PT-2026-104631

Name of the Vulnerable Software and Affected Versions ZITADEL versions 3.0.0 through 3.4.15 ZITADEL versions 4.0.0 through 4.17.2 Description An issue exists where links are created between user accounts and external identity providers without verifying a primary factor or the caller's permission...

CVE-2026-105206: Incorrect Authorization

ZITADEL 3.0.0 through 3.4.15 and 4.x before 4.17.3 contains an incorrect authorization flaw in the User Service API, which verifies user.read against the caller's organization rather than the organization owning the target user. An authenticated member holding org-scoped user.read can query GET...

CVE-2026-105213: Improper Authentication

ZITADEL 4.x before 4.17.1 does not check an organization's inactive state during Login V2 authentication, verifying only the individual user's status. Users of a deactivated organization who hold valid credentials, an existing session, or a refresh token can still sign in, create sessions, and...

PT-2026-104635

Name of the Vulnerable Software and Affected Versions ZITADEL versions prior to 4.17.1 Description An authentication bypass exists in Login V2 that allows unauthenticated attackers to take over accounts. Attackers who know the login name of a victim enrolled in OTP-Email and OTP-SMS can obtain...

PT-2026-104637

ZITADEL 4.x before 4.17.1 does not check an organization's inactive state during Login V2 authentication, verifying only the individual user's status. Users of a deactivated organization who hold valid credentials, an existing session, or a refresh token can still sign in, create sessions, and...

SUSE SLES15: helm / helm-bash-completion / helm-fish-completion / etc (SUSE-SU-2026:4417-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4417-1 advisory. - CVE-2026-85731: oras.land/oras-go/v2: arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction...

GO-2026-6589 ZITADEL: MFA bypass via session reuse in Login V2 in github.com/zitadel/zitadel

ZITADEL: MFA bypass via session reuse in Login V2 in github.com/zitadel/zitadel...

CVE-2026-12405

A flaw was found in rubygem-foremanremoteexecution. A command injection vulnerability exists in the Red Hat Satellite API /api/v2/jobinvocations. When a job template has the effectiveuser property marked as overridable: true, the application fails to properly sanitize the effectiveuser input...

CVE-2026-12405 Rubygem-foreman_remote_execution: command injection in job invocations via effective_user parameter

A flaw was found in rubygem-foremanremoteexecution. A command injection vulnerability exists in the Red Hat Satellite API /api/v2/jobinvocations. When a job template has the effectiveuser property marked as overridable: true, the application fails to properly sanitize the effectiveuser input...

CVE-2026-12405 Rubygem-foreman_remote_execution: command injection in job invocations via effective_user parameter

A flaw was found in rubygem-foremanremoteexecution. A command injection vulnerability exists in the Red Hat Satellite API /api/v2/jobinvocations. When a job template has the effectiveuser property marked as overridable: true, the application fails to properly sanitize the effectiveuser input...

EUVD-2026-90914

A flaw was found in rubygem-foremanremoteexecution. A command injection vulnerability exists in the Red Hat Satellite API /api/v2/jobinvocations. When a job template has the effectiveuser property marked as overridable: true, the application fails to properly sanitize the effectiveuser input...

CVE-2026-12405

A flaw was found in rubygem-foremanremoteexecution. A command injection vulnerability exists in the Red Hat Satellite API /api/v2/jobinvocations. When a job template has the effectiveuser property marked as overridable: true, the application fails to properly sanitize the effectiveuser input...

ROOT-APP-GOBINARY-CVE-2026-50151 CVE-2026-50151 in oras.land/oras-go/v2 - Patched by Root

Root has patched CVE-2026-50151 in the oras.land/oras-go/v2 package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2026-50163 CVE-2026-50163 in oras.land/oras-go/v2 - Patched by Root

Root has patched CVE-2026-50163 in the oras.land/oras-go/v2 package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2026-85731 CVE-2026-85731 in oras.land/oras-go/v2 - Patched by Root

Root has patched CVE-2026-85731 in the oras.land/oras-go/v2 package for Root:Go. Multiple fixed versions available...

Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.

Summary Maximo AI Service uses github.com/aws/aws-sdk-go-v2/service/s3 v1.96.2, github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.50.2, github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.5, tar 7.5.19, libsolv 0.7.24-5.el98, compat-openssl11 1:1.1.1k-5.el98.3, sigstore 2.3.1, and dif...

CVE-2026-85679

The Extendify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'styles.blocks' Block Type Key in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

EUVD-2026-90500

The Extendify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'styles.blocks' Block Type Key in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2026-85679 Extendify <= 3.1.6 - Unauthenticated Stored Cross-Site Scripting via 'styles.blocks' Block Type Key

The Extendify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'styles.blocks' Block Type Key in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2026-85679 Extendify <= 3.1.6 - Unauthenticated Stored Cross-Site Scripting via 'styles.blocks' Block Type Key

The Extendify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'styles.blocks' Block Type Key in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...