CVE-2026-105214 Zitadel before 4.16.2 SSRF via Organization Domain HTTP Verification

Zitadel before 4.16.2 contains a server-side request forgery vulnerability that allows attackers to make the server request internal resources through organization domain HTTP verification. The challenge fetch uses Go's default http.Get instead of the protected client, so attackers can register...

CVE-2026-105214 Zitadel before 4.16.2 SSRF via Organization Domain HTTP Verification

Zitadel before 4.16.2 contains a server-side request forgery vulnerability that allows attackers to make the server request internal resources through organization domain HTTP verification. The challenge fetch uses Go's default http.Get instead of the protected client, so attackers can register...

CVE-2026-105214 Zitadel before 4.16.2 SSRF via Organization Domain HTTP Verification

Zitadel before 4.16.2 contains a server-side request forgery vulnerability that allows attackers to make the server request internal resources through organization domain HTTP verification. The challenge fetch uses Go's default http.Get instead of the protected client, so attackers can register...

EUVD-2026-92107

Zitadel before 4.16.2 contains a server-side request forgery vulnerability that allows attackers to make the server request internal resources through organization domain HTTP verification. The challenge fetch uses Go's default http.Get instead of the protected client, so attackers can register...

Zack-LocalScan

Zack-LocalScan English | 简体中文 Zack-Loc...

EUVD-2026-92049

LaraDashboard 1.4.2 before 1.4.8 applies advanced email validation to unauthenticated forgot-password and reset-password requests, triggering DNS lookups and paid AbstractAPI verification calls. Unauthenticated attackers can submit arbitrary addresses to exhaust the verification quota, making...

CVE-2026-105127: Allocation of Resources Without Limits or Throttling

LaraDashboard 1.4.2 before 1.4.8 applies advanced email validation to unauthenticated forgot-password and reset-password requests, triggering DNS lookups and paid AbstractAPI verification calls. Unauthenticated attackers can submit arbitrary addresses to exhaust the verification quota, making...

PT-2026-104646

Name of the Vulnerable Software and Affected Versions Cockpit CMS versions 2.12.0 through 2.14.0 Description The software disables TLS certificate verification during the web worker restart request. This allows a man-in-the-middle attacker on the outbound path to the site url to present any...

CVE-2026-105214: Server-Side Request Forgery (SSRF)

Zitadel before 4.16.2 contains a server-side request forgery vulnerability that allows attackers to make the server request internal resources through organization domain HTTP verification. The challenge fetch uses Go's default http.Get instead of the protected client, so attackers can register...

PT-2026-104638

Zitadel before 4.16.2 contains a server-side request forgery vulnerability that allows attackers to make the server request internal resources through organization domain HTTP verification. The challenge fetch uses Go's default http.Get instead of the protected client, so attackers can register...

PT-2026-104656

The alexpechkarev/google-maps Laravel package through 12.16 disables TLS certificate verification by default because the bundled config sets ssl verify peer to FALSE, which is passed to CURLOPT SSL VERIFYPEER. On-path attackers can present any certificate to intercept Google Maps web-service...

PT-2026-104644

A flaw has been found in invariant-systems-ai aiir up to 1.7.0. The affected element is an unknown function of the component Policy Gate Handler. Executing a manipulation can lead to improper verification of cryptographic signature. The attack can be executed remotely. It is advisable to upgrade...

CVE-2026-105161: Improper Verification of Cryptographic Signature

A flaw has been found in invariant-systems-ai aiir up to 1.7.0. The affected element is an unknown function of the component Policy Gate Handler. Executing a manipulation can lead to improper verification of cryptographic signature. The attack can be executed remotely. It is advisable to upgrade...

PT-2026-104647

Name of the Vulnerable Software and Affected Versions gopay versions prior to 1.5.119 Description The software disables TLS certificate verification within the defaultClient function located in pkg/xhttp/client.go. This flaw allows man-in-the-middle attackers to impersonate payment provider APIs ...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature through OpenPGPCertificate.getApplyingSubpacket in org.bouncycastle.openpgp.api. An attacker can make a genuine signature from a victim’s signing subkey validate under an...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature through OpenPGPCertificate.getApplyingSubpacket in org.bouncycastle.openpgp.api. An attacker can make a genuine signature from a victim’s signing subkey validate under an...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature through OpenPGPCertificate.getApplyingSubpacket in org.bouncycastle.openpgp.api. An attacker can make a genuine signature from a victim’s signing subkey validate under an...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature through OpenPGPCertificate.getApplyingSubpacket in org.bouncycastle.openpgp.api. An attacker can make a genuine signature from a victim’s signing subkey validate under an...

Improper Verification of Cryptographic Signature

Overview org.bouncycastle:bcprov-jdk15to18 is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the BLS12381BasicScheme.keyValidate path in BLS12381BasicScheme.java. An attacker can be accept...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the BLS12381BasicScheme.keyValidate path in BLS12381BasicScheme.java. An attacker can be accepted as a signer in BLS aggregate verification by supplying an ECPoint built on a...