluation when processing supplementary-plane Unicode characters. No fix is currently available for this vulnerability.
CVE-2026-107217 is an integer overflow vulnerability in the Excelize Go library used for reading and writing Microsoft Excel spreadsheets. The function ColumnNameToNumber does not detect overflow when converting long column names to numeric indices, causing a wraparound to zero. This leads to a negative slice index during worksheet normalization, which can cause the application to panic and terminate unexpectedly. No fixed version is currently available.
CVE-2026-107211 is a high-severity vulnerability in the qax-os excelize library involving improper validation of array indices when processing pivot tables in .xlsx files. The vulnerability arises because the library indexes arrays with attacker-controlled integers from pivot table XML parts without bounds checking, leading to runtime panics (index out of range errors). This can cause the host process to crash when opening crafted malicious Excel files containing pivot tables. The issue affects versions from 2.8.1 through 2.11.0. No official patch or fix is currently documented.
Coraza WAF versions 3.0.0 through 3.8.0 have a vulnerability where the argument limit silently drops request parameters once the limit is reached, without logging or flagging the event. This allows attackers to bypass ARGS-targeted security rules by flooding requests with many parameters, causing malicious arguments to be discarded and evade detection. Additionally, the POST urlencoded body processor bypasses the argument limit entirely, creating a bypass and potential memory DoS risk. The issue is silent and non-deterministic due to Go's randomized map iteration order. A fix is available in version 3.8.1.
A vulnerability in Coraza WAF versions 3.4.0 through before 3.8.0 causes the multipart body processor to silently ignore truncated multipart request bodies due to improper handling of io.ErrUnexpectedEOF. This results in the MULTIPART_STRICT_ERROR flag not being set, preventing the critical defensive rule 200003 from firing on malformed multipart bodies. Consequently, attackers can bypass multipart parser inconsistency detection, potentially enabling evasion of backend multipart parsers and payload smuggling. The issue was introduced in version 3.4.0 and fixed in 3.8.0.
CVE-2026-41504 is a vulnerability in Coraza WAF's Native audit-log format that allows CRLF injection and log forgery via attacker-controlled request body and header fields. The Native format writes raw, unescaped input into line-based log sections, enabling attackers to inject forged log lines that appear legitimate. This compromises the integrity of individual audit records, potentially misleading human operators and automated SIEM systems. The issue affects Coraza versions from 3.0.0 up to but not including 3.8.0 and is fixed in version 3.8.0.
A vulnerability in External Secrets Operator's webhook generator allows bypassing label enforcement, enabling unauthorized secret exfiltration. The bug causes the label-enforcement flag to be cleared incorrectly, skipping a critical check that ensures secrets are properly labeled for webhook use. An attacker with permission to create webhook generators can exploit this to exfiltrate secrets not intended for webhook access. The issue affects versions from 0.10.0 up to but not including 1.3.2. A patch is available to fix this flaw. Mitigations include disabling webhook generators if unused, restricting RBAC permissions, enforcing label policies, and limiting egress network access from controller pods.
An information disclosure vulnerability in SiYuan kernel allows any authenticated user to retrieve TLS private keys via the /api/file/getFile endpoint due to an incomplete blocklist in the IsForbiddenAbsPath() function. The TLS private key (conf/key.pem) and CA private key (conf/ca.key) are not blocked and can be accessed, potentially compromising encrypted communications and certificate trust. This affects all installations including those where TLS is inactive, as the key files are generated on every boot.
A vulnerability in the SiYuan kernel allows unauthorized access to historical snapshots of sensitive files such as data/.siyuan/publishAccess.json and data/templates/* via the /history/*path and /repo/diff/*path HTTP routes. These routes do not enforce the same access restrictions as live-file endpoints, potentially exposing plaintext publish-mode passwords and template files from prior versions. The issue arises because the new centralized guard util.IsForbiddenAbsPath() is not called in these handlers, leading to missing authorization checks on historical data.
A vulnerability in gitea-runner allows workflow container options to pass dangerous Docker host namespace and capability flags to job containers even when privileged mode is disabled. This enables an attacker submitting a malicious workflow to gain root execution on the runner host by entering host PID and IPC namespaces and bypassing security restrictions. The flaw affects versions prior to 1.0.9-0.20260731160927-34bfa1915022 and is critical for shared runners and high severity for single-tenant runners with privileged mode disabled.
SiYuan Agent Tools versions up to 3.8.0 contain a Server-Side Request Forgery (SSRF) vulnerability due to a DNS rebinding time-of-check to time-of-use (TOCTOU) flaw. The vulnerability arises because the SSRF protection performs a single DNS resolution at guard time but does not verify the IP address at connection time, allowing an attacker-controlled domain to bypass the check by returning a public IP initially and a private or loopback IP on connection. This enables access to internal services such as cloud instance metadata. The issue affects the AI Agent tools' http_request and web_fetch components and was patched in version 3.8.1.
SiYuan MCP's asset.upload tool allows reading arbitrary absolute file paths without workspace boundary checks, enabling an attacker who can influence the AI Agent to upload sensitive local files into the workspace. This vulnerability affects versions up to 3.8.0 and was patched in version 3.8.1. Exploitation requires user approval of a generic confirmation prompt, making the attack vector reliant on prompt injection and user interaction. The vulnerability leads to confidentiality breaches by exposing sensitive files such as SSH keys and cloud credentials via the workspace file API.
Xray-core has a vulnerability where pinning a CA certificate using pinnedPeerCertSha256 can enable man-in-the-middle (MITM) attacks if the ServerName configuration is empty. This occurs because the TLS verification does not check the hostname against the certificate when ServerName is missing and InsecureSkipVerify is true. In some code paths, ServerName is not set when using IP addresses or certain dialers, allowing an attacker to issue a leaf certificate from the pinned CA and hijack connections.
Podman versions from 4.4.0 up to but not including 5.8.8, and from 6.0.0 up to but not including 6.1.3, contain a vulnerability where podman run treats images with the io.podman.annotations.checkpoint.runtime.name annotation as checkpoints. This causes podman to ignore user-supplied container creation restrictions such as --cap-drop=ALL, potentially allowing weaker sandbox settings and capabilities. Rootless containers are not affected. The issue is fixed in versions 5.8.8 and 6.1.3.