GHSA-JHH7-832H-F8HV WPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user existence + profile (defeats explicit anti-enumeration design)

Summary The sendPasswordResetEmail mutation in WPGraphQL is explicitly designed to prevent user enumeration. The resolver in src/Mutation/SendPasswordResetEmail.php states in a code comment: // We obsfucate the actual success of this mutation to prevent user enumeration. The mutation always retur...

WPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user existence + profile (defeats explicit anti-enumeration design)

Summary The sendPasswordResetEmail mutation in WPGraphQL is explicitly designed to prevent user enumeration. The resolver in src/Mutation/SendPasswordResetEmail.php states in a code comment: // We obsfucate the actual success of this mutation to prevent user enumeration. The mutation always retur...

CVE-2026-14919

The ShopMonitor.io WordPress plugin before 1.2.0 does not properly restrict its email-rerouting test mode, gating it behind a trusted-source check that is satisfiable with client-supplied request headers, allowing unauthenticated attackers to redirect outgoing emails, including the WordPress...

CVE-2026-14919

The vulnerability CVE-2026-14919 affects the ShopMonitor.io WordPress plugin prior to 1.2.0. The plugin’s email-rerouting test mode is inadequately restricted by a trusted-source check that can be satisfied with client-supplied request headers, enabling unauthenticated attackers to redirect outgo...

CVE-2026-14919 ShopMonitor.io < 1.2.0 - Unauthenticated Administrator Account Takeover via Password-Reset Email Reroute

The ShopMonitor.io WordPress plugin before 1.2.0 does not properly restrict its email-rerouting test mode, gating it behind a trusted-source check that is satisfiable with client-supplied request headers, allowing unauthenticated attackers to redirect outgoing emails, including the WordPress...

PT-2026-66871

Name of the Vulnerable Software and Affected Versions WPGraphQL versions 2.0.0 through 2.15.0 Description An unauthenticated caller can distinguish existing author-class accounts and obtain public profile fields through the sendPasswordResetEmail mutation. While the mutation is designed to preven...

CVE-2026-67594

Spikster through commit e1cdf8c contains a missing authentication vulnerability that allows unauthenticated remote attackers to access all API routes by exploiting the unattached CipiAuth middleware, which is registered but never applied to any route in the API routing configuration. Attackers ca...

CVE-2026-67594

Summary (CVE-2026-67594): Spikster (commit e1cdf8c) contains a missing authentication flaw in the API route group due to the CipiAuth middleware being registered but never applied. This allows unauthenticated remote attackers to access approximately 50 API endpoints, enabling enumeration and prov...

CVE-2026-67594 Spikster Missing Authentication via API Route Group

Spikster through commit e1cdf8c contains a missing authentication vulnerability that allows unauthenticated remote attackers to access all API routes by exploiting the unattached CipiAuth middleware, which is registered but never applied to any route in the API routing configuration. Attackers ca...

SUSE CVE-2026-55077

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the PUT /api/v2/users/user/password endpoint authorized only ActionUpdatePersonal and did not prevent a user-admin from resetting an owner account's passwor...

CVE-2026-18363

A logic vulnerability in the password reset token validation routine implemented by osTicket in versions prior to v1.17.8 and v1.18.4. During the password reset process, the application retrieves the timestamp associated with the provided token and checks whether the configured validity period ha...

CVE-2026-18363

osTicket suffers a logic flaw in its password reset flow: for versions &lt; v1.17.8 and

CVE-2026-18363

A logic vulnerability in the password reset token validation routine implemented by osTicket in versions prior to v1.17.8 and v1.18.4. During the password reset process, the application retrieves the timestamp associated with the provided token and checks whether the configured validity period ha...

EUVD-2026-51068

A logic vulnerability in the password reset token validation routine implemented by osTicket in versions prior to v1.17.8 and v1.18.4. During the password reset process, the application retrieves the timestamp associated with the provided token and checks whether the configured validity period ha...

CVE-2026-18363 Weak password recovery mechanism in osTicket by Enhancesoft LLC

A logic vulnerability in the password reset token validation routine implemented by osTicket in versions prior to v1.17.8 and v1.18.4. During the password reset process, the application retrieves the timestamp associated with the provided token and checks whether the configured validity period ha...

CVE-2026-64635

CVE-2026-64635 affects Veeam Service Provider Console. An improper handling of the returnUrl parameter in Forgot Password enables an unauthenticated attacker to hijack the password-reset link domain, causing the reset code to be sent to an attacker-controlled host and potentially take over the us...

EUVD-2026-51018

Improper handling of the returnUrl parameter in the Forgot Password function of Veeam Service Provider Console allows an unauthenticated attacker to control the domain of the generated password reset link. When the targeted user clicks the link delivered by email, the reset code is transmitted to...

PT-2026-66575

Name of the Vulnerable Software and Affected Versions Spikster versions prior to commit e1cdf8c Description A missing authentication flaw allows unauthenticated remote attackers to access all API routes. This occurs because the CipiAuth middleware is registered but not applied to any route within...

CVE-2026-65887

Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox 2.20.2 - The resetPassword method allows actors to reset any user password, allowing to login and act as these users - excluding super admins...

CVE-2026-65887 Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox < 2.20.2

Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox 2.20.2 - The resetPassword method allows actors to reset any user password, allowing to login and act as these users - excluding super admins...