🚨 CVE-2026-105156
A weakness has been identified in YzmCMS up to 7.6. Impacted is the function Password of the file /common/function/system.func.php of the component MD5 Handler. Executing a manipulation of the argument pass can lead to password hash with insufficient computational effort. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is considered difficult. The exploit has been made available to the public and could be used for attacks. The vendor kindly explains: "Our regular release cycle is about 6 months. The last release was in the previous month, and our next scheduled version will be released in March 2027. We will implement the backward-compatible gradual hash migration feature in this upcoming release. (...) Before the new version is available, we will publish security mitigation guidance on our official documentation for existing deployers to reduce the risk."
🎖@cveNotify
A weakness has been identified in YzmCMS up to 7.6. Impacted is the function Password of the file /common/function/system.func.php of the component MD5 Handler. Executing a manipulation of the argument pass can lead to password hash with insufficient computational effort. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is considered difficult. The exploit has been made available to the public and could be used for attacks. The vendor kindly explains: "Our regular release cycle is about 6 months. The last release was in the previous month, and our next scheduled version will be released in March 2027. We will implement the backward-compatible gradual hash migration feature in this upcoming release. (...) Before the new version is available, we will publish security mitigation guidance on our official documentation for existing deployers to reduce the risk."
🎖@cveNotify
GitHub
YzmCMS V7.6 Weak Password Hashing · Issue #6 · Witiers/CVEs
NAME OF AFFECTED PRODUCT(S) YzmCMS V7.6 Vendor Homepage https://www.yzmcms.com AFFECTED AND/OR FIXED VERSION(S) submitter Witiers Vulnerable File /common/function/system.func.php (the password() fu...
❤1
🚨 CVE-2026-105157
A security vulnerability has been detected in RainyGao DocSys up to 2.02.85. The affected element is the function DocController.doGetTmp of the file /Doc/doGetTmpFile.do of the component Document Controller. The manipulation of the argument path/fileName leads to path traversal. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
🎖@cveNotify
A security vulnerability has been detected in RainyGao DocSys up to 2.02.85. The affected element is the function DocController.doGetTmp of the file /Doc/doGetTmpFile.do of the component Document Controller. The manipulation of the argument path/fileName leads to path traversal. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
🎖@cveNotify
Gitee
Rainy/DocSys: MxsDoc是内置了 AI智能体 和 Office引擎 的文档管理软件，支持文档分级/分类/版本管理、Office预览/编辑、WPS预览/编辑、在线解压缩、在线视频播放、文件分享、文件加密、远程存储、远程推送、智能搜索、在线…
🚨 CVE-2026-105158
A vulnerability was detected in RainyGao DocSys up to 2.02.85. The impacted element is the function BaseController.createDBForMysql of the file BaseController.java of the component Database Management. The manipulation of the argument url results in sql injection. The attack can be executed remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
🎖@cveNotify
A vulnerability was detected in RainyGao DocSys up to 2.02.85. The impacted element is the function BaseController.createDBForMysql of the file BaseController.java of the component Database Management. The manipulation of the argument url results in sql injection. The attack can be executed remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
🎖@cveNotify
Gitee
Rainy/DocSys: MxsDoc是内置了 AI智能体 和 Office引擎 的文档管理软件，支持文档分级/分类/版本管理、Office预览/编辑、WPS预览/编辑、在线解压缩、在线视频播放、文件分享、文件加密、远程存储、远程推送、智能搜索、在线…
🚨 CVE-2026-105205
SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish-mode readers to learn backlink block IDs and reference counts from password-protected and publish-disabled documents by querying a published document. Attackers can send POST requests to /api/block/getDocInfo or getDocsInfo for a published document ID to obtain refIDs and refCount of hidden referencing blocks, bypassing the publish confidentiality boundary.
🎖@cveNotify
SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish-mode readers to learn backlink block IDs and reference counts from password-protected and publish-disabled documents by querying a published document. Attackers can send POST requests to /api/block/getDocInfo or getDocsInfo for a published document ID to obtain refIDs and refCount of hidden referencing blocks, bypassing the publish confidentiality boundary.
🎖@cveNotify
GitHub
Publish readers learn backlink block IDs and reference counts of password-protected and publish-disabled documents via /api/block/getDocInfo…
## Summary
`POST /api/block/getDocInfo` and `POST /api/block/getDocsInfo` are registered with `model.CheckAuth` only (no `CheckReadonly`/`CheckAdminRole`), so a publish-mode reader (RoleReader JWT...
