CVE-2026-55671 ZITADEL: Server-Side Request Forgery (SSRF) and Denylist Bypass in Outgoing HTTP Components

ZITADEL is an open source identity management platform. From 4.0.0-rc.1 through 4.15.1, ZITADEL's HTTP notification channels, OIDC BackChannel Logout, and SAML metadata URL fetches do not consistently validate user-defined URLs against protected denylist handling, allowing server-side requests to...

CVE-2026-55671 ZITADEL: Server-Side Request Forgery (SSRF) and Denylist Bypass in Outgoing HTTP Components

ZITADEL is an open source identity management platform. From 4.0.0-rc.1 through 4.15.1, ZITADEL's HTTP notification channels, OIDC BackChannel Logout, and SAML metadata URL fetches do not consistently validate user-defined URLs against protected denylist handling, allowing server-side requests to...

CVE-2026-33382

creationtimestamp| type| source ---|---|--- 2026-07-10 17:00:54+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqcmrjabny2r 2026-07-10 22:29:42+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqd75hwwav2i 2026-07-11 00:20:09+00:00| seen|...

CVE-2026-61431

creationtimestamp| type| source ---|---|--- 2026-07-10 16:57:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqcmlhpqih2l 2026-07-10 20:18:44+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqcxtbl45i2f 2026-07-10 22:05:28+00:00| seen|...

CVE-2026-61441

creationtimestamp| type| source ---|---|--- 2026-07-10 16:32:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqcl6piort2i 2026-07-10 22:21:24+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqd6omq2ei26 2026-07-10 23:26:14+00:00| seen|...

CVE-2026-61432

creationtimestamp| type| source ---|---|--- 2026-07-10 16:28:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqckwzwntr2k 2026-07-10 20:15:25+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqcxneg5ju2i 2026-07-10 23:29:45+00:00| seen|...

CVE-2026-61492

creationtimestamp| type| source ---|---|--- 2026-07-10 16:18:05+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqckeuxhu526 2026-07-10 20:21:02+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqcxxf2ixm2d 2026-07-10 22:29:17+00:00| seen|...

CVE-2026-46340

creationtimestamp| type| source ---|---|--- 2026-07-10 16:17:57+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqckepga3q2a...

CVE-2026-60091

creationtimestamp| type| source ---|---|--- 2026-07-10 16:06:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqcjpwr6kh2q 2026-07-10 20:15:05+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqcxmqnilo2c 2026-07-15 16:35:50+00:00| seen|...

CVE-2026-54469

creationtimestamp| type| source ---|---|--- 2026-07-10 15:30:16+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116896393517811948 2026-07-10 17:27:21+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqcoasxcp327 2026-07-10 21:24:23+00:00| seen|...

CVE-2026-56765

Vikunja before 2.2.1 contains an authorization flaw where the LinkSharing.ReadAll endpoint exposes share hashes to users with read access, enabling permission escalation to admin-level shares. The GetTaskAttachment endpoint performs permission checks against user-supplied task IDs but fetches...

GHSA-4VJ7-5MJ6-JM8M

creationtimestamp| type| source ---|---|--- 2026-07-10 15:11:59+00:00| seen| https://gist.github.com/alon710/6a1f370c6283107f299350100ca84db2...

CVE-2026-48138

creationtimestamp| type| source ---|---|--- 2026-07-10 14:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mqceqewuyp2g...

CVE-2026-57229

creationtimestamp| type| source ---|---|--- 2026-07-10 14:00:19+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mqccon2eyw25...

CVE-2026-56765 Vikunja - Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR

Vikunja before 2.2.1 contains an authorization flaw where the LinkSharing.ReadAll endpoint exposes share hashes to users with read access, enabling permission escalation to admin-level shares. The GetTaskAttachment endpoint performs permission checks against user-supplied task IDs but fetches...

CVE-2026-56765 Vikunja - Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR

Vikunja before 2.2.1 contains an authorization flaw where the LinkSharing.ReadAll endpoint exposes share hashes to users with read access, enabling permission escalation to admin-level shares. The GetTaskAttachment endpoint performs permission checks against user-supplied task IDs but fetches...

CVE-2026-56312 Capgo - Account Creation Before CAPTCHA Validation in accept_invitation Endpoint

Capgo before 12.128.2 contains an improper validation vulnerability in the acceptinvitation endpoint that creates user accounts before captcha validation is enforced. Attackers can bypass captcha protection by sending POST requests with invalid captcha tokens to create unwanted accounts and burn...

CVE-2026-9857

creationtimestamp| type| source ---|---|--- 2026-07-10 12:42:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqc6czb7p427 2026-07-10 21:23:28+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqd3h22ks422 2026-07-10 21:23:34+00:00| seen|...

CVE-2026-14461

creationtimestamp| type| source ---|---|--- 2026-07-10 12:27:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqc5i5xosi2x 2026-07-10 14:21:24+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqcdud4c3b26 2026-07-10 16:15:07+00:00| seen|...

CVE-2026-12955

creationtimestamp| type| source ---|---|--- 2026-07-10 12:13:09+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqc4oz4s4a2i 2026-07-10 21:13:54+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqd2vwd6tv2s...