go-micro versions before 6.0.0 have an improper certificate validation vulnerability where the shared TLS helper sets InsecureSkipVerify to true by default. This allows network attackers to impersonate services and perform man-in-the-middle attacks, intercepting or modifying gRPC transport, HTTP and RabbitMQ broker, and Consul or etcd registry traffic, including sensitive authentication tokens and credentials.
CVE-2026-105161 is a medium severity vulnerability in invariant-systems-ai aiir up to version 1.7.0. It involves improper verification of a cryptographic signature in the Policy Gate Handler component. The flaw can be exploited remotely without authentication. The affected product is no longer supported and its GitHub repository is unavailable.
ZITADEL versions 4.x prior to 4.17.1 do not verify whether an organization is inactive during Login V2 authentication, only checking the individual user's status. This allows users belonging to deactivated organizations who have valid credentials, existing sessions, or refresh tokens to continue signing in, creating sessions, and obtaining or refreshing tokens.
ZITADEL versions before 3.4.14 and 4.x before 4.16.2 have an authentication bypass vulnerability in the hosted Login V1 UI. The flaw arises because the 'external account not found' registration endpoint trusts client-supplied external identity fields without verifying a completed identity provider (IdP) callback. This allows unauthenticated attackers to forge IDPConfigID and ExternalUserID values to pre-create accounts linked to a victim's external IdP identity. When the victim later logs in via the genuine external IdP, they are signed into the attacker-created account.
ZITADEL versions 3.x before 3.4.14 and 4.x before 4.16.2 contain an authentication bypass vulnerability in the hosted Login V1 and Login V2 user interfaces. This flaw allows unauthenticated attackers who know a victim's login name to register an attacker-controlled authenticator during identify-only login sessions before any primary factor verification. As a result, attackers can log in as the victim without needing the victim's password or multi-factor authentication.
ZITADEL versions 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 have a vulnerability where links between user accounts and external identity providers are created without verifying a primary authentication factor or the caller's permission. This allows an unauthenticated attacker who knows a victim's login name to link their own external identity provider identity to the victim's account and subsequently sign in as that victim.
ZITADEL versions 3.x before 3.4.15 and 4.x before 4.17.1 contain an improper authorization vulnerability. The flaw occurs when issuing passkey or passwordless enrollment codes, where the system verifies only the organization in the x-zitadel-orgid header instead of the target user's organization. This allows attackers with user-write permission in one organization to obtain enrollment codes for users in other organizations on the same instance and register their own authenticators, effectively taking over those accounts.
ZITADEL versions 3.x before 3.4.15 and 4.x before 4.17.1 contain an authentication flaw in the hosted Login V1 UI. The flaw allows attackers who know only a victim's login name to enroll attacker-controlled second-factor authentication methods without verifying the primary factor. This includes enrolling TOTP, OTP-SMS, OTP-Email, or U2F factors, overwriting verified phone numbers, and enumerating users via error discrepancies.
ZITADEL versions 3.0.0 through 3.4.15 and 4.x before 4.17.3 contain an authorization flaw in the User Service API. The flaw causes the system to verify user.read permissions against the caller's organization instead of the organization owning the target user. This allows an authenticated user with org-scoped user.read permission to query authentication methods of users in other organizations via the GET /v2/users/{userId}/authentication_methods endpoint.
ZITADEL versions 4.x before 4.17.3 and 3.x through 3.4.15 use unauthenticated, malleable encryption to protect IdP intent tokens. This flaw allows authenticated users to tamper with their own tokens to impersonate another user's external login intent. An attacker who can predict a victim's in-flight intent identifier and win a timing race may steal the victim's IdP tokens or hijack their session.
Zitadel versions prior to 4.16.2 contain a server-side request forgery (SSRF) vulnerability. This flaw allows attackers to exploit the organization domain HTTP verification process to make the server request internal resources. The vulnerability arises because the challenge fetch uses Go's default http.Get method instead of a protected client, enabling attackers to register domains that redirect to loopback, internal, or cloud metadata addresses. This can be used to scan ports and map internal networks.
ZITADEL versions before 4.17.1 have an authentication bypass vulnerability in the Login V2 component. This flaw allows unauthenticated attackers to take over accounts by exploiting the returnCode delivery type to obtain OTP codes. Attackers who know a victim's login name and that the victim has OTP-Email and OTP-SMS enrolled can read both OTP codes from server responses, enabling them to gain MFA-authenticated sessions, including administrator accounts.
A path traversal vulnerability exists in RainyGao DocSys up to version 2.02.85 in the DocController.doGetTmp function. This flaw allows remote attackers with low privileges to manipulate the path/fileName argument to access unauthorized files. The vulnerability has a low CVSS score of 4.3 and no known active exploitation in the wild. The vendor has not yet responded or provided a fix.
CVE-2026-105147 is a vulnerability in SciPhi-AI R2R versions up to 3.6.6 involving hard-coded credentials in the JWT Secret Handler component. The issue arises from manipulation of the DEFAULT_BCRYPT_SECRET_KEY and DEFAULT_NACL_SECRET_KEY arguments. This vulnerability can be exploited remotely and has been publicly disclosed. The vendor has not responded to the disclosure, and no patch information is available. The CVSS score is 7.3, indicating a medium severity risk.
WWBN AVideo versions 12.4 through 29.2.0 contain a stored cross-site scripting (XSS) vulnerability. Authenticated uploaders can exploit this by submitting doubly-encoded entities in video titles, bypassing the safeString() sanitization function. This allows injection of malicious HTML that executes in various pages such as trending, gallery, embed, and playlist pages.
CVE-2026-104402 is a vulnerability in farvisun Mindio Magic MCP versions before 0.7.1 that allows insertion of sensitive information into sent data, potentially enabling retrieval of embedded sensitive data. The issue affects versions from initial releases up to 0.5.6. The vulnerability has a medium severity with a CVSS score of 4.3, indicating limited confidentiality impact and no impact on integrity or availability.
WWBN AVideo versions up to 29.2.0 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows users with upload permissions to inject malicious scripts via the video trailer URL, which is rendered without proper escaping in certain templates and playlists. Exploitation can lead to arbitrary JavaScript execution in other users' browsers.
The announcement comes after Trump hosted top executives of AI companies at the White House last week. The post Trump Names National Intelligence Director Jay Clayton to Lead a New Federal AI Task Force appeared first on SecurityWeek .
A SQL injection vulnerability exists in RainyGao DocSys up to version 2.02.85 in the BaseController.createDBForMysql function. This vulnerability allows remote attackers to manipulate the 'url' argument, potentially leading to unauthorized database access or modification. The vulnerability has a CVSS score of 7.3 (medium severity). The issue was reported early to the project, but no response or patch has been provided yet. Public exploit code is available, increasing the risk of exploitation.