`POST /api/block/getDocInfo` and `POST /api/block/getDocsInfo` are registered with `model.CheckAuth` only (no `CheckReadonly`/`CheckAdminRole`), so a publish-mode reader (RoleReader JWT...
🚨 CVE-2026-105206
ZITADEL 3.0.0 through 3.4.15 and 4.x before 4.17.3 contains an incorrect authorization flaw in the User Service API, which verifies user.read against the caller's organization rather than the organization owning the target user. An authenticated member holding org-scoped user.read can query GET /v2/users/{userId}/authentication_methods to learn which authentication method types users in other organizations have registered.
🎖@cveNotify
ZITADEL 3.0.0 through 3.4.15 and 4.x before 4.17.3 contains an incorrect authorization flaw in the User Service API, which verifies user.read against the caller's organization rather than the organization owning the target user. An authenticated member holding org-scoped user.read can query GET /v2/users/{userId}/authentication_methods to learn which authentication method types users in other organizations have registered.
🎖@cveNotify
GitHub
Cross-Organization Authentication Method Enumeration
### Summary
ZITADEL’s **User Service** API allowed an authenticated organization member who holds `user.read` in one organization to learn which authentication methods are configured for a user ...
ZITADEL’s **User Service** API allowed an authenticated organization member who holds `user.read` in one organization to learn which authentication methods are configured for a user ...
🚨 CVE-2026-105207
ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user accounts and external identity providers without verifying a primary factor or the caller's permission, including on identify-only Login V2 sessions and via the User Service V2 AddIDPLink endpoint. An unauthenticated attacker knowing a victim's login name can bind their own external IdP identity to the victim's account and then sign in as the victim.
🎖@cveNotify
ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user accounts and external identity providers without verifying a primary factor or the caller's permission, including on identify-only Login V2 sessions and via the User Service V2 AddIDPLink endpoint. An unauthenticated attacker knowing a victim's login name can bind their own external IdP identity to the victim's account and then sign in as the victim.
🎖@cveNotify
GitHub
Unauthenticated Account Takeover Through External Identity Provider with Account Manual Linking enabled
### Summary
ZITADEL established links between user accounts and external identity providers without verifying that the requester was entitled to create the link. The hosted **Login V2** UI accepte...
ZITADEL established links between user accounts and external identity providers without verifying that the requester was entitled to create the link. The hosted **Login V2** UI accepte...
🚨 CVE-2026-105208
ZITADEL 4.x before 4.17.3 and 3.x through 3.4.15 protects IdP intent tokens with unauthenticated, malleable encryption, allowing authenticated users to tamper with their own token so it is accepted for another user's external login intent. An attacker who predicts a victim's in-flight intent identifier and wins a timing race can call /v2/idp_intents or /v2/sessions to steal the victim's IdP tokens or hijack their session.
🎖@cveNotify
ZITADEL 4.x before 4.17.3 and 3.x through 3.4.15 protects IdP intent tokens with unauthenticated, malleable encryption, allowing authenticated users to tamper with their own token so it is accepted for another user's external login intent. An attacker who predicts a victim's in-flight intent identifier and wins a timing race can call /v2/idp_intents or /v2/sessions to steal the victim's IdP tokens or hijack their session.
🎖@cveNotify
GitHub
Cross-user session hijacking and external IdP token theft via forgeable IdP intent tokens
### Summary
ZITADEL issues an **IdP intent** token to the login UI after a user completes a login with an external identity provider (IdP). The login UI presents this token, together with the in...
ZITADEL issues an **IdP intent** token to the login UI after a user completes a login with an external identity provider (IdP). The login UI presents this token, together with the in...
🚨 CVE-2026-105209
ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnerability: when issuing passkey or passwordless enrollment codes, it checks only the organization in the x-zitadel-orgid header, not the target user's organization. Attackers with user-write permission in one organization can obtain an enrollment code for a user in another organization on the same instance and register their own authenticator to take over that account.
🎖@cveNotify
ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnerability: when issuing passkey or passwordless enrollment codes, it checks only the organization in the x-zitadel-orgid header, not the target user's organization. Attackers with user-write permission in one organization can obtain an enrollment code for a user in another organization on the same instance and register their own authenticator to take over that account.
