CVE-2026-114401

Trudesk through 1.2.11 contains a regular expression injection vulnerability that allows unauthenticated attackers to enumerate usernames by submitting regex patterns to POST /api/v1/login. Attackers can send alternations or prefixes like admin|root or a. and distinguish 'Invalid User' from...

EUVD-2026-107248

Trudesk through 1.2.11 contains a regular expression injection vulnerability that allows unauthenticated attackers to enumerate usernames by submitting regex patterns to POST /api/v1/login. Attackers can send alternations or prefixes like admin|root or a. and distinguish 'Invalid User' from...

PT-2026-120588

Trudesk through 1.2.11 contains a regular expression injection vulnerability that allows unauthenticated attackers to enumerate usernames by submitting regex patterns to POST /api/v1/login. Attackers can send alternations or prefixes like admin|root or a. and distinguish 'Invalid User' from...

Chris Trudesk: Vulnerability in input validation

Chris Trudesk versions 1.2.11 and earlier have a vulnerability in input validation. This vulnerability stems from regular expression injection: unvalidated attackers can submit regular expression patterns to the POST /api/v1/login endpoint. By distinguishing the responses for invalid usernames an...

CVE-2026-11922

A vulnerability in zenml-io/zenml versions 0.57.0 through 0.94.2 allows an attacker to bypass rate-limiting on the "POST /api/v1/login" and self password-change endpoints by rotating the "X-Forwarded-For" header. The rate limiter keys requests by "request.client.host", which is derived from the...