Craft CMS: Arbitrary user password reset leading to administrator account takeover

The vulnerability allows any authenticated user to change their own password without providing the current password or having an active elevated session. It also allows the attacker to change other users’ passwords if the attacker’s account has edit users permission which doesn’t allow changing...

MAL-2026-13468 Malicious code in xdaxx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7cd212c80bcca22443f4498afeadb70b93268b5904daa521b83242513d478bd The tarball contains a working browser-side account-takeover payload gated to run on noviembrenacional.com. When loaded in a logged-in victim's...

ResetNightmare-Python

ResetNightmare PoC CVE-2026-27912 Python/impacket re-implem...

WordPress Membership Plugin – Kadence Memberships plugin <= 4.0.0 - Unauthenticated Password Reset Link Poisoning to Account Takeover vulnerability

Unauthenticated Password Reset Link Poisoning to Account Takeover vulnerability discovered by scort in WordPress Plugin Restrict Content versions = 4.0.0...

PT-2026-70008

Уязвимость прикладного программного интерфейса сброса пароля программного средства визуализации данных и создания отчетов Metabase связана с непринятием мер по защите структуры запроса SQL. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить произвольный SQL-запро...

Use of a Key Past its Expiration Date

Overview Affected versions of this package are vulnerable to Use of a Key Past its Expiration Date via the SavePasswordController::handle process. An attacker can gain unauthorized access to user accounts by submitting expired password reset tokens directly to the reset endpoint, bypassing the...

CVE-2026-39923

Flarum before 1.8.16 contains a password reset token expiry bypass vulnerability that allows unauthenticated attackers to reuse expired password reset tokens by submitting them directly to the reset processing endpoint. The SavePasswordController::handle method calls PasswordToken::findOrFail...

CVE-2026-39924

CVE-2026-39924 affects Flarum prior to 1.8.16. The vulnerability is a session persistence issue caused by not clearing the access_tokens table on password changes, leaving attacker-held sessions active even after a victim resets a password. The TokensClearer::clearPasswordTokens() function only r...

CVE-2026-39923

Flarum before 1.8.16 contains a password reset token expiry bypass vulnerability that allows unauthenticated attackers to reuse expired password reset tokens by submitting them directly to the reset processing endpoint. The SavePasswordController::handle method calls PasswordToken::findOrFail...

CVE-2026-39923 Flarum < 1.8.16 Password Reset Token Expiry Bypass via POST /reset

Flarum before 1.8.16 contains a password reset token expiry bypass vulnerability that allows unauthenticated attackers to reuse expired password reset tokens by submitting them directly to the reset processing endpoint. The SavePasswordController::handle method calls PasswordToken::findOrFail...

EUVD-2026-53389

Flarum before 1.8.16 contains a password reset token expiry bypass vulnerability that allows unauthenticated attackers to reuse expired password reset tokens by submitting them directly to the reset processing endpoint. The SavePasswordController::handle method calls PasswordToken::findOrFail...

CVE-2026-39923

CVE-2026-39923 affects Flarum prior to 1.8.16. A password reset token expiry bypass allows unauthenticated attackers to reuse expired tokens by POSTing to the reset endpoint; SavePasswordController::handle() calls PasswordToken::findOrFail() without expiry validation, bypassing the 24-hour token ...

CVE-2026-39923 Flarum < 1.8.16 Password Reset Token Expiry Bypass via POST /reset

Flarum before 1.8.16 contains a password reset token expiry bypass vulnerability that allows unauthenticated attackers to reuse expired password reset tokens by submitting them directly to the reset processing endpoint. The SavePasswordController::handle method calls PasswordToken::findOrFail...

CVