9767 matches found
CVE-2026-18963
A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the...
EUVD-2026-61063
A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the...
CVE-2026-18963
A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the...
SUSE CVE-2026-15689
Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset link poisoning via the request Host header in defaultemailpasswordreset and defaultwelcomesend. Both default emails emit a link of the form $base/login/$code, whose authority comes from the request Host header,...
PT-2026-77216
Name of the Vulnerable Software and Affected Versions Keycloak versions prior to 26.7.2 Red Hat Build of Keycloak versions 26.4.x prior to 26.4.15 Red Hat Build of Keycloak versions 26.6.x prior to 26.6.6 Description A flaw exists in the reset-credentials flow of the keycloak-services component d...
CVE-2026-75103
Crawlab fails to verify user ownership or administrative role on the password-change endpoint, allowing any authenticated user to reset any account's password. Attackers can enumerate user accounts through the user listing endpoint and change administrator credentials to achieve full account...
CVE-2026-75103 Crawlab Missing Authorization on Password Change Endpoint Allows Account Takeover
Crawlab fails to verify user ownership or administrative role on the password-change endpoint, allowing any authenticated user to reset any account's password. Attackers can enumerate user accounts through the user listing endpoint and change administrator credentials to achieve full account...
CVE-2026-50772
An issue in Squirro Cognitive Search 3.14.2 allows a remote attacker to execute arbitrary code via a crafted payload to the password reset function...
CVE-2026-19965
A vulnerability was determined in automad up to 2.0.0-beta.32. This vulnerability affects the function requestPasswordResetToken of the file automad/src/server/Controllers/API/UserController.php of the component Password Reset Endpoint. This manipulation of the argument name-or-email causes...
CVE-2026-19965 automad Password Reset Endpoint UserController.php requestPasswordResetToken response discrepancy
A vulnerability was determined in automad up to 2.0.0-beta.32. This vulnerability affects the function requestPasswordResetToken of the file automad/src/server/Controllers/API/UserController.php of the component Password Reset Endpoint. This manipulation of the argument name-or-email causes...
CVE-2026-19965 automad Password Reset Endpoint UserController.php requestPasswordResetToken response discrepancy
A vulnerability was determined in automad up to 2.0.0-beta.32. This vulnerability affects the function requestPasswordResetToken of the file automad/src/server/Controllers/API/UserController.php of the component Password Reset Endpoint. This manipulation of the argument name-or-email causes...
CVE-2026-19965
The CVE-2026-19965 affects automad up to version 2.0.0-beta.32. It targets the Password Reset Endpoint’s requestPasswordResetToken in automad/src/server/Controllers/API/UserController.php, where manipulation of the name-or-email argument causes observable response discrepancies. The issue can be ...
EUVD-2026-60010
A vulnerability was determined in automad up to 2.0.0-beta.32. This vulnerability affects the function requestPasswordResetToken of the file automad/src/server/Controllers/API/UserController.php of the component Password Reset Endpoint. This manipulation of the argument name-or-email causes...
CVE-2026-19965 automad Password Reset Endpoint UserController.php requestPasswordResetToken response discrepancy
A vulnerability was determined in automad up to 2.0.0-beta.32. This vulnerability affects the function requestPasswordResetToken of the file automad/src/server/Controllers/API/UserController.php of the component Password Reset Endpoint. This manipulation of the argument name-or-email causes...
CVE-2026-50772: Improper Control of Generation of Code
An issue in Squirro Cognitive Search 3.14.2 allows a remote attacker to execute arbitrary code via a crafted payload to the password reset function...
PT-2026-76744
Name of the Vulnerable Software and Affected Versions Squirro Cognitive Search versions prior to 3.14.2 Description A remote attacker can execute arbitrary code by sending a crafted payload to the password reset function. Recommendations Update Squirro Cognitive Search to version 3.14.2 or later...
CVE-2026-50772
An issue in Squirro Cognitive Search 3.14.2 allows a remote attacker to execute arbitrary code via a crafted payload to the password reset function...
CVE-2026-50772
An issue in Squirro Cognitive Search versions prior to 3.14.2 allows a remote attacker to achieve arbitrary code execution . This vulnerability is triggered by sending a crafted payload to the application's password reset function . The severity is rated as CRITICAL (CVSS 9.8) due to the potentia...