CVE-2026-53547

A low-privileged authenticated user on Termix (prior to 2.3.2) can call POST /database/export to retrieve a global settings table containing reset_code_ and temp_reset_token_ artifacts for other accounts, enabling account takeover and admin compromise via the normal password-reset flow. Upgrade t...

CVE-2026-49976

Snipe-IT is an IT asset/license management system. Prior to 8.6.1, a user with the import permission can use CSV update mode to overwrite the email address of a non-admin user and then request a password reset to take over that account. app/Importer/UserImporter.php applies the canEditAuthFields...

CVE-2026-49976 Snipe-IT: User Account Escalation via CSV Import

Snipe-IT is an IT asset/license management system. Prior to 8.6.1, a user with the import permission can use CSV update mode to overwrite the email address of a non-admin user and then request a password reset to take over that account. app/Importer/UserImporter.php applies the canEditAuthFields...

EUVD-2026-62443

phpMyFAQ before 4.1.7 stores password reset tokens in a publicly accessible tracking file when user tracking is enabled. Unauthenticated attackers can read the tracking file at content/core/data/trackingDDMMYYYY to extract reset tokens and replay them against the password reset API to take over...

CVE-2026-75918 phpMyFAQ before 4.1.7 Authentication Bypass via Tracking File

phpMyFAQ before 4.1.7 stores password reset tokens in a publicly accessible tracking file when user tracking is enabled. Unauthenticated attackers can read the tracking file at content/core/data/trackingDDMMYYYY to extract reset tokens and replay them against the password reset API to take over...

CVE-2026-75918

phpMyFAQ versions before 4.1.7 write password-reset tokens to the world-readable file content/core/data/trackingDDMMYYYY when user tracking is enabled; unauthenticated attackers read it and replay tokens against the reset API for account takeover. CVSS 3.1 scores 8.8 HIGH. Remediation: upgrade to...

CVE-2026-18776

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of its AJAX actions, allowing unauthenticated users to change the email address of arbitrary users, including administrators, and subsequently take over their account via the password reset flow...

CVE-2026-18776 TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Account Takeover via Multiple AJAX Actions

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of its AJAX actions, allowing unauthenticated users to change the email address of arbitrary users, including administrators, and subsequently take over their account via the password reset flow...

CVE-2026-18776

CVE-2026-18776 is a critical (CVSS 9.8) unauthenticated account takeover vulnerability in the TrueBooker Appointment Booking WordPress plugin, affecting versions prior to 1.2.7 . The root cause is missing authorization checks on certain AJAX actions , which allow any unauthenticated attacker to c...

EUVD-2026-62281

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of its AJAX actions, allowing unauthenticated users to change the email address of arbitrary users, including administrators, and subsequently take over their account via the password reset flow...

PT-2026-78571

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key leading to Account Takeover in all versions up to, and including, 1.2.6. This is due to the admin user create cus AJAX handler lacking any authenticatio...

CVE-2026-18963

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the...

CVE-2026-18963

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the...

EUVD-2026-61063

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the...

CVE-2026-18963

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the...

PT-2026-77216

Name of the Vulnerable Software and Affected Versions Red Hat Build of Keycloak affected versions not specified Description A flaw in the reset-credentials flow of the keycloak-services component allows an unauthenticated attacker to bypass the email verification requirement during the password...

CVE-2026-75103

Crawlab fails to verify user ownership or administrative role on the password-change endpoint, allowing any authenticated user to reset any account's password. Attackers can enumerate user accounts through the user listing endpoint and change administrator credentials to achieve full account...

CVE-2026-75103 Crawlab Missing Authorization on Password Change Endpoint Allows Account Takeover

Crawlab fails to verify user ownership or administrative role on the password-change endpoint, allowing any authenticated user to reset any account's password. Attackers can enumerate user accounts through the user listing endpoint and change administrator credentials to achieve full account...

CVE-2026-50772

An issue in Squirro Cognitive Search 3.14.2 allows a remote attacker to execute arbitrary code via a crafted payload to the password reset function...

CVE-2026-19965

A vulnerability was determined in automad up to 2.0.0-beta.32. This vulnerability affects the function requestPasswordResetToken of the file automad/src/server/Controllers/API/UserController.php of the component Password Reset Endpoint. This manipulation of the argument name-or-email causes...