CVE-2026-109373

ZITADEL versions 3.0.0 before 4.19.2 are vulnerable to an authentication bypass in the Login V2 UI . The root cause allows unauthenticated attackers to forge unsigned session cookies by guessing time-ordered session IDs near a victim's sign-in. By supplying these IDs with empty tokens, attackers ...

CVE-2026-109373 ZITADEL 3.0.0 before 4.19.2 Account Takeover via Unsigned Login V2 Session Cookie

ZITADEL 3.0.0 before 4.19.2 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to obtain other users' session tokens by forging unsigned session cookies. Attackers can guess time-ordered session IDs around a victim's sign-in and supply them wi...

EUVD-2026-97671

ZITADEL 3.0.0 before 4.19.2 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to obtain other users' session tokens by forging unsigned session cookies. Attackers can guess time-ordered session IDs around a victim's sign-in and supply them wi...

CVE-2026-109373 ZITADEL 3.0.0 before 4.19.2 Account Takeover via Unsigned Login V2 Session Cookie

ZITADEL 3.0.0 before 4.19.2 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to obtain other users' session tokens by forging unsigned session cookies. Attackers can guess time-ordered session IDs around a victim's sign-in and supply them wi...

EUVD-2026-97669

ZITADEL 3.0.0 before 4.18.0 contains a missing authentication vulnerability in the hosted Login V1 UI, where the change-username handler acts on the account bound to a login flow before any factor is verified. Unauthenticated attackers can submit a victim's login name and then post a new username...

CVE-2026-109371 ZITADEL 3.0.0 before 4.18.0 Unauthenticated Username Change via Login V1

ZITADEL 3.0.0 before 4.18.0 contains a missing authentication vulnerability in the hosted Login V1 UI, where the change-username handler acts on the account bound to a login flow before any factor is verified. Unauthenticated attackers can submit a victim's login name and then post a new username...

CVE-2026-109371 ZITADEL 3.0.0 before 4.18.0 Unauthenticated Username Change via Login V1

ZITADEL 3.0.0 before 4.18.0 contains a missing authentication vulnerability in the hosted Login V1 UI, where the change-username handler acts on the account bound to a login flow before any factor is verified. Unauthenticated attackers can submit a victim's login name and then post a new username...

CVE-2026-109346

The better-auth library versions 1.3.8-beta.3 before 1.7.0-rc.3 is vulnerable to a UI misrepresentation issue within the deviceAuthorization plugin. The root cause is that the GET /device endpoint fails to include the requesting client_id and scope . This allows an attacker to initiate a device r...

EUVD-2026-97648

better-auth from 1.3.8-beta.3 before 1.7.0-rc.3 contains a UI misrepresentation vulnerability in the deviceAuthorization plugin because GET /device omits the requesting clientid and scope. Attackers can start a device request via /device/code, trick signed-in users into approving the code, then...

CVE-2026-109346 better-auth 1.3.8-beta.3 before 1.7.0-rc.3 Device Authorization Phishing via /device

better-auth from 1.3.8-beta.3 before 1.7.0-rc.3 contains a UI misrepresentation vulnerability in the deviceAuthorization plugin because GET /device omits the requesting clientid and scope. Attackers can start a device request via /device/code, trick signed-in users into approving the code, then...

CVE-2026-108901 Shenzhen HCC Technology MPOS M6 PLUS Display QR Code Rendering ui layer

A vulnerability was found in Shenzhen HCC Technology MPOS M6 PLUS 1.31-N. Affected by this vulnerability is an unknown functionality of the component Display QR Code Rendering. Performing a manipulation of the argument alignment results in improper restriction of rendered ui layers. The attack ca...

CVE-2018-6961

CVE-2018-6961 Exploit in Python3 VMware NSX SD-WAN Edge by VeloCloud prior to version 3.1.0 contains a command injection vulnerability in the local web UI component. This component is disabled by default and should not be enabled on untrusted networks. VeloCloud by VMware will be removing this...

CVE-2022-37017

CVE-2022-37017 Authentication bypass for Symantec Endpoint Protection 14.3.5351 Client User Interface Password Symantec Endpoint Protection allows setting a password protection on its UI to prevent configuration changes. This password check in implemented by logic that is neither in a Protected...

Malicious code in ap3-foundations-ui (npm)

Source: amazon-inspector 7469eefaab624821647b4e412c4ceac1f422d4857b8484767041fdc355398477 The package's preinstall hook runs index.js, which collects installer host identifiers os.hostname, os.userInfo.username, os.homedir, process.cwd, os.platform, os.arch, and process.env.CI and POSTs them as...

Malicious code in ap3-foundations-ui (npm)

ap3-foundations-ui describes itself as a security research PoC for dependency confusion and does not identify an upstream package it copies. Its preinstall hook runs node index.js during npm install; the script sends the package name and version, hostname, username, home directory, working...

MAL-2026-17806 Malicious code in ap3-foundations-ui (npm)

ap3-foundations-ui describes itself as a security research PoC for dependency confusion and does not identify an upstream package it copies. Its preinstall hook runs node index.js during npm install; the script sends the package name and version, hostname, username, home directory, working...

PT-2026-110975

Name of the Vulnerable Software and Affected Versions Nginx UI versions prior to 2.4.1 Description An authenticated MCP caller or an MCP agent induced via prompt injection can bypass security controls to inject dangerous Nginx directives. While the ValidateConfigFile function in...

PT-2026-110974

Name of the Vulnerable Software and Affected Versions Nginx UI versions prior to 2.4.1 Description An authenticated user can bypass configuration validation because the config.ValidateConfigDirectives function only checks the first directive token on each line, ignoring subsequent...

PT-2026-110890

Name of the Vulnerable Software and Affected Versions IBM Db2 Recovery Expert for Linux, UNIX and Windows version 5.5 IF 2 Description An unauthenticated attacker can embed arbitrary JavaScript code into the Web UI. This cross-site scripting issue allows the attacker to alter the intended...

PT-2026-110953

Name of the Vulnerable Software and Affected Versions Nginx UI versions prior to 2.4.3 Description An authenticated user can manipulate the backup process by creating or modifying an automatic backup. The AutoBackup.GetName function returns a user-controlled name that does not reject path...