3445 matches found
Huawei EulerOS: Security Advisory for libtasn1 (EulerOS-SA-2026-1250)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2026-31824: Concurrent Execution using Shared Resource with Improper Synchronization
Sylius is an Open Source eCommerce Framework on Symfony. A Time-of-Check To Time-of-Use TOCTOU race condition was discovered in the promotion usage limit enforcement. The same class of vulnerability affects the promotion usage limit the global used counter on Promotion entities, coupon usage limi...
CVE-2026-31801: Incorrect Authorization
zot is ancontainer image/artifact registry based on the Open Container Initiative Distribution Specification. From 1.3.0 to 2.1.14, zot’s dist-spec authorization middleware infers the required action for PUT /v2/name/manifests/reference as create by default, and only switches to update when the t...
CVE-2026-31821: Missing Authorization
Sylius is an Open Source eCommerce Framework on Symfony. The POST /api/v2/shop/orders/tokenValue/items endpoint does not verify cart ownership. An unauthenticated attacker can add items to other registered customers' carts by knowing the cart tokenValue. An attacker who obtains a cart tokenValue...
CVE-2026-30862 Critical Stored XSS & Privilege Escalation in Appsmith
Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.96, a Critical Stored XSS vulnerability exists in the Table Widget TableWidgetV2. The root cause is a lack of HTML sanitization in the React component rendering pipeline, allowing malicious attributes to be...
CVE-2026-29192
Technical details for CVE-2026-29192 are not provided in the connected documents. No specifics on affected products beyond Zitadel 4.0.0–4.11.1 or remediation beyond patch to 4.12.0. Monitor for official advisories and updates.
ZITADEL 跨站脚本漏洞
ZITADEL is an open-source identity and access management platform developed by ZITADEL in Switzerland. Versions of ZITADEL from 4.0.0 to 4.11.1 have a cross-site scripting vulnerability. This vulnerability stems from a default URI redirection issue in the login V2 interface, which may lead to...
CVE-2026-29191: Improper Neutralization of Input During Web Page Generation
ZITADEL is an open source identity management platform. From version 4.0.0 to 4.11.1, a vulnerability in Zitadel's login V2 interface was discovered that allowed a possible account takeover via XSS in /saml-post Endpoint. This issue has been patched in version 4.12.0...
CVE-2026-29193: Improper Authentication
ZITADEL is an open source identity management platform. From version 4.0.0 to 4.12.0, a vulnerability in Zitadel's login V2 UI allowed users to bypass login behavior and security policies and self-register new accounts or sign in using password even if corresponding options were disabled in their...
CVE-2026-29067: URL Redirection to Untrusted Site
ZITADEL is an open source identity management platform. From version 4.0.0-rc.1 to 4.7.0, a potential vulnerability exists in ZITADEL's password reset mechanism in login V2. ZITADEL utilizes the Forwarded or X-Forwarded-Host header from incoming requests to construct the URL for the password rese...
CVE-2026-29192: Improper Neutralization of Input During Web Page Generation
ZITADEL is an open source identity management platform. From version 4.0.0 to 4.11.1, a vulnerability in Zitadel's login V2 interface was discovered that allowed a possible account takeover via Default URI Redirect. This issue has been patched in version 4.12.0...
ZITADEL 跨站脚本漏洞
ZITADEL is a modern open-source alternative to Auth0, Firebase Auth, AWS Cognito, and Keycloak, developed by ZITADEL in Switzerland for the era of containers and serverless architectures. Versions 4.0.0 to 4.11.1 of ZITADEL contain a cross-site scripting vulnerability. This vulnerability stems fr...
Malicious code in pino-sdk-v2 (npm)
Malware detected: Exfiltrates .env file keys to Discord webhook. Impersonates legit pino package with modified malicious package/lib/tools.js. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 093fa98258b33a735216506ea119532a3cc24c92359028b4bb1955d0b712951a The...
MAL-2026-1182 Malicious code in bigmathutils-v2 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c792a1951ba6e4b2e2f4e8b067b8be850400fbc0f20e89af56336fffd56b2522 The package bigmathutils-v2 was found to contain malicious code. Source: ghsa-malware cd02bf555ca1d0393411bacd3b44a82ab4c6726b7510274bcdca34126958da6...
Malicious code in bigmathutils-v2 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c792a1951ba6e4b2e2f4e8b067b8be850400fbc0f20e89af56336fffd56b2522 The package bigmathutils-v2 was found to contain malicious code. Source: ghsa-malware cd02bf555ca1d0393411bacd3b44a82ab4c6726b7510274bcdca34126958da6...
Malicious Package
Overview bigmathutils-v2 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
EUVD-2026-8793
ZITADEL has potential SSRF via Actions...
ZITADEL's truncated opaque tokens are still valid
Summary Opaque OIDC access tokens in v2 format, truncated to 80 characters are still considered valid. ZITADEL uses a symmetric AES encryption for opaque tokens. The cleartext payload is a concatenation of a couple of identifiers, such as a token ID and user ID. Internally Zitadel has 2 different...