CVE-2026-82269 Gophish Account Lockout and Forced Password Change Bypassable via API Key

Gophish through 0.12.1 fails to enforce account lockout and password change requirements in the API authentication middleware. Attackers with valid API keys can bypass these security controls and retain full API access even when their account is locked or password change is required...

ALPINE-CVE-2026-42393

The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service, able to make repeated requests and measure response timing accurately, can learn the length of...

AZL-98310 CVE-2026-42393 affecting package dovecot 2.3.20-1

The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service, able to make repeated requests and measure response timing accurately, can learn the length of...

CVE-2026-42393

The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service, able to make repeated requests and measure response timing accurately, can learn the length of...

CVE-2026-42393

The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service, able to make repeated requests and measure response timing accurately, can learn the length of...

CVE-2026-42393

CVE-2026-42393 affects the doveadm service in Open-Xchange's Dovecot implementation. The password and API key comparison is not fully timing-safe, allowing a network-adjacent attacker who can make repeated requests and accurately measure response times to learn the length of the configured secret...

CVE-2026-42393

The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service, able to make repeated requests and measure response timing accurately, can learn the length of...

EUVD-2026-67676

The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service, able to make repeated requests and measure response timing accurately, can learn the length of...

CVE-2026-42393

The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service, able to make repeated requests and measure response timing accurately, can learn the length of...

CVE-2026-42393

The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service, able to make repeated requests and measure response timing accurately, can learn the length of...

CVE-2026-42393: Exposure of Sensitive Information to an Unauthorized Actor

The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service, able to make repeated requests and measure response timing accurately, can learn the length of...

UBUNTU-CVE-2026-42393

The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service, able to make repeated requests and measure response timing accurately, can learn the length of...

PT-2026-83293

Portkey AI Gateway through 1.15.2 contains a server-side request forgery vulnerability in the /v1/proxy/ route that lacks requestValidator middleware. Attackers can set the x-portkey-custom-host header to internal addresses and forward requests with Authorization headers to reach internal service...

PT-2026-83302

HyperDX through 1.10.1 fails to enforce role-based access controls in team management endpoints, allowing any team member to perform administrative actions. Attackers can delete team members including owners, rotate API keys, and rename teams by sending requests to PATCH /team/apiKey, PATCH...

PT-2026-83069

Name of the Vulnerable Software and Affected Versions dovecot versions prior to 2.4.5-1.1 Description The comparison process for the doveadm password and API key is not fully timing safe. This allows an attacker on the same network as the doveadm service to determine the length of the configured...

WordPress AI Engine plugin < 3.6.4 - Editor+ Sensitive Information Disclosure of API Key and Bearer Tokens vulnerability

Editor+ Sensitive Information Disclosure of API Key and Bearer Tokens vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin AI Engine versions 3.6.4...

WordPress WP Directory Kit plugin < 1.5.5 - Subscriber+ Plugin Settings and API Key Disclosure vulnerability

Subscriber+ Plugin Settings and API Key Disclosure vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin WP Directory Kit versions 1.5.5...

CVE-2026-81027

one-api gates one of its two channel-pinning paths and not the other. middleware/auth.go permits a request to name a specific channel either through a suffix on the API key or through a URL path parameter. The suffix path is reached only after model.IsAdmin succeeds and otherwise rejects the...

CVE-2026-81027 one-api through 0.6.10 Missing Authorization on URL-Parameter Channel Pinning

one-api gates one of its two channel-pinning paths and not the other. middleware/auth.go permits a request to name a specific channel either through a suffix on the API key or through a URL path parameter. The suffix path is reached only after model.IsAdmin succeeds and otherwise rejects the...

CVE-2026-80204

The Grav API plugin getgrav/grav-plugin-api before 1.0.18 does not apply the API-key scope cap in the injectSecurityTab function of BlueprintController when deciding whether a page's security/permissions blueprint section is editable. Because the function performs raw isSuperAdmin/hasPermission...