🎖@cveNotify
GitHub
Improper authorization when issuing passkey and passwordless enrollment codes (cross-organization account takeover)
### Summary
ZITADEL lets an administrator start passkey or passwordless enrollment for another user by issuing a one-time enrollment link (or code). When that link was requested, ZITADEL did not...
ZITADEL lets an administrator start passkey or passwordless enrollment for another user by issuing a one-time enrollment link (or code). When that link was requested, ZITADEL did not...
🚨 CVE-2026-105210
ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose second-factor enrollment and initialization handlers act on an identify-only session before any primary factor is verified. Attackers knowing only a victim's login name can enroll attacker-controlled TOTP, OTP-SMS, OTP-Email, or U2F factors, overwrite the verified phone number, and enumerate users through discrepant errors.
🎖@cveNotify
ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose second-factor enrollment and initialization handlers act on an identify-only session before any primary factor is verified. Attackers knowing only a victim's login name can enroll attacker-controlled TOTP, OTP-SMS, OTP-Email, or U2F factors, overwrite the verified phone number, and enumerate users through discrepant errors.
🎖@cveNotify
GitHub
Login V1: unauthenticated MFA enrollment and phone-number overwrite via ungated init handlers
### Summary
ZITADEL’s hosted **Login V1** UI allowed an unauthenticated attacker who knows only a victim’s login name to enroll attacker-controlled second factors on the victim’s account and to ...
ZITADEL’s hosted **Login V1** UI allowed an unauthenticated attacker who knows only a victim’s login name to enroll attacker-controlled second factors on the victim’s account and to ...
🚨 CVE-2026-105211
ZITADEL before 4.17.1 contains an authentication bypass vulnerability in Login V2 that allows unauthenticated attackers to take over accounts by obtaining OTP codes via the returnCode delivery type. Attackers knowing a login name of a victim with OTP-Email and OTP-SMS enrolled can read both codes from server-action responses to gain MFA-authenticated sessions, including administrator takeover.
🎖@cveNotify
ZITADEL before 4.17.1 contains an authentication bypass vulnerability in Login V2 that allows unauthenticated attackers to take over accounts by obtaining OTP codes via the returnCode delivery type. Attackers knowing a login name of a victim with OTP-Email and OTP-SMS enrolled can read both codes from server-action responses to gain MFA-authenticated sessions, including administrator takeover.
🎖@cveNotify
GitHub
Unauthenticated account takeover via OTP-Email and OTP-SMS return-code bypass in Login V2
### Summary
ZITADEL’s hosted **Login V2** UI allowed an unauthenticated attacker who knows only a victim’s login name to obtain a fully MFA-authenticated session for that victim — without any pa...
ZITADEL’s hosted **Login V2** UI allowed an unauthenticated attacker who knows only a victim’s login name to obtain a fully MFA-authenticated session for that victim — without any pa...
🚨 CVE-2026-105212
ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 and Login V2 UIs that accepts passkey or other authenticator enrollment on identify-only login sessions, before any primary factor is verified. Unauthenticated attackers knowing only a victim's login name can register an attacker-controlled authenticator and log in as that user, bypassing existing passwords and MFA.
🎖@cveNotify
ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 and Login V2 UIs that accepts passkey or other authenticator enrollment on identify-only login sessions, before any primary factor is verified. Unauthenticated attackers knowing only a victim's login name can register an attacker-controlled authenticator and log in as that user, bypassing existing passwords and MFA.
🎖@cveNotify
GitHub
Unauthenticated account takeover via passkey enrollment on Login V1 and Login V2
### Summary
ZITADEL’s hosted login UIs allowed an unauthenticated attacker who knows only a victim’s login name to register an attacker-controlled passkey (or other authenticator) on the victim’...
ZITADEL’s hosted login UIs allowed an unauthenticated attacker who knows only a victim’s login name to register an attacker-controlled passkey (or other authenticator) on the victim’...
🚨 CVE-2026-105213
ZITADEL 4.x before 4.17.1 does not check an organization's inactive state during Login V2 authentication, verifying only the individual user's status. Users of a deactivated organization who hold valid credentials, an existing session, or a refresh token can still sign in, create sessions, and obtain or refresh tokens.
🎖@cveNotify
ZITADEL 4.x before 4.17.1 does not check an organization's inactive state during Login V2 authentication, verifying only the individual user's status. Users of a deactivated organization who hold valid credentials, an existing session, or a refresh token can still sign in, create sessions, and obtain or refresh tokens.
