Sun, Oct 04 · 03:16 PM CDTCVE-2026-105207
9.8/10 · Must read/watchNVDvuln
Summary
ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user accounts and external identity providers without verifying a primary factor or the caller's permission, including on identify-only Login V2 sessions and via the User Service V2 AddIDPLink endpoint. An unauthenticated attacker knowing a vict
CVECVE-2026-105207
SeverityCRITICAL
TypeNEW
PublishedSun, Oct 04 · 03:16 PM CDT
ModifiedSun, Oct 04 · 03:16 PM CDT
CVE-2026-105209
9.6/10 · Must read/watchNVDvuln
Summary
ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnerability: when issuing passkey or passwordless enrollment codes, it checks only the organization in the x-zitadel-orgid header, not the target user's organization. Attackers with user-write permission in one organization can obtain
CVECVE-2026-105209
SeverityCRITICAL
TypeNEW
PublishedSun, Oct 04 · 03:16 PM CDT
ModifiedSun, Oct 04 · 03:16 PM CDT
CVE-2026-105215
9.1/10 · Must read/watchNVDvuln
Summary
ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 UI because the 'external account not found' registration endpoint trusts client-supplied external identity fields without a completed IdP callback. Unauthenticated attackers can submit forged IDPConfigID and ExternalUse
CVECVE-2026-105215
SeverityCRITICAL
TypeNEW
PublishedSun, Oct 04 · 03:16 PM CDT
ModifiedSun, Oct 04 · 03:16 PM CDT
CVE-2026-105086
8.7/10 · Worth your timeNVDvuln
Summary
WWBN AVideo 12.4 through 29.2.0 contains a stored cross-site scripting vulnerability that allows authenticated uploaders to inject HTML by submitting doubly-encoded entities in video titles. Because safeString() strips tags before decoding entities and runs twice via setTitle() and save(), attackers can store markup th
CVECVE-2026-105086
SeverityHIGH
TypeNEW
PublishedSun, Oct 04 · 04:16 PM CDT
ModifiedSun, Oct 04 · 04:16 PM CDT
CVE-2026-105089
8.7/10 · Worth your timeNVDvuln
Summary
WWBN AVideo through 29.2.0 contains a stored cross-site scripting vulnerability that allows users with upload permission to inject script by setting a malicious video trailer1 URL. The value is rendered unescaped in YouPHPFlix2 templates and channel playlists, letting attackers break out of onclick strings or iframe sr
CVECVE-2026-105089
SeverityHIGH
TypeNEW
PublishedSun, Oct 04 · 04:16 PM CDT
ModifiedSun, Oct 04 · 04:16 PM CDT
CVE-2026-105210
8.2/10 · Worth your timeNVDvuln
Summary
ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose second-factor enrollment and initialization handlers act on an identify-only session before any primary factor is verified. Attackers knowing only a victim's login name can enroll attacker-controlled
CVECVE-2026-105210
SeverityHIGH
TypeNEW
PublishedSun, Oct 04 · 03:16 PM CDT
ModifiedSun, Oct 04 · 03:16 PM CDT
CVE-2026-105213
8.2/10 · Worth your timeNVDvuln
Summary
ZITADEL 4.x before 4.17.1 does not check an organization's inactive state during Login V2 authentication, verifying only the individual user's status. Users of a deactivated organization who hold valid credentials, an existing session, or a refresh token can still sign in, create sessions, and obtain or refresh tokens.
