gopay before 1.5.119 disables TLS certificate verification in defaultClient() in pkg/xhttp/client...
CVE-2026-105218
gopay before 1.5.119 disables TLS certificate verification in defaultClient() in pkg/xhttp/client.go, allowing man-in-th
#advisory
共收录 23210 条相关情报。
← 返回所有主题A flaw has been found in invariant-systems-ai aiir up to 1.7.0. The affected element is an...
CVE-2026-105161
A flaw has been found in invariant-systems-ai aiir up to 1.7.0. The affected element is an unknown function of the compo
Cockpit CMS 2.12.0 before 2.14.1 disables TLS certificate verification in the cron.php web worker...
CVE-2026-105217
Cockpit CMS 2.12.0 before 2.14.1 disables TLS certificate verification in the cron.php web worker restart request, allow
WWBN AVideo through 29.2.0 contains a stored cross-site scripting vulnerability that allows users...
CVE-2026-105089
WWBN AVideo through 29.2.0 contains a stored cross-site scripting vulnerability that allows users with upload permission
YesWiki before 4.6.7 contains a cross-site scripting vulnerability in the Bazar valeur action...
CVE-2026-105224
YesWiki before 4.6.7 contains a cross-site scripting vulnerability in the Bazar valeur action that allows page editors t
Insertion of Sensitive Information Into Sent Data vulnerability in farvisun Mindio Magic MCP...
CVE-2026-104402
Insertion of Sensitive Information Into Sent Data vulnerability in farvisun Mindio Magic MCP mindio-magic-mcp allows Ret
WWBN AVideo 12.4 through 29.2.0 contains a stored cross-site scripting vulnerability that allows...
CVE-2026-105086
WWBN AVideo 12.4 through 29.2.0 contains a stored cross-site scripting vulnerability that allows authenticated uploaders
Mammoth.js 1.3.0 before 1.12.3 ReDoS via Style Map Tokeniser
CVE-2026-105219
Mammoth.js 1.3.0 before 1.12.3 contains a regular expression denial of service vulnerability in the style map tokeniser
gopay before 1.5.119 Disabled TLS Certificate Verification in xhttp Client
CVE-2026-105218
gopay before 1.5.119 disables TLS certificate verification in defaultClient() in pkg/xhttp/client.go, allowing man-in-th
Cockpit CMS 2.12.0 before 2.14.1 Disabled TLS Verification via cron.php
CVE-2026-105217
Cockpit CMS 2.12.0 before 2.14.1 disables TLS certificate verification in the cron.php web worker restart request, allow
go-micro before 6.0.0 Disabled TLS Certificate Verification via tls.Config Helper
CVE-2026-105216
go-micro before 6.0.0 contains an improper certificate validation vulnerability that allows network attackers to imperso
ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login...
CVE-2026-105215
ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 UI because the 'ext
ZITADEL 4.x before 4.17.1 does not check an organization's inactive state during Login V2...
CVE-2026-105213
ZITADEL 4.x before 4.17.1 does not check an organization's inactive state during Login V2 authentication, verifying only
ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user accounts and...
CVE-2026-105207
ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user accounts and external identity providers
ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnerability:...
CVE-2026-105209
ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnerability: when issuing passkey o
Zitadel before 4.16.2 contains a server-side request forgery vulnerability that allows attackers...
CVE-2026-105214
Zitadel before 4.16.2 contains a server-side request forgery vulnerability that allows attackers to make the server requ
ZITADEL 4.x before 4.17.3 and 3.x through 3.4.15 protects IdP intent tokens with unauthenticated,...
CVE-2026-105208
ZITADEL 4.x before 4.17.3 and 3.x through 3.4.15 protects IdP intent tokens with unauthenticated, malleable encryption,
ZITADEL 3.0.0 through 3.4.15 and 4.x before 4.17.3 contains an incorrect authorization flaw in...
CVE-2026-105206
ZITADEL 3.0.0 through 3.4.15 and 4.x before 4.17.3 contains an incorrect authorization flaw in the User Service API, whi
ZITADEL before 4.17.1 contains an authentication bypass vulnerability in Login V2 that allows...
CVE-2026-105211
ZITADEL before 4.17.1 contains an authentication bypass vulnerability in Login V2 that allows unauthenticated attackers
ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the...
CVE-2026-105210
ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose