CVE-2026-105210 ZITADEL before 4.17.1 Unauthenticated MFA Enrollment via Login V1 Init Handlers

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose second-factor enrollment and initialization handlers act on an identify-only session before any primary factor is verified. Attackers knowing only a victim's login name can enro...

CVE-2026-105210

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose second-factor enrollment and initialization handlers act on an identify-only session before any primary factor is verified. Attackers knowing only a victim's login name can enro...

CVE-2026-105210: Improper Authentication

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose second-factor enrollment and initialization handlers act on an identify-only session before any primary factor is verified. Attackers knowing only a victim's login name can enro...

PT-2026-104634

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose second-factor enrollment and initialization handlers act on an identify-only session before any primary factor is verified. Attackers knowing only a victim's login name can enro...

CVE-2026-104439

YesWiki before 4.6.7 contains a user enumeration vulnerability in LostPasswordAction.php that allows unauthenticated attackers to confirm registered email addresses through differing responses. Attackers can submit emails to the MotDePassePerdu recovery page without rate limiting to identify vali...

CVE-2026-104439 YesWiki before 4.6.7 User Enumeration via Lost-Password Flow

YesWiki before 4.6.7 contains a user enumeration vulnerability in LostPasswordAction.php that allows unauthenticated attackers to confirm registered email addresses through differing responses. Attackers can submit emails to the MotDePassePerdu recovery page without rate limiting to identify vali...

CVE-2026-104439 YesWiki before 4.6.7 User Enumeration via Lost-Password Flow

YesWiki before 4.6.7 contains a user enumeration vulnerability in LostPasswordAction.php that allows unauthenticated attackers to confirm registered email addresses through differing responses. Attackers can submit emails to the MotDePassePerdu recovery page without rate limiting to identify vali...

EUVD-2026-91449

YesWiki before 4.6.7 contains a user enumeration vulnerability in LostPasswordAction.php that allows unauthenticated attackers to confirm registered email addresses through differing responses. Attackers can submit emails to the MotDePassePerdu recovery page without rate limiting to identify vali...

CVE-2026-104439

YesWiki versions prior to 4.6.7 are vulnerable to a user enumeration vulnerability within the LostPasswordAction.php component. Unauthenticated attackers can confirm registered email addresses by submitting emails to the MotDePassePerdu recovery page and analyzing the differing responses. The lac...

CVE-2026-104439 YesWiki before 4.6.7 User Enumeration via Lost-Password Flow

YesWiki before 4.6.7 contains a user enumeration vulnerability in LostPasswordAction.php that allows unauthenticated attackers to confirm registered email addresses through differing responses. Attackers can submit emails to the MotDePassePerdu recovery page without rate limiting to identify vali...

PT-2026-104249

YesWiki before 4.6.7 contains a user enumeration vulnerability in LostPasswordAction.php that allows unauthenticated attackers to confirm registered email addresses through differing responses. Attackers can submit emails to the MotDePassePerdu recovery page without rate limiting to identify vali...

CVE-2026-104439: Observable Response Discrepancy

YesWiki before 4.6.7 contains a user enumeration vulnerability in LostPasswordAction.php that allows unauthenticated attackers to confirm registered email addresses through differing responses. Attackers can submit emails to the MotDePassePerdu recovery page without rate limiting to identify vali...

GO-2026-6555 Tinyauth: User enumeration attack by timing oracle in github.com/tinyauthapp/tinyauth

Tinyauth: User enumeration attack by timing oracle in github.com/tinyauthapp/tinyauth...

CVE-2026-56098

A flaw was found in rubygem-katello. The RegistryProxiesController in Katello contains an authorization bypass vulnerability due to an execution fall-through in the registryauthorize filter. While the application identifies unauthorized requests and triggers an error response via the unauthorized...

CVE-2026-56098

A flaw in rubygem-katello allows an authorization bypass within the RegistryProxiesController component. The vulnerability is caused by an execution fall-through in the registry_authorize filter, where a missing return statement fails to halt execution after identifying an unauthorized request. T...

EUVD-2026-90971

A flaw was found in rubygem-katello. The RegistryProxiesController in Katello contains an authorization bypass vulnerability due to an execution fall-through in the registryauthorize filter. While the application identifies unauthorized requests and triggers an error response via the unauthorized...

PT-2026-105576

Tinyauth: User enumeration attack by timing oracle in github.com/tinyauthapp/tinyauth...

CVE-2026-56098: Observable Discrepancy

A flaw was found in rubygem-katello. The RegistryProxiesController in Katello contains an authorization bypass vulnerability due to an execution fall-through in the registryauthorize filter. While the application identifies unauthorized requests and triggers an error response via the unauthorized...

PT-2026-103960

Name of the Vulnerable Software and Affected Versions rubygem-katello affected versions not specified Description An authorization bypass exists in the RegistryProxiesController within Katello due to an execution fall-through in the registry authorize filter. Although the application detects...

CVE-2021-4191-EXPLOIT

CVE-2021-4191 - GitLab ユーザー列挙 GitLabは、Gitリポジトリマネージャーを提供し、継続的インテグレーション、課題追跡、コードレビューなどの機能を統合した、広く利用されているWebベースのDevOpsライフサイクルツールです。GraphQL APIは、プログラム的にGitLabと対話し、さまざまな操作を実行できる強力なインターフェースです。 GitLab CVE-2021-4191脆弱性は、特定のバージョンのGitLabにおけるGraphQL...