CVE-2026-50686

Access of resource using incompatible type 'type confusion' in Windows OLE allows an unauthorized attacker to execute code over a network...

CVE-2026-50686 Windows OLE Remote Code Execution Vulnerability

...

CVE-2026-50686

CVE-2026-50686 is a Windows OLE remote code execution vulnerability caused by a type confusion in resource access. It enables network-exposed code execution without authentication and is documented with CVSS v3.1 base score 8.1 (High). Public references identify the affected area as Windows OLE, ...

CVE-2026-50344 Windows OLE Elevation of Privilege Vulnerability

...

CVE-2026-50344 Windows OLE Elevation of Privilege Vulnerability

...

CVE-2026-50344

CVE-2026-50344 corresponds to an Windows OLE elevation-of-privilege vulnerability. Description from sources: “Improper authorization in Windows OLE allows an authorized attacker to elevate privileges locally.” Exploitation details are not provided beyond that this is a local privilege escalation ...

Windows OLE Elevation of Privilege Vulnerability

Improper authorization in Windows OLE allows an authorized attacker to elevate privileges locally...

Windows OLE Remote Code Execution Vulnerability

Access of resource using incompatible type 'type confusion' in Windows OLE allows an unauthorized attacker to execute code over a network...

PT-2026-58332

Name of the Vulnerable Software and Affected Versions Windows affected versions not specified Description Improper authorization in Windows OLE Object Linking and Embedding, a framework that allows embedding documents and other objects in one application within another application allows an...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication in the auto-linking process by email, as the external identity provider does not verify ownership of the email address before linking accounts. An attacker can gain unauthorized access to a victim's local account...

CVE-2026-56666

ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL's external identity provider handler checks that the local user's email is verified but does not verify that the external IdP confirmed ownership of the same email before auto-linking by email, allowing a permissive...

CVE-2026-56666 ZITADEL: Auto-linking by email: IdP-side email verification is not checked

ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL's external identity provider handler checks that the local user's email is verified but does not verify that the external IdP confirmed ownership of the same email before auto-linking by email, allowing a permissive...

CVE-2026-56666 ZITADEL: Auto-linking by email: IdP-side email verification is not checked

ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL's external identity provider handler checks that the local user's email is verified but does not verify that the external IdP confirmed ownership of the same email before auto-linking by email, allowing a permissive...

CVE-2026-56666

ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL's external identity provider handler checks that the local user's email is verified but does not verify that the external IdP confirmed ownership of the same email before auto-linking by email, allowing a permissive...

CVE-2026-56666 ZITADEL: Auto-linking by email: IdP-side email verification is not checked

ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL's external identity provider handler checks that the local user's email is verified but does not verify that the external IdP confirmed ownership of the same email before auto-linking by email, allowing a permissive...

CVE-2026-56666

ZITADEL before v4.15.3 permits auto-linking by email without confirming IdP ownership of the email. The external IdP handler validates the local email but not that the IdP confirms ownership, enabling linking a permissive provider account to a victim’s local account. This vulnerability is address...

PT-2026-57254

Name of the Vulnerable Software and Affected Versions ZITADEL versions prior to 4.15.3 Description The external identity provider handler fails to verify that the external identity provider confirmed ownership of an email address before performing auto-linking by email. While the system checks if...

CVE-2026-58494

A flaw was found in Wasmtime, a runtime for WebAssembly. A WebAssembly System Interface WASI guest with a read-only source file capability can exploit this vulnerability. During hard-link creation and renaming operations, the system checks directory permissions but fails to match file permissions...

Improper Authentication

github.com/coder/coder is vulnerable to Improper Authentication. The vulnerability is due to improper OIDC email-based account linking and incorrect handling of the emailverified claim, which allows an attacker to authenticate with a malicious or unverified OIDC identity and take over another...

CVE-2026-55076 Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, Coder's OIDC callback checked emailverified with a direct Go bool type assertion. When an IdP returned the claim as a non-boolean for example the string...