CVE-2026-105208 ZITADEL before 4.17.3 Session Hijacking via Forgeable IdP Intent Tokens

ZITADEL 4.x before 4.17.3 and 3.x through 3.4.15 protects IdP intent tokens with unauthenticated, malleable encryption, allowing authenticated users to tamper with their own token so it is accepted for another user's external login intent. An attacker who predicts a victim's in-flight intent...

CVE-2026-105208

ZITADEL versions 4.x before 4.17.3 and 3.x through 3.4.15 are vulnerable to session hijacking due to the use of unauthenticated, malleable encryption for IdP intent tokens. This flaw allows authenticated users to tamper with their own tokens to be accepted for another user's external login intent...

CVE-2026-105208 ZITADEL before 4.17.3 Session Hijacking via Forgeable IdP Intent Tokens

ZITADEL 4.x before 4.17.3 and 3.x through 3.4.15 protects IdP intent tokens with unauthenticated, malleable encryption, allowing authenticated users to tamper with their own token so it is accepted for another user's external login intent. An attacker who predicts a victim's in-flight intent...

CVE-2026-105208 ZITADEL before 4.17.3 Session Hijacking via Forgeable IdP Intent Tokens

ZITADEL 4.x before 4.17.3 and 3.x through 3.4.15 protects IdP intent tokens with unauthenticated, malleable encryption, allowing authenticated users to tamper with their own token so it is accepted for another user's external login intent. An attacker who predicts a victim's in-flight intent...

PT-2026-104632

ZITADEL 4.x before 4.17.3 and 3.x through 3.4.15 protects IdP intent tokens with unauthenticated, malleable encryption, allowing authenticated users to tamper with their own token so it is accepted for another user's external login intent. An attacker who predicts a victim's in-flight intent...

CVE-2026-105208: Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking

ZITADEL 4.x before 4.17.3 and 3.x through 3.4.15 protects IdP intent tokens with unauthenticated, malleable encryption, allowing authenticated users to tamper with their own token so it is accepted for another user's external login intent. An attacker who predicts a victim's in-flight intent...

Reactivating Alignment: Defending LLMs from Jailbreaks Via Intention-Aware Input-Output Matching

Large language models LLMs remain vulnerable to jailbreak attacks that conceal harmful intent within complex adversarial prompts. Existing defenses primarily rely on input perturbation or harmful-output suppression, but they rarely model where malicious intent resides, resulting in brittle...

PT-2026-104140

Name of the Vulnerable Software and Affected Versions LatePoint | Calendar & Scheduling for WordPress versions prior to 5.7.2 Description An Insecure Direct Object Reference exists via the OsPaypalConnectController::create order for transaction action, which is registered as a public route throug...

WordPress Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin <= 5.7.1 - Insecure Direct Object Reference to Unauthenticated Unauthorized Transaction Intent Creation/Modification and Invoice Enumeration vulnerability

Insecure Direct Object Reference to Unauthenticated Unauthorized Transaction Intent Creation/Modification and Invoice Enumeration vulnerability discovered by Niv Kochan, Matan Bachar in WordPress Plugin LatePoint versions = 5.7.1...

nautobot-app-intent-networking (>=2.0.9, <=2.0.17) potentially affected by CVE-2026-83805 via nautobot (3.1.1)

nautobot PYPI version 3.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on nautobot and may be impacted: - nautobot-app-intent-networking =2.0.9, =2.0.17 Source cves: CVE-2026-83805 Source advisory: OSV:PYSEC-2026-4111...

nautobot-app-intent-networking (>=2.0.9, <=2.0.17) potentially affected by CVE-2026-83801 via nautobot (3.1.1)

nautobot PYPI version 3.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on nautobot and may be impacted: - nautobot-app-intent-networking =2.0.9, =2.0.17 Source cves: CVE-2026-83801 Source advisory: OSV:PYSEC-2026-4110...

PT-2026-99412

Name of the Vulnerable Software and Affected Versions miniOrange OTP Login, Verification and SMS Notifications versions prior to 5.5.6 Description An authentication bypass exists when the mo wp login intent parameter is used. The issue occurs within the mo by pass login function, specifically in...

nautobot-app-intent-networking (>=2.0.9, <=2.0.17) potentially affected by CVE-2026-83805 via nautobot (3.1.1)

nautobot PYPI version 3.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on nautobot and may be impacted: - nautobot-app-intent-networking =2.0.9, =2.0.17 Source cves: CVE-2026-83805 Source advisory: GHSA-Q4C5-2J6F-R476...

nautobot-app-intent-networking (>=2.0.9, <=2.0.17) potentially affected by CVE-2026-83805 via nautobot (3.1.1)

nautobot PYPI version 3.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on nautobot and may be impacted: - nautobot-app-intent-networking =2.0.9, =2.0.17 Source cves: CVE-2026-83805 Source advisory: OSV:GHSA-Q4C5-2J6F-R476...

nautobot-app-intent-networking (>=2.0.9, <=2.0.17) potentially affected by CVE-2026-83801 via nautobot (3.1.1)

nautobot PYPI version 3.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on nautobot and may be impacted: - nautobot-app-intent-networking =2.0.9, =2.0.17 Source cves: CVE-2026-83801 Source advisory: OSV:GHSA-56V6-2FHR-WXGQ...

nautobot-app-intent-networking (>=2.0.9, <=2.0.17) potentially affected by CVE-2026-83805 via nautobot (3.1.1)

nautobot PYPI version 3.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on nautobot and may be impacted: - nautobot-app-intent-networking =2.0.9, =2.0.17 Source cves: CVE-2026-83805 Source advisory: MEND:CVE-2026-83805...

Improper access control vulnerability in Android application "ManabiPocket for Parents"

Overview Android application "ManabiPocket for Parents" provided by NTT DOCOMO BUSINESS, Inc. contains the following vulnerability: Improper Export of Android Application Components CWE-926 - CVE-2026-86701 The CVSS below assumes that sensitive information within the affected application is...

CVE-2026-86701

Android application "ManabiPocket for Parents" contains an improper access control vulnerability in one of its components. A malicious application installed on the user's Android device may exploit the affected component via an Intent, potentially allowing the malicious application to obtain...

CVE-2026-86701

Android application "ManabiPocket for Parents" contains an improper access control vulnerability in one of its components. A malicious application installed on the user's Android device may exploit the affected component via an Intent, potentially allowing the malicious application to obtain...

CVE-2026-86701

CVE-2026-86701 affects the Android application ManabiPocket for Parents , which contains an improper access control vulnerability in one of its components. A malicious application installed on the same device can exploit the affected component via an Intent , potentially allowing it to obtain sen...