CVE-2026-50641

Streamsoft Business Intelligence BI stores users' passwords in plaintext form in the database This issue was fixed in version 6.8.0.0, users were also requested to change their password on the first login...

CVE-2026-50641 Plaintext password storage in Streamsoft Business Intelligence

Streamsoft Business Intelligence BI stores users' passwords in plaintext form in the database This issue was fixed in version 6.8.0.0, users were also requested to change their password on the first login...

Linux Distros Unpatched Vulnerability : CVE-2026-58216

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An out-of-bounds read flaw was found in Samba's Kerberos Key Distribution Center's KDC password change kpasswd service. When processing malformed ASN.1-encoded...

Security Bulletin: Unauthenticated User Could Gain Remote Access to TS3100/TS3200 (CVE-2016-9005)

Summary IBM TS3100/TS3200 Tape Library could allow an unauthenticated user, with access to the company network, to change a user's password and gain remote access to the system. Vulnerability Details CVEID:CVE-2016-9005 DESCRIPTION: IBM TS3100-TS3200 Tape Library could allow an unauthenticated...

CVE-2026-15962 Fluent Forms Pro Add On Pack <= 6.2.6 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary User Password Change via User Meta Field

The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.2.6 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The...

CVE-2026-15962

The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.2.6 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The...

EUVD-2026-49047

The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.2.6 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The...

Authentication Bypass by Assumed-Immutable Data

Overview Affected versions of this package are vulnerable to Authentication Bypass by Assumed-Immutable Data in the password change process when the stored password remains at its default value and the submitted password is not verified. An attacker can gain unauthorized access and set a new...

CVE-2026-12981

The CAFEHAUS API WordPress plugin through 1.0.0 does not have any authentication or authorisation when updating user passwords, allowing unauthenticated attackers to set the password of any user, including administrators, and fully take over their accounts...

CVE-2026-11922

A vulnerability in zenml-io/zenml versions 0.57.0 through 0.94.2 allows an attacker to bypass rate-limiting on the POST /api/v1/login and self password-change endpoints by rotating the X-Forwarded-For header. The rate limiter keys requests by request.client.host, which is derived from the...

CVE-2026-11922

The CVE-2026-11922 entry describes a rate-limit bypass in zenml-io/zenml (versions 0.57.0–0.94.2). The issue arises because the rate limiter uses request.client.host (derived from the X-Forwarded-For header when Uvicorn is run with --proxy-headers --forwarded-allow-ips *), allowing an attacker to...

EUVD-2026-48467

A vulnerability in zenml-io/zenml versions 0.57.0 through 0.94.2 allows an attacker to bypass rate-limiting on the POST /api/v1/login and self password-change endpoints by rotating the X-Forwarded-For header. The rate limiter keys requests by request.client.host, which is derived from the...

CVE-2026-11922 Rate-limit Bypass in zenml-io/zenml

A vulnerability in zenml-io/zenml versions 0.57.0 through 0.94.2 allows an attacker to bypass rate-limiting on the POST /api/v1/login and self password-change endpoints by rotating the X-Forwarded-For header. The rate limiter keys requests by request.client.host, which is derived from the...

CVE-2026-11922

A vulnerability in zenml-io/zenml versions 0.57.0 through 0.94.2 allows an attacker to bypass rate-limiting on the POST /api/v1/login and self password-change endpoints by rotating the X-Forwarded-For header. The rate limiter keys requests by request.client.host, which is derived from the...

PT-2026-64225

A vulnerability in zenml-io/zenml versions 0.57.0 through 0.94.2 allows an attacker to bypass rate-limiting on the POST /api/v1/login and self password-change endpoints by rotating the X-Forwarded-For header. The rate limiter keys requests by request.client.host, which is derived from the...

VulnCheck KEV: CVE-2025-62631

An insufficient session expiration vulnerability CWE-613 vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions allows attacker to maintain access to network resources via an active SSLVPN session not terminated after a user's passwor...

CVE-2026-12692

Unverified password change vulnerability in Vimesoft Inc. Enterprise Video Platform allows Authentication Bypass. This issue affects Enterprise Video Platform: from 3.11.0.0 before 3.25.0...

CVE-2026-12692 Improper Authentication in Vimesoft's Enterprise Video Platform

Unverified password change vulnerability in Vimesoft Inc. Enterprise Video Platform allows Authentication Bypass. This issue affects Enterprise Video Platform: from 3.11.0.0 before 3.25.0...

CVE-2026-12692 Improper Authentication in Vimesoft's Enterprise Video Platform

Unverified password change vulnerability in Vimesoft Inc. Enterprise Video Platform allows Authentication Bypass. This issue affects Enterprise Video Platform: from 3.11.0.0 before 3.25.0...

CVE-2026-12692

CVE-2026-12692 affects Vimesoft Inc. Enterprise Video Platform (EVP) versions prior to 3.25.0, with EVP 3.11.0.0 and above being affected. The issue is described as an unverified password change vulnerability that enables authentication bypass. The available documents do not provide details on th...