ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user accounts and...
CVE-2026-105207
ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user accounts and external identity providers
#severity:critical
共收录 1449 条相关情报。
← 返回所有主题ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnerability:...
CVE-2026-105209
ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnerability: when issuing passkey o
ZITADEL before 4.17.1 contains an authentication bypass vulnerability in Login V2 that allows...
CVE-2026-105211
ZITADEL before 4.17.1 contains an authentication bypass vulnerability in Login V2 that allows unauthenticated attackers
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')...
CVE-2026-103355
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Unlimited Elements
CWE-306: Missing Authentication for Critical Function in the ait.core.server telemetry and...
CVE-2026-105105
CWE-306: Missing Authentication for Critical Function in the ait.core.server telemetry and command broker (ait-server) i
The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is...
CVE-2026-92084
The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shor
In Bouncy Castle for Java before 1.86, the Messaging Layer Security (MLS, RFC 9420)...
CVE-2026-71885
In Bouncy Castle for Java before 1.86, the Messaging Layer Security (MLS, RFC 9420) implementation did not bind an X.509
The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to arbitrary...
CVE-2026-87115
The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to arbitrary file deletion due to insuf
In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes...
CVE-2026-105080
In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes them to the ebook-conve
The web management service in affected RouterOS versions contains an integer underflow in its...
CVE-2026-84411
The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling
WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate...
CVE-2026-95102
WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate charging stations. As a res
gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled
CVE-2026-73802
### Summary act_runner appends workflow-controlled `jobs..container.options` directly to the Docker HostConfig for the
@a2ui/web_core: `openUrl` permits `javascript:` URI execution via agent-supplied button actions
CVE-2026-10032
### Summary The `openUrl` function in `@a2ui/web_core` passes an agent-controlled URL directly to `window.open()` witho
Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chain
### Summary: 5 findings — unauthenticated full-API exposure (F1, lead Critical), read-side authorization gap that persi
Vibe-Trading LLM-callable tools permit command execution, code injection, and SSRF
### Summary: 5 findings — `BashTool` shell-injection sink (F6, the canonical RCE primitive), `BackgroundRunTool` async
Trigger.dev: V1 coordinator default-secret unauth Socket.IO
## TL;DR The /coordinator Socket.IO namespace mounts on every webapp boot and authenticates with a default secret ("coo
UTMStack before 11.2.16 contains an authentication bypass vulnerability that allows remote...
CVE-2026-82042
UTMStack before 11.2.16 contains an authentication bypass vulnerability that allows remote attackers to gain full admini
A specially crafted HTTP POST request to the web administration interface allows an...
CVE-2026-75937
A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute
H3C CVM, the Cloud Virtualization Management component of the H3C CAS cloud platform, contains an...
CVE-2023-54405
H3C CVM, the Cloud Virtualization Management component of the H3C CAS cloud platform, contains an unauthenticated arbitr
Discord libdave before 1.2.0 did not reject an MLS Welcome message when the resulting group...
CVE-2026-104480
Discord libdave before 1.2.0 did not reject an MLS Welcome message when the resulting group roster contained an unrecogn