•about 3 hours ago•CVE-2026-61534
9.1CVE-2026-61534: Prototype Pollution in confetti yayson JSON:API Deserialization Engine
A critical prototype pollution vulnerability was discovered in the confetti yayson library prior to version 4.3.0. The library deserializes JSON:API structures into internal cache dictionaries mapped with standard JavaScript objects. An attacker can control the cache keys by supplying '__proto__' in properties like type or id, modifying the prototype of all JavaScript objects process-wide.
3 views•7 min read
•3 days ago•CVE-2026-11748
6.9CVE-2026-11748: Unauthenticated LDAP Injection in Central Dogma Server Authentication
An LDAP injection vulnerability exists in the centraldogma-server-auth-shiro module of LY Corporation Central Dogma before version 0.84.0. The search logic dynamically constructs LDAP search filters by interpolating user-provided usernames without escaping RFC 4515 metacharacters. Unauthenticated remote attackers can leverage this flaw to bypass authentication, enumerate directory hierarchies, and access unauthorized resources.
13 views•6 min read
•3 days ago•CVE-2026-11746
9.4CVE-2026-11746: Use of Hard-coded ZooKeeper Replication Secret 'ch4n63m3' in Central Dogma Server
CVE-2026-11746 is a critical vulnerability in Central Dogma Server prior to version 0.84.0, where an embedded ZooKeeper replication secret silently falls back to a publicly known, hard-coded default string ('ch4n63m3'). Remote attackers with access to the replication network can authenticate as legitimate cluster peers, potentially leading to unauthorized data exposure, state manipulation, or complete cluster takeover.
10 views•6 min read
•3 days ago•CVE-2026-56665
4.2CVE-2026-56665: Logical Validation Bypass in ZITADEL External JWT Identity Provider
A logical verification flaw in ZITADEL's external JWT Identity Provider validation allows attackers to bypass session expiration checks. If an incoming JWT lacks the 'exp' claim, the system skips validation entirely, creating an indefinitely valid session. This issue has been addressed in versions 3.4.12 and 4.15.2.
11 views•7 min read
•3 days ago•CVE-2026-59149
6.5CVE-2026-59149: Sibling Directory Path Traversal in Mockoon Backend Server
CVE-2026-59149 identifies a directory traversal vulnerability in `@mockoon/commons-server`, the backend mock-server library powering the Mockoon application. The flaw occurs in the path containment validation logic used during raw file response generation. An unauthenticated attacker can exploit this weakness to retrieve arbitrary files from sibling directories sharing a common prefix with the designated static base directory.
16 views•5 min read
•3 days ago•CVE-2026-59148
8.8CVE-2026-59148: Unauthenticated Administrative API and CORS Misconfiguration in Mockoon
An in-depth analysis of CVE-2026-59148, a high-severity flaw in Mockoon where unauthenticated administrative endpoints and a wildcard Cross-Origin Resource Sharing (CORS) policy allow remote execution, state poisoning, and credential theft.
16 views•6 min read
•3 days ago•CVE-2026-56666
4.8CVE-2026-56666: Account Takeover via Improper Email Verification in ZITADEL Federated Identity Handler
An improper authentication vulnerability (CWE-287) in ZITADEL's external identity provider handler before version 4.15.3 allows remote attackers to perform complete account takeover. When auto-linking by email is enabled, ZITADEL verifies that the local target account has a verified email address but fails to verify if the external provider confirmed ownership of that same email. Attackers can exploit this by registering an unverified account with a victim's email address on a permissive external provider, leading to unauthorized account binding and persistent access.
10 views•7 min read
•3 days ago•CVE-2026-59151
9.6CVE-2026-59151: Cross-Tenant Account Takeover via Improper SAML Assertion Validation in Prowler
A critical authentication bypass and cross-tenant account takeover vulnerability exists in the Prowler cloud security platform due to improper validation of the SAML Assertion Consumer Service (ACS) flow. An authenticated attacker controlling a custom Identity Provider (IdP) can forge assertions targeting arbitrary user identities across distinct tenants, allowing complete unauthorized access to target tenant-scoped resources.
19 views•6 min read
•3 days ago•CVE-2026-11745
8.8CVE-2026-11745: Host Key Verification Bypass in Central Dogma Git Mirror SSH Client
An issue was identified in Central Dogma prior to version 0.84.0. The Git mirror SSH client does not verify remote host keys for git+ssh:// connections, which allows an on-path attacker to execute man-in-the-middle attacks and compromise mirrored repositories.
15 views•7 min read
•3 days ago•CVE-2026-87014
6.5CVE-2026-87014: Session Desynchronization and Privilege Persistence in Open WebUI
Open WebUI from version 0.9.0 to 0.11.1 is vulnerable to a state desynchronization and privilege persistence flaw. When an administrator is demoted to a standard user via Single Sign-On (SSO) role synchronization, the local database is updated, but their active Socket.IO connection is not invalidated. Because the WebSocket handlers authorize operations using the cached role in the socket context, the demoted user retains administrative read and write access to all collaborative notes.
11 views•7 min read
•3 days ago•CVE-2026-87013
4.3CVE-2026-87013: Denial of Service via Cyclic Folder Structures in Open WebUI
An authenticated denial of service vulnerability exists in Open WebUI versions 0.10.0 through 0.11.0. An attacker can update a folder's parent identifier to establish cyclic folder references, causing recursive tree-walking operations to execute infinitely, leading to CPU exhaustion and localized application denial of service.
11 views•6 min read
•3 days ago•CVE-2026-87012
4.3CVE-2026-87012: Instance-Wide Denial of Service via Calendar Alert Metadata Type Confusion in Open WebUI
Open WebUI is a self-hosted AI platform. Versions 0.9.0 through 0.11.0 contain a denial-of-service vulnerability where an authenticated user can inject non-numeric values into calendar event alert metadata. The shared scheduler process fails to validate the type, leading to an unhandled TypeError that halts the execution of instance-wide alerts, suppressing notifications for all users.
13 views•5 min read