ZITADEL 4.x before 4.17.3 and 3.x through 3.4.15 protects IdP intent tokens with unauthenticated,...
CVE-2026-105208
ZITADEL 4.x before 4.17.3 and 3.x through 3.4.15 protects IdP intent tokens with unauthenticated, malleable encryption,
#severity:high
共收录 5417 条相关情报。
← 返回所有主题ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the...
CVE-2026-105210
ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose
ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted...
CVE-2026-105212
ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 and Login V2 UI
Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Cost Calculator...
CVE-2026-97307
Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Cost Calculator Builder cost-calculato
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')...
CVE-2026-97276
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP Stat
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')...
CVE-2026-103344
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')...
CVE-2026-103354
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / Stell
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')...
CVE-2026-103062
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs Transla
LaraDashboard before 1.4.8 contains an improper privilege management vulnerability that allows...
CVE-2026-105126
LaraDashboard before 1.4.8 contains an improper privilege management vulnerability that allows authenticated Admin users
LaraDashboard before 1.4.8 contains an incorrect authorization vulnerability that allows...
CVE-2026-105129
LaraDashboard before 1.4.8 contains an incorrect authorization vulnerability that allows authenticated users with only s
W (vincent-peugnet/wcms) through 3.18.0 contains a remote code execution vulnerability that...
CVE-2026-105123
W (vincent-peugnet/wcms) through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors
Authorization Bypass Through User-Controlled Key vulnerability in Ultimate Member Ultimate Member...
CVE-2026-96451
Authorization Bypass Through User-Controlled Key vulnerability in Ultimate Member Ultimate Member ultimate-member allows
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')...
CVE-2026-103342
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements
Improper Validation of Specified Quantity in Input vulnerability in Themeum Kirki kirki allows...
CVE-2026-103065
Improper Validation of Specified Quantity in Input vulnerability in Themeum Kirki kirki allows Accessing Functionality N
OpenAM before 16.1.3 applies its OAuth2 Provider PKCE enforcement only to authorization requests...
CVE-2026-105119
OpenAM before 16.1.3 applies its OAuth2 Provider PKCE enforcement only to authorization requests whose response_type is
OpenAM before 16.1.3 contains an unauthenticated arbitrary class instantiation vulnerability in...
CVE-2026-105115
OpenAM before 16.1.3 contains an unauthenticated arbitrary class instantiation vulnerability in the legacy JAX-RPC SOAP
Nezha Dashboard from 1.8.0 before 2.3.13 contains an improper locking vulnerability where a non...
CVE-2026-105113
Nezha Dashboard from 1.8.0 before 2.3.13 contains an improper locking vulnerability where a non-deferred mutex unlock le
In Bouncy Castle for Java before 1.86, BLS12_381BasicScheme.keyValidate, and so...
CVE-2026-71891
In Bouncy Castle for Java before 1.86, BLS12_381BasicScheme.keyValidate, and so BLSPublicKeyParameters and every BasicSc
In Bouncy Castle for Java before 1.86, the high-level OpenPGP API accepted a data signature made...
CVE-2026-71887
In Bouncy Castle for Java before 1.86, the high-level OpenPGP API accepted a data signature made by a signing subkey who
In Bouncy Castle for Java before 1.86, the high-level OpenPGP certificate API accepted a third...
CVE-2026-71886
In Bouncy Castle for Java before 1.86, the high-level OpenPGP certificate API accepted a third-party certification or tr