CWE-649 (CWE-649) — 3 disclosed vulnerabilities

Records the NVD classes under CWE-649, highest CVSS first.

HIGH 7.7CVE-2026-105208public PoC2026-10-04
ZITADEL 4.x before 4.17.3 and 3.x through 3.4.15 protects IdP intent tokens with unauthenticated, malleable encryption, allowing authenticated users to tamper with their own token so it is accepted for another user's external login intent. An attacker who pred…
AI risk analysis on Exploit-DB.ai →
UNSCOREDCVE-2026-964142026-11-11
In affected versions of Octopus Server, insufficient integrity protection of authentication cookies, combined with incorrect validation of permissions assigned to a user that allowed them to view users or audit events, could result in the user escalating their…
AI risk analysis on Exploit-DB.ai →
UNSCOREDCVE-2026-95105public PoC2026-10-06
Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking vulnerability in danielberkompas cloak allows an attacker with write access to stored ciphertext to make it decrypt to a chosen value via bit flipping. Cloak.Ciphers.…
AI risk analysis on Exploit-DB.ai →