•32 minutes ago•CVE-2026-11746
9.4CVE-2026-11746: Use of Hard-coded ZooKeeper Replication Secret 'ch4n63m3' in Central Dogma Server
CVE-2026-11746 is a critical vulnerability in Central Dogma Server prior to version 0.84.0, where an embedded ZooKeeper replication secret silently falls back to a publicly known, hard-coded default string ('ch4n63m3'). Remote attackers with access to the replication network can authenticate as legitimate cluster peers, potentially leading to unauthorized data exposure, state manipulation, or complete cluster takeover.
0 views•6 min read
•about 2 hours ago•CVE-2026-56665
4.2CVE-2026-56665: Logical Validation Bypass in ZITADEL External JWT Identity Provider
A logical verification flaw in ZITADEL's external JWT Identity Provider validation allows attackers to bypass session expiration checks. If an incoming JWT lacks the 'exp' claim, the system skips validation entirely, creating an indefinitely valid session. This issue has been addressed in versions 3.4.12 and 4.15.2.
1 views•7 min read
•about 3 hours ago•CVE-2026-59149
6.5CVE-2026-59149: Sibling Directory Path Traversal in Mockoon Backend Server
CVE-2026-59149 identifies a directory traversal vulnerability in `@mockoon/commons-server`, the backend mock-server library powering the Mockoon application. The flaw occurs in the path containment validation logic used during raw file response generation. An unauthenticated attacker can exploit this weakness to retrieve arbitrary files from sibling directories sharing a common prefix with the designated static base directory.
3 views•5 min read
•about 4 hours ago•CVE-2026-59148
8.8CVE-2026-59148: Unauthenticated Administrative API and CORS Misconfiguration in Mockoon
An in-depth analysis of CVE-2026-59148, a high-severity flaw in Mockoon where unauthenticated administrative endpoints and a wildcard Cross-Origin Resource Sharing (CORS) policy allow remote execution, state poisoning, and credential theft.
4 views•6 min read
•about 5 hours ago•CVE-2026-56666
4.8CVE-2026-56666: Account Takeover via Improper Email Verification in ZITADEL Federated Identity Handler
An improper authentication vulnerability (CWE-287) in ZITADEL's external identity provider handler before version 4.15.3 allows remote attackers to perform complete account takeover. When auto-linking by email is enabled, ZITADEL verifies that the local target account has a verified email address but fails to verify if the external provider confirmed ownership of that same email. Attackers can exploit this by registering an unverified account with a victim's email address on a permissive external provider, leading to unauthorized account binding and persistent access.
2 views•7 min read
•about 6 hours ago•CVE-2026-59151
9.6CVE-2026-59151: Cross-Tenant Account Takeover via Improper SAML Assertion Validation in Prowler
A critical authentication bypass and cross-tenant account takeover vulnerability exists in the Prowler cloud security platform due to improper validation of the SAML Assertion Consumer Service (ACS) flow. An authenticated attacker controlling a custom Identity Provider (IdP) can forge assertions targeting arbitrary user identities across distinct tenants, allowing complete unauthorized access to target tenant-scoped resources.
3 views•6 min read
•about 7 hours ago•CVE-2026-11745
8.8CVE-2026-11745: Host Key Verification Bypass in Central Dogma Git Mirror SSH Client
An issue was identified in Central Dogma prior to version 0.84.0. The Git mirror SSH client does not verify remote host keys for git+ssh:// connections, which allows an on-path attacker to execute man-in-the-middle attacks and compromise mirrored repositories.
2 views•7 min read
•about 12 hours ago•CVE-2026-87014
6.5CVE-2026-87014: Session Desynchronization and Privilege Persistence in Open WebUI
Open WebUI from version 0.9.0 to 0.11.1 is vulnerable to a state desynchronization and privilege persistence flaw. When an administrator is demoted to a standard user via Single Sign-On (SSO) role synchronization, the local database is updated, but their active Socket.IO connection is not invalidated. Because the WebSocket handlers authorize operations using the cached role in the socket context, the demoted user retains administrative read and write access to all collaborative notes.
4 views•7 min read
•about 13 hours ago•CVE-2026-87013
4.3CVE-2026-87013: Denial of Service via Cyclic Folder Structures in Open WebUI
An authenticated denial of service vulnerability exists in Open WebUI versions 0.10.0 through 0.11.0. An attacker can update a folder's parent identifier to establish cyclic folder references, causing recursive tree-walking operations to execute infinitely, leading to CPU exhaustion and localized application denial of service.
2 views•6 min read
•about 14 hours ago•CVE-2026-87012
4.3CVE-2026-87012: Instance-Wide Denial of Service via Calendar Alert Metadata Type Confusion in Open WebUI
Open WebUI is a self-hosted AI platform. Versions 0.9.0 through 0.11.0 contain a denial-of-service vulnerability where an authenticated user can inject non-numeric values into calendar event alert metadata. The shared scheduler process fails to validate the type, leading to an unhandled TypeError that halts the execution of instance-wide alerts, suppressing notifications for all users.
2 views•5 min read
•about 15 hours ago•CVE-2026-87011
7.5CVE-2026-87011: Denial of Service via Event-Loop Starvation in Open WebUI OIDC Back-Channel Logout
CVE-2026-87011 is a critical vulnerability in Open WebUI versions 0.9.0 through 0.11.0. It allows unauthenticated remote attackers to trigger a Denial of Service (DoS) by sending crafted tokens to the back-channel logout endpoint, causing synchronous network calls that block the single-worker ASGI event loop.
3 views•8 min read
•about 16 hours ago•CVE-2026-88045
7.5CVE-2026-88045: Denial of Service via Uncontrolled Memory Preallocation and Integer Overflow in rclone S3 Compatibility Layer
A high-severity Denial of Service (DoS) vulnerability in the S3 compatibility layer of rclone allows unauthenticated remote attackers (or authenticated attackers depending on configuration) to trigger rapid memory exhaustion and process termination. The flaw lies in the handling of S3 multipart uploads, where rclone eagerly allocates buffers based on untrusted size headers and fails to prevent integer overflows in its concurrent request admission control.
3 views•7 min read