CVE-2026-51772

A Server-Side Request Forgery SSRF vulnerability exists in the Image API v2 of OpenStack Glance. When the showmultiplelocations configuration option is enabled in glance-api.conf, an authenticated attacker can manipulate the locations attribute of an image in the queued state by sending a crafted...

PT-2026-98822

Name of the Vulnerable Software and Affected Versions OpenStack Glance affected versions not specified Description A Server-Side Request Forgery SSRF issue exists in the Image API v2. When the show multiple locations configuration option is enabled in glance-api.conf, an authenticated attacker ca...

CVE-2026-51772: Server-Side Request Forgery (SSRF)

A Server-Side Request Forgery SSRF vulnerability exists in the Image API v2 of OpenStack Glance. When the showmultiplelocations configuration option is enabled in glance-api.conf, an authenticated attacker can manipulate the locations attribute of an image in the queued state by sending a crafted...

CVE-2026-51772

A Server-Side Request Forgery SSRF vulnerability exists in the Image API v2 of OpenStack Glance. When the showmultiplelocations configuration option is enabled in glance-api.conf, an authenticated attacker can manipulate the locations attribute of an image in the queued state by sending a crafted...

EUVD-2026-87085

A Server-Side Request Forgery SSRF vulnerability exists in the Image API v2 of OpenStack Glance. When the showmultiplelocations configuration option is enabled in glance-api.conf, an authenticated attacker can manipulate the locations attribute of an image in the queued state by sending a crafted...

CVE-2026-51772

A Server-Side Request Forgery (SSRF) vulnerability exists in the Image API (v2) of OpenStack Glance . When the show_multiple_locations configuration option is enabled in glance-api.conf, an authenticated attacker can manipulate the locations attribute of an image in the queued state by sending a ...

ROS-20260925-73-0152

The vulnerability of the anyseemasterxfer function in the drivers/media/usb/dvb-usb-v2/anysee.c file of the Linux multimedia device driver framework involves pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a service failure...

openSUSE 16 Security Update : keybase-client (openSUSE-SU-2026:21925-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21925-1 advisory. Changes in keybase-client: - CVE-2026-89090: Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder Tenable has extracted the...

GHSA-9993-RFWP-RHWF ZITADEL: MFA bypass via session reuse in Login V2

Summary A vulnerability in ZITADEL’s Login V2 UI allowed a password-verified browser session to be reused for a new authentication request without re-checking a user’s enrolled second factor TOTP, OTP, or U2F. An attacker who already knows valid credentials can fully authenticate to an applicatio...

ZITADEL: MFA bypass via session reuse in Login V2

Summary A vulnerability in ZITADEL’s Login V2 UI allowed a password-verified browser session to be reused for a new authentication request without re-checking a user’s enrolled second factor TOTP, OTP, or U2F. An attacker who already knows valid credentials can fully authenticate to an applicatio...

CVE-2026-85056

ZITADEL is an open source identity management platform. From 4.0.0 until 4.16.1, ZITADEL Login V2 creates a browser session after password verification and can reuse that session for a later authentication request without verifying a user's enrolled TOTP, OTP, or U2F second factor. When the MFA...

CVE-2026-85056 ZITADEL: MFA bypass via session reuse in Login V2

ZITADEL is an open source identity management platform. From 4.0.0 until 4.16.1, ZITADEL Login V2 creates a browser session after password verification and can reuse that session for a later authentication request without verifying a user's enrolled TOTP, OTP, or U2F second factor. When the MFA...

CVE-2026-85056 ZITADEL: MFA bypass via session reuse in Login V2

ZITADEL is an open source identity management platform. From 4.0.0 until 4.16.1, ZITADEL Login V2 creates a browser session after password verification and can reuse that session for a later authentication request without verifying a user's enrolled TOTP, OTP, or U2F second factor. When the MFA...

CVE-2026-85056 ZITADEL: MFA bypass via session reuse in Login V2

ZITADEL is an open source identity management platform. From 4.0.0 until 4.16.1, ZITADEL Login V2 creates a browser session after password verification and can reuse that session for a later authentication request without verifying a user's enrolled TOTP, OTP, or U2F second factor. When the MFA...

CVE-2026-85056

The identity management platform ZITADEL is vulnerable to an MFA bypass in Login V2 (versions 4.0.0 through 4.16.1). The root cause is that the system creates a browser session after password verification and allows it to be reused for subsequent requests without verifying enrolled TOTP, OTP, or ...

EUVD-2026-86324

ZITADEL is an open source identity management platform. From 4.0.0 until 4.16.1, ZITADEL Login V2 creates a browser session after password verification and can reuse that session for a later authentication request without verifying a user's enrolled TOTP, OTP, or U2F second factor. When the MFA...

PT-2026-98200

Name of the Vulnerable Software and Affected Versions ZITADEL versions 4.0.0 through 4.16.0 Description ZITADEL Login V2 creates a browser session immediately after password verification. This session can be reused for subsequent authentication requests without verifying a user's enrolled second...

PT-2026-97829

Name of the Vulnerable Software and Affected Versions Altera Trusted Firmware on HPS versions prior to socfpga v2.14.0 Description An out-of-bounds read issue exists where unvalidated SiP v2 mailbox pointers allow non-secure EL1 access to arbitrary physical addresses through EL3. This can lead to...

CVE-2026-85056: Improper Authentication

ZITADEL is an open source identity management platform. From 4.0.0 until 4.16.1, ZITADEL Login V2 creates a browser session after password verification and can reuse that session for a later authentication request without verifying a user's enrolled TOTP, OTP, or U2F second factor. When the MFA...

CVE-2026-97056: Insufficient Session Expiration

SigNoz versions from v0.98.0 up to but not including v0.143.0, when configured to use the opaque session tokenizer which was not the default before v0.143.0, do not revoke a user's existing login sessions when the user's password is reset with a reset token UpdatePasswordByResetPasswordToken,...