CVECVE-2026-105213
SeverityHIGH
TypeNEW
PublishedSun, Oct 04 · 03:16 PM CDT
ModifiedSun, Oct 04 · 03:16 PM CDT
CVE-2026-104988
8.1/10 · Worth your timeNVDvuln
Summary
A flaw was found in Dogtag PKI (pki-core). The CMCAuthForEST authentication plugin fails open when an EST fullcmc enrollment request is submitted via BasicAuth without an end-user TLS client certificate. The SSL_CLIENT_CERT session attribute retains the EST subsystem's agent certificate, which causes downstream authori
CVECVE-2026-104988
SeverityHIGH
TypeUPDATED
PublishedFri, Oct 02 · 08:17 PM CDT
ModifiedMon, Oct 05 · 09:17 AM CDT
CVE-2026-105211
8.1/10 · Worth your timeNVDvuln
Summary
ZITADEL before 4.17.1 contains an authentication bypass vulnerability in Login V2 that allows unauthenticated attackers to take over accounts by obtaining OTP codes via the returnCode delivery type. Attackers knowing a login name of a victim with OTP-Email and OTP-SMS enrolled can read both codes from server-action res
CVECVE-2026-105211
SeverityHIGH
TypeNEW
PublishedSun, Oct 04 · 03:16 PM CDT
ModifiedSun, Oct 04 · 03:16 PM CDT
CVE-2026-105293
8.1/10 · Worth your timeNVDvuln
Summary
Legcord 1.1.0 through 1.3.0 contains a path traversal vulnerability in theme IPC handlers that allows script in the Discord page to escape the themes directory via unvalidated theme ids. Attackers running script in the Discord origin, such as through XSS, can abuse themes.folder, themes.uninstall, and themes.install to
CVECVE-2026-105293
SeverityHIGH
TypeNEW
PublishedMon, Oct 05 · 01:16 AM CDT
ModifiedMon, Oct 05 · 01:16 AM CDT
CVE-2026-105220
7.8/10 · Worth your timeNVDvuln
Summary
Twine 2 desktop through 2.12.0 contains a cross-site scripting vulnerability in importStories() that executes markup from imported story files in the editor window. Attackers can craft a story file whose script calls the twineElectron openWithScratchFile IPC bridge to write and open a .bat file, executing code as the u
CVECVE-2026-105220
SeverityHIGH
TypeNEW
PublishedSun, Oct 04 · 11:16 PM CDT
ModifiedSun, Oct 04 · 11:16 PM CDT
CVE-2026-18917
7.8/10 · Worth your timeNVDvuln
Summary
A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an undersized memory buffer. Subsequently, real NUMA node data can overwrite this buffer. This heap buffer overf
CVECVE-2026-18917
SeverityHIGH
TypeUPDATED
PublishedThu, Aug 20 · 10:16 AM CDT
ModifiedMon, Oct 05 · 09:17 AM CDT
CVE-2026-63622
7.8/10 · Worth your timeNVDvuln
Summary
A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploit a symlink-following vulnerability in the `virFileChownFiles()` function. By planting a symbolic link within the `swtpm` state directory, the attacker could trick the root-level libvirt daemon into c
CVECVE-2026-63622
SeverityHIGH
TypeUPDATED
PublishedMon, Aug 10 · 09:17 PM CDT
ModifiedMon, Oct 05 · 09:17 AM CDT
CVE-2026-89793
7.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: ublk: clear VM_MAYWRITE on read-only ublk char device mmap ublk_ch_mmap() rejects mmap requests with VM_WRITE set, but never clears VM_MAYWRITE on the resulting read-only mapping. This allows a userspace daemon to mmap the per-queue command buffer PROT
CVECVE-2026-89793
SeverityHIGH
TypeUPDATED
PublishedWed, Sep 16 · 10:16 AM CDT
ModifiedMon, Oct 05 · 06:16 AM CDT
CVE-2026-96512
7.8/10 · Worth your timeNVDvuln
Summary
A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Because sudo is a setuid-root program, an unprivileged local use
CVECVE-2026-96512
SeverityHIGH
TypeUPDATED
PublishedWed, Sep 23 · 02:17 PM CDT
ModifiedMon, Oct 05 · 06:16 AM CDT
CVE-2026-105208
7.7/10 · Worth your timeNVDvuln
Summary
ZITADEL 4.x before 4.17.3 and 3.x through 3.4.15 protects IdP intent tokens with unauthenticated, malleable encryption, allowing authenticated users to tamper with their own token so it is accepted for another user's external login intent. An attacker who predicts a victim's in-flight intent identifier and wins a timin
CVECVE-2026-105208
SeverityHIGH
TypeNEW
PublishedSun, Oct 04 · 03:16 PM CDT
ModifiedSun, Oct 04 · 03:16 PM CDT
CVE-2026-105212
7.5/10 · Worth your timeNVDvuln
Summary
ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 and Login V2 UIs that accepts passkey or other authenticator enrollment on identify-only login sessions, before any primary factor is verified. Unauthenticated attackers knowing only a victim's login name can regist
CVECVE-2026-105212
SeverityHIGH
TypeNEW
PublishedSun, Oct 04 · 03:16 PM CDT
ModifiedSun, Oct 04 · 03:16 PM CDT
CVE-2026-105219
7.5/10 · Worth your timeNVDvuln
Summary
Mammoth.js 1.3.0 before 1.12.3 contains a regular expression denial of service vulnerability in the style map tokeniser in lib/styles/parser/tokeniser.js due to overlapping regex alternatives. Attackers can supply a crafted .docx with an unterminated quoted string of repeated backslash escapes in mammoth/style-map to b
CVECVE-2026-105219
SeverityHIGH
TypeNEW
PublishedSun, Oct 04 · 06:16 PM CDT
ModifiedSun, Oct 04 · 06:16 PM CDT
CVE-2026-105295
7.5/10 · Worth your timeNVDvuln
Summary
GitAhead 2.5.0 through 2.7.1 contains an insecure update mechanism that installs downloaded updates without integrity or signature verification and permanently ignores TLS errors after one SSL error dialog. Network attackers presenting an invalid certificate once can intercept later automatic update checks, offer a fak
CVECVE-2026-105295
SeverityHIGH
TypeNEW
PublishedMon, Oct 05 · 01:16 AM CDT
ModifiedMon, Oct 05 · 01:16 AM CDT
CVE-2026-97307
7.5/10 · Worth your timeNVDvuln
Summary
Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Cost Calculator Builder cost-calculator-builder allows Retrieve Embedded Sensitive Data.This issue affects Cost Calculator Builder: from n/a through 4.0.17.