🎖@cveNotify
GitHub
Users in deactivated organizations can still log in with Login V2
### Summary
In ZITADEL, deactivating an organization is meant to stop its users from logging in. With Login V2 enabled, that was not always enforced. Users in a deactivated organization could st...
In ZITADEL, deactivating an organization is meant to stop its users from logging in. With Login V2 enabled, that was not always enforced. Users in a deactivated organization could st...
🚨 CVE-2026-105214
Zitadel before 4.16.2 contains a server-side request forgery vulnerability that allows attackers to make the server request internal resources through organization domain HTTP verification. The challenge fetch uses Go's default http.Get instead of the protected client, so attackers can register domains that redirect to loopback, internal, or cloud metadata addresses to scan ports and map internal networks.
🎖@cveNotify
Zitadel before 4.16.2 contains a server-side request forgery vulnerability that allows attackers to make the server request internal resources through organization domain HTTP verification. The challenge fetch uses Go's default http.Get instead of the protected client, so attackers can register domains that redirect to loopback, internal, or cloud metadata addresses to scan ports and map internal networks.
🎖@cveNotify
GitHub
Server-Side Request Forgery (SSRF) in Organization Domain HTTP Verification
### Summary
A Server-Side Request Forgery (SSRF) vulnerability was discovered in Zitadel affecting:
- **Organization Domain HTTP Verification:** Verifies organization domain ownership by fetc...
A Server-Side Request Forgery (SSRF) vulnerability was discovered in Zitadel affecting:
- **Organization Domain HTTP Verification:** Verifies organization domain ownership by fetc...
🚨 CVE-2026-105215
ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 UI because the 'external account not found' registration endpoint trusts client-supplied external identity fields without a completed IdP callback. Unauthenticated attackers can submit forged IDPConfigID and ExternalUserID values to pre-create an account bound to a victim's external IdP identity, which the victim's later genuine external login then signs into.
🎖@cveNotify
ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 UI because the 'external account not found' registration endpoint trusts client-supplied external identity fields without a completed IdP callback. Unauthenticated attackers can submit forged IDPConfigID and ExternalUserID values to pre-create an account bound to a victim's external IdP identity, which the victim's later genuine external login then signs into.
🎖@cveNotify
GitHub
Unauthenticated Account Pre-Hijacking via Forged External Identity Provider Callback in Login V1
### Summary
ZITADEL’s hosted **Login V1** UI allowed an unauthenticated attacker to create a user account bound to an arbitrary external identity provider (IdP) identity without completing authe...
ZITADEL’s hosted **Login V1** UI allowed an unauthenticated attacker to create a user account bound to an arbitrary external identity provider (IdP) identity without completing authe...
🚨 CVE-2026-104470
YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows page editors to make the server fetch arbitrary URLs via the url parameter of the Bazar valeur action. Attackers can embed the action with a champ parameter in wiki markup to reach loopback or internal services and partially read responses rendered into the page.
🎖@cveNotify
YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows page editors to make the server fetch arbitrary URLs via the url parameter of the Bazar valeur action. Attackers can embed the action with a champ parameter in wiki markup to reach loopback or internal services and partially read responses rendered into the page.
🎖@cveNotify
GitHub
fix(bazar): GHSA-6rvf-7pwm-6j44 + refacto action valeur · YesWiki/yeswiki@22a5260
YesWiki is a wiki system written in PHP, including extensions making collaboration more simple (databases, maps, easy editing, bootstrap themes,...). - fix(bazar): GHSA-6rvf-7pwm-6j44 + refacto action valeur · YesWiki/yeswiki@22a5260
🚨 CVE-2026-12392
An information exposure vulnerability in Canonical MAAS prior to versions 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0 allows an unauthenticated attacker to retrieve the RPC secret in plaintext via the vendor data metadata endpoint. If a target machine was deployed with the 'register as rack' option enabled, an attacker who obtains or infers the machine's system ID can query the preseed/metadata server to leak the secret.
🎖@cveNotify
An information exposure vulnerability in Canonical MAAS prior to versions 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0 allows an unauthenticated attacker to retrieve the RPC secret in plaintext via the vendor data metadata endpoint. If a target machine was deployed with the 'register as rack' option enabled, an attacker who obtains or infers the machine's system ID can query the preseed/metadata server to leak the secret.
