2632 matches found
EUVD-2026-102130
An issue in Justson agentweb-core v5.1.6-androidx and earlier allows a local attacker to obtain sensitive information and launch non-exported host application components via incorrect access control in the handling of intent:// URLS in DefaultWebClient...
CVE-2026-95180
An issue in Justson agentweb-core versions v5.1.6-androidx and earlier allows a local attacker to obtain sensitive information and launch non-exported host application components . This is caused by incorrect access control during the handling of intent:// URLs within the DefaultWebClient compone...
CVE-2026-109372
ZITADEL 4.x before 4.19.2 and 3.x through 3.4.15 contains an authentication bypass in the SAML identity-provider intent callback, which verifies the assertion signature using the provider named in the request URL but resolves the user from the login intent without checking they match. Attackers...
CVE-2026-109372 ZITADEL 3.0.0 before 4.19.2 Account Takeover via SAML Identity-Provider Confusion
ZITADEL 4.x before 4.19.2 and 3.x through 3.4.15 contains an authentication bypass in the SAML identity-provider intent callback, which verifies the assertion signature using the provider named in the request URL but resolves the user from the login intent without checking they match. Attackers...
EUVD-2026-97670
ZITADEL 4.x before 4.19.2 and 3.x through 3.4.15 contains an authentication bypass in the SAML identity-provider intent callback, which verifies the assertion signature using the provider named in the request URL but resolves the user from the login intent without checking they match. Attackers...
CVE-2026-109372
The ZITADEL identity platform (versions 4.x before 4.19.2 and 3.x through 3.4.15 ) is vulnerable to an authentication bypass in the SAML identity-provider intent callback. The root cause is a failure to verify that the provider name in the request URL matches the provider used to resolve the user...
PT-2026-110785
Name of the Vulnerable Software and Affected Versions ZITADEL versions 4.x through 4.19.1 ZITADEL versions 3.x through 3.4.15 Description An authentication bypass exists in the SAML identity-provider intent callback. The system verifies the assertion signature using the provider specified in the...
CVE-2026-109372: Improper Authentication
ZITADEL 4.x before 4.19.2 and 3.x through 3.4.15 contains an authentication bypass in the SAML identity-provider intent callback, which verifies the assertion signature using the provider named in the request URL but resolves the user from the login intent without checking they match. Attackers...
CVE-2026-104724
The FireBox – WooCommerce Popup Builder plugin for WordPress is vulnerable to a generic SQL Injection in all versions up to and including 3.1.13 . The root cause is insufficient escaping on user-supplied parameters and a lack of sufficient preparation on existing SQL queries within the FireBox Fo...
DEBIAN-CVE-2026-108093
A flaw was found in GIMP. The XCF loader processes image-simulation-intent and image-simulation-bpc parasites without ensuring the parasite data is present before dereferencing it. Opening a specially crafted XCF file with a zero-size simulation parasite can cause a NULL pointer dereference and...
CVE-2026-108093
A flaw was found in GIMP. The XCF loader processes image-simulation-intent and image-simulation-bpc parasites without ensuring the parasite data is present before dereferencing it. Opening a specially crafted XCF file with a zero-size simulation parasite can cause a NULL pointer dereference and...
UBUNTU-CVE-2026-108093
A flaw was found in GIMP. The XCF loader processes image-simulation-intent and image-simulation-bpc parasites without ensuring the parasite data is present before dereferencing it. Opening a specially crafted XCF file with a zero-size simulation parasite can cause a NULL pointer dereference and...
CVE-2026-108093 Gimp: gimp: denial of service via null pointer dereference in xcf simulation parasite loading
A flaw was found in GIMP. The XCF loader processes image-simulation-intent and image-simulation-bpc parasites without ensuring the parasite data is present before dereferencing it. Opening a specially crafted XCF file with a zero-size simulation parasite can cause a NULL pointer dereference and...
CVE-2026-108093
A flaw was found in GIMP. The XCF loader processes image-simulation-intent and image-simulation-bpc parasites without ensuring the parasite data is present before dereferencing it. Opening a specially crafted XCF file with a zero-size simulation parasite can cause a NULL pointer dereference and...
CVE-2026-92862
The Android application "Ticket Ryutsu Center" improperly handles custom URL schemes, allowing a malicious application to cause access to an arbitrary website via a crafted Intent...
CVE-2026-92862
The Android application "Ticket Ryutsu Center" improperly handles custom URL schemes, allowing a malicious application to cause access to an arbitrary website via a crafted Intent...
EUVD-2026-94676
The Android application "Ticket Ryutsu Center" improperly handles custom URL schemes, allowing a malicious application to cause access to an arbitrary website via a crafted Intent...
CVE-2026-92862
The Android application Ticket Ryutsu Center is vulnerable to an improper handling of custom URL schemes (CWE-939). A malicious application can leverage a crafted Intent to force the vulnerable application to access an arbitrary website. No specific patch version or remediation is provided in the...
CVE-2026-92862: Improper Authorization in Handler for Custom URL Scheme
The Android application "Ticket Ryutsu Center" improperly handles custom URL schemes, allowing a malicious application to cause access to an arbitrary website via a crafted Intent...
PT-2026-107787
The Android application "Ticket Ryutsu Center" improperly handles custom URL schemes, allowing a malicious application to cause access to an arbitrary website via a crafted Intent...