CVECVE-2026-97307
SeverityHIGH
TypeNEW
PublishedSun, Oct 04 · 11:16 AM CDT
ModifiedSun, Oct 04 · 11:16 AM CDT
CVE-2026-105216
7.4/10 · Worth your timeNVDvuln
Summary
go-micro before 6.0.0 contains an improper certificate validation vulnerability that allows network attackers to impersonate services because the shared TLS helper sets InsecureSkipVerify to true by default. Man-in-the-middle attackers can present any certificate to intercept or modify gRPC transport, HTTP and RabbitMQ
CVECVE-2026-105216
SeverityHIGH
TypeNEW
PublishedSun, Oct 04 · 06:16 PM CDT
ModifiedSun, Oct 04 · 06:16 PM CDT
CVE-2026-105218
7.4/10 · Worth your timeNVDvuln
Summary
gopay before 1.5.119 disables TLS certificate verification in defaultClient() in pkg/xhttp/client.go, allowing man-in-the-middle attackers to impersonate payment provider APIs. Attackers can present any certificate to read merchant credentials, signatures and transaction data, and modify payment, refund and order query
CVECVE-2026-105218
SeverityHIGH
TypeNEW
PublishedSun, Oct 04 · 06:16 PM CDT
ModifiedSun, Oct 04 · 06:16 PM CDT
CVE-2026-105221
7.4/10 · Worth your timeNVDvuln
Summary
The gist RubyGem before 6.1.0 contains an improper certificate validation vulnerability that allows on-path attackers to intercept HTTPS traffic because http_connection in lib/gist.rb sets VERIFY_NONE. Attackers can present any certificate to read or modify GitHub API traffic, stealing OAuth tokens and login credential
CVECVE-2026-105221
SeverityHIGH
TypeNEW
PublishedSun, Oct 04 · 11:16 PM CDT
ModifiedSun, Oct 04 · 11:16 PM CDT
CVE-2026-105222
7.4/10 · Worth your timeNVDvuln
Summary
The alexpechkarev/google-maps Laravel package through 12.16 disables TLS certificate verification by default because the bundled config sets ssl_verify_peer to FALSE, which is passed to CURLOPT_SSL_VERIFYPEER. On-path attackers can present any certificate to intercept Google Maps web-service requests, steal the API key
CVECVE-2026-105222
SeverityHIGH
TypeNEW
PublishedSun, Oct 04 · 11:16 PM CDT
ModifiedSun, Oct 04 · 11:16 PM CDT
CVE-2026-105223
7.4/10 · Worth your timeNVDvuln
Summary
maclof kubernetes-client 0.17.0 before 0.32.0 disables TLS certificate verification in parseKubeconfig() and parseKubeconfigFile() when a kubeconfig lacks certificate-authority-data, ignoring insecure-skip-tls-verify. On-path attackers can impersonate the Kubernetes API server to capture Bearer tokens or Basic credenti
CVECVE-2026-105223
SeverityHIGH
TypeNEW
PublishedMon, Oct 05 · 01:16 AM CDT
ModifiedMon, Oct 05 · 01:16 AM CDT
