88754 matches found
CVE-2026-55669 ZITADEL: Missing Token Audience Validation (`aud`) in JWT IdP Provider
ZITADEL is an open source identity management platform. Prior to 3.4.12 and 4.15.2, ZITADEL's external JWT Identity Provider validates a token's signature and issuer iss but not the audience aud claim, allowing a validly signed token from a trusted issuer for another relying party to be accepted ...
EUVD-2026-42958
ZITADEL is an open source identity management platform. Prior to 3.4.12 and 4.15.2, ZITADEL's external JWT Identity Provider validates a token's signature and issuer iss but not the audience aud claim, allowing a validly signed token from a trusted issuer for another relying party to be accepted ...
EUVD-2026-42939
ESF-IDF is the Espressif Internet of Things IOT Development Framework. Versions 6.0.1, 5.5.4, 5.4.4, 5.3.5, and possibly prior contain an out-of-bounds write in jpegparsedqtmarker in components/espdriverjpeg/jpegparsemarker.c because the attacker-controlled DQT marker Tq nibble is used as an inde...
CVE-2026-38057
The CVE-2026-38057 entry affects the iDirect iQ200 series. The issue is CSRF on state-changing API endpoints, specifically the /api/reboot POST endpoint, which accepts requests authenticated only by a session cookie that lacks the SameSite attribute. A remote attacker can lure an authenticated ad...
MINI-JP24-44R5-PG2H
Bulletin has no description...
EUVD-2026-42890
Vikunja before 2.2.1 contains an authorization flaw where the LinkSharing.ReadAll endpoint exposes share hashes to users with read access, enabling permission escalation to admin-level shares. The GetTaskAttachment endpoint performs permission checks against user-supplied task IDs but fetches...
CVE-2026-56305 Capgo - Authentication Bypass in Password Change via Missing Current Password Validation
Capgo before 12.128.2 contains an authentication bypass vulnerability in the password change endpoint that allows attackers to change user passwords without requiring current password confirmation. Attackers with temporary session access can exploit this flaw to permanently lock out legitimate...
MINI-GW36-HCJ6-QWF7
Bulletin has no description...
MINI-C83W-GP9J-4QV6
Bulletin has no description...
MINI-XV73-H3C9-CC4J
Bulletin has no description...
MINI-QP43-FQ3F-PJGP
Bulletin has no description...
MINI-WM54-89WF-XCMC
Bulletin has no description...
MINI-XR3V-CMJP-WPGM
Bulletin has no description...
MINI-X57J-PH27-WC38
Bulletin has no description...
MINI-9MX8-94V6-MR3Q
Bulletin has no description...
MINI-82F5-G5F3-CQJ9
Bulletin has no description...
MINI-G68C-3XM6-QPQP
Bulletin has no description...
MINI-97QP-F6Q7-6M68
Bulletin has no description...