🎖@cveNotify
Launchpad
Bug #2153942 “RPC secret leak” : Bugs : MAAS
Describe the bug:
If the attacker can guess the system id of a machine (via bruteforce, external leaks, or by guessing the MAC address and making a TFTP request to the grub config endpoint) and the machine was deployed with the option "register as rack"…
If the attacker can guess the system id of a machine (via bruteforce, external leaks, or by guessing the MAC address and making a TFTP request to the grub config endpoint) and the machine was deployed with the option "register as rack"…
🚨 CVE-2026-88779
Vulnerability in NetScaler ADC and NetScaler Gateway.
This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282; Gateway: before 14.1-73.41 and before 13.1-64.28.
🎖@cveNotify
Vulnerability in NetScaler ADC and NetScaler Gateway.
This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282; Gateway: before 14.1-73.41 and before 13.1-64.28.
🎖@cveNotify
🚨 CVE-2026-104402
Insertion of Sensitive Information Into Sent Data vulnerability in farvisun Mindio Magic MCP mindio-magic-mcp allows Retrieve Embedded Sensitive Data.This issue affects Mindio Magic MCP: from n/a through 0.5.6.
🎖@cveNotify
Insertion of Sensitive Information Into Sent Data vulnerability in farvisun Mindio Magic MCP mindio-magic-mcp allows Retrieve Embedded Sensitive Data.This issue affects Mindio Magic MCP: from n/a through 0.5.6.
🎖@cveNotify
Patchstack
Sensitive Data Exposure in WordPress Mindio Magic MCP Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-105086
WWBN AVideo 12.4 through 29.2.0 contains a stored cross-site scripting vulnerability that allows authenticated uploaders to inject HTML by submitting doubly-encoded entities in video titles. Because safeString() strips tags before decoding entities and runs twice via setTitle() and save(), attackers can store markup that executes in trending, gallery, embed, and playlist pages.
🎖@cveNotify
WWBN AVideo 12.4 through 29.2.0 contains a stored cross-site scripting vulnerability that allows authenticated uploaders to inject HTML by submitting doubly-encoded entities in video titles. Because safeString() strips tags before decoding entities and runs twice via setTitle() and save(), attackers can store markup that executes in trending, gallery, embed, and playlist pages.
🎖@cveNotify
GitHub
fix(security): sanitize video titles and descriptions to prevent XSS … · WWBN/AVideo@c4b6ca9
…vulnerabilities
🚨 CVE-2026-105089
WWBN AVideo through 29.2.0 contains a stored cross-site scripting vulnerability that allows users with upload permission to inject script by setting a malicious video trailer1 URL. The value is rendered unescaped in YouPHPFlix2 templates and channel playlists, letting attackers break out of onclick strings or iframe src attributes to execute JavaScript in victims' browsers.
🎖@cveNotify
WWBN AVideo through 29.2.0 contains a stored cross-site scripting vulnerability that allows users with upload permission to inject script by setting a malicious video trailer1 URL. The value is rendered unescaped in YouPHPFlix2 templates and channel playlists, letting attackers break out of onclick strings or iframe src attributes to execute JavaScript in victims' browsers.
🎖@cveNotify
GitHub
fix(trailer): validate and escape trailer URLs in templates to enhanc… · WWBN/AVideo@c4adfde
…e security
🚨 CVE-2026-105224
YesWiki before 4.6.7 contains a cross-site scripting vulnerability in the Bazar valeur action that allows page editors to inject script by rendering unescaped HTML fetched from a remote URL. Attackers can point tools/bazar/actions/valeur.php at a controlled server returning BAZ_fiche_titre markup with an img onerror handler, executing script in every viewer's browser.
🎖@cveNotify
YesWiki before 4.6.7 contains a cross-site scripting vulnerability in the Bazar valeur action that allows page editors to inject script by rendering unescaped HTML fetched from a remote URL. Attackers can point tools/bazar/actions/valeur.php at a controlled server returning BAZ_fiche_titre markup with an img onerror handler, executing script in every viewer's browser.
🎖@cveNotify
GitHub
fix(bazar): GHSA-6rvf-7pwm-6j44 + refacto action valeur · YesWiki/yeswiki@22a5260
YesWiki is a wiki system written in PHP, including extensions making collaboration more simple (databases, maps, easy editing, bootstrap themes,...). - fix(bazar): GHSA-6rvf-7pwm-6j44 + refacto action valeur · YesWiki/yeswiki@22a5260