PT-2026-104639

ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 UI because the 'external account not found' registration endpoint trusts client-supplied external identity fields without a completed IdP callback. Unauthenticated attackers can submit forged...

PT-2026-104634

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose second-factor enrollment and initialization handlers act on an identify-only session before any primary factor is verified. Attackers knowing only a victim's login name can enro...

CVE-2026-105210: Improper Authentication

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose second-factor enrollment and initialization handlers act on an identify-only session before any primary factor is verified. Attackers knowing only a victim's login name can enro...

CVE-2025-71405 vulnerabilities

Vulnerabilities for packages: cloudflared, rclone, step-issuer, karma, buf, step-ca-fips, kyverno-policy-reporter-ui, step-ca, step-fips, dapr, caddy, gogatekeeper, kyverno-policy-reporter-ui-fips, step, tkn, dapr-fips, caddy-fips, telegraf, rclone-fips, tkn-fips, gitness, sftpgo, step-issuer-fip...

GHSA-XCVF-46F4-XWXF vulnerabilities

Vulnerabilities for packages: step-ca, sftpgo, step-issuer, karma, caddy, buf, cloudflared, gogatekeeper, tkn, step, kyverno-policy-reporter-ui, gitness, rclone...

CVE-2025-71405 vulnerabilities

Vulnerabilities for packages: step-ca, sftpgo, step-issuer, karma, caddy, buf, cloudflared, gogatekeeper, tkn, step, kyverno-policy-reporter-ui, gitness, rclone...

Malicious Package

Overview ui-base-colors is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Pentesting

⚡ Pentesting Toolkit v3.0 — AMAN EDITION Pentesting Toolkit e...

CVE-2026-95307

An ui misrepresentation flaw was found in the ExtensionsMenu component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/423956129...

CVE-2026-95363

An ui misrepresentation flaw was found in the FileSystem component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/522344883...

CVE-2026-95321

An ui misrepresentation flaw was found in the Payments component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/545879261...

CVE-2026-95346

An ui misrepresentation flaw was found in the Chromoting component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/514059630...

CVE-2026-95337

An ui misrepresentation flaw was found in the Messages component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/514019137...

CVE-2026-95294

An ui misrepresentation flaw was found in the Browser component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/513992281...

Malicious code in ui-base-colors (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1f7251d8342fbc78bb25925a713153e0bd22f820c678fde7e2ffa0db10fbd151 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17459 Malicious code in ui-base-colors (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1f7251d8342fbc78bb25925a713153e0bd22f820c678fde7e2ffa0db10fbd151 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in ui-base-colors

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

@hmcts/ccd-case-ui-toolkit (>=7.3.49-4369, <=7.3.51), @hmcts/media-viewer (>=4.2.16-4435, <=4.2.17) potentially affected by CVE-2026-104871 via @angular/ssr (>=20.3.18, <=20.3.24)

@angular/ssr NPM version =20.3.18, =7.3.49-4369, =4.2.16-4435, =4.2.17 Source cves: CVE-2026-104871 Source advisory: SNYK:JS-ANGULARSSR-20417147...

GO-2026-6596 vulnerabilities

Vulnerabilities for packages: kubescape-operator, kubescape, hubble-ui, cilium, hubble...

@hmcts/ccd-case-ui-toolkit (>=7.3.49-4369, <=7.3.51), @hmcts/media-viewer (>=4.2.16-4435, <=4.2.17) potentially affected by CVE-2026-104871 via @angular/ssr (>=20.3.18, <=20.3.24)

@angular/ssr NPM version =20.3.18, =7.3.49-4369, =4.2.16-4435, =4.2.17 Source cves: CVE-2026-104871 Source advisory: MEND:CVE-2026-104871...