ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted...
CVE-2026-105212
ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 and Login V2 UI
#advisory
共收录 23210 条相关情报。
← 返回所有主题A weakness has been identified in YzmCMS up to 7.6. Impacted is the function Password of the file...
CVE-2026-105156
A weakness has been identified in YzmCMS up to 7.6. Impacted is the function Password of the file /common/function/syste
SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish-mode...
CVE-2026-105205
SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish-mode readers to learn backlink
A security vulnerability has been detected in RainyGao DocSys up to 2.02.85. The affected element...
CVE-2026-105157
A security vulnerability has been detected in RainyGao DocSys up to 2.02.85. The affected element is the function DocCon
A vulnerability was detected in RainyGao DocSys up to 2.02.85. The impacted element is the...
CVE-2026-105158
A vulnerability was detected in RainyGao DocSys up to 2.02.85. The impacted element is the function BaseController.creat
A security flaw has been discovered in mooSocial up to 3.2.4. This issue affects some unknown...
CVE-2026-105149
A security flaw has been discovered in mooSocial up to 3.2.4. This issue affects some unknown processing of the file /st
A vulnerability was determined in SciPhi-AI R2R up to 3.6.6. This affects an unknown part of the...
CVE-2026-105147
A vulnerability was determined in SciPhi-AI R2R up to 3.6.6. This affects an unknown part of the component JWT Secret Ha
A vulnerability was identified in SciPhi-AI R2R up to 3.6.6. This vulnerability affects unknown...
CVE-2026-105148
A vulnerability was identified in SciPhi-AI R2R up to 3.6.6. This vulnerability affects unknown code of the file py/shar
WWBN AVideo 12.4 through 29.2.0 Stored XSS via Double-Encoded Video Title
CVE-2026-105086
WWBN AVideo 12.4 through 29.2.0 contains a stored cross-site scripting vulnerability that allows authenticated uploaders
YesWiki before 4.6.7 Stored XSS via Bazar valeur Action
CVE-2026-104470 · CVE-2026-105224
YesWiki before 4.6.7 contains a cross-site scripting vulnerability in the Bazar valeur action that allows page editors t
WWBN AVideo through 29.2.0 Stored XSS via trailer1 in YouPHPFlix2 Templates
CVE-2026-105089
WWBN AVideo through 29.2.0 contains a stored cross-site scripting vulnerability that allows users with upload permission
ZITADEL before 4.16.2 Account Pre-Hijacking via Forged External IdP Callback
CVE-2026-105215
ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 UI because the 'ext
Zitadel before 4.16.2 SSRF via Organization Domain HTTP Verification
CVE-2026-105214
Zitadel before 4.16.2 contains a server-side request forgery vulnerability that allows attackers to make the server requ
ZITADEL before 4.17.1 Authentication Bypass via Login V2 for Deactivated Organizations
CVE-2026-105213
ZITADEL 4.x before 4.17.1 does not check an organization's inactive state during Login V2 authentication, verifying only
ZITADEL before 3.4.14 and 4.16.2 Account Takeover via Passkey Enrollment
CVE-2026-105212
ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 and Login V2 UI
ZITADEL before 4.17.1 Authentication Bypass via Login V2 OTP returnCode
CVE-2026-105211
ZITADEL before 4.17.1 contains an authentication bypass vulnerability in Login V2 that allows unauthenticated attackers
ZITADEL before 4.17.1 Unauthenticated MFA Enrollment via Login V1 Init Handlers
CVE-2026-105210
ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose
ZITADEL before 3.4.15 and 4.17.1 Cross-Organization Account Takeover via Passkey Enrollment
CVE-2026-105209
ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnerability: when issuing passkey o
ZITADEL before 4.17.3 Session Hijacking via Forgeable IdP Intent Tokens
CVE-2026-105208
ZITADEL 4.x before 4.17.3 and 3.x through 3.4.15 protects IdP intent tokens with unauthenticated, malleable encryption,
ZITADEL before 4.17.3 Account Takeover via External IdP Linking
CVE-2026-105207
ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user accounts and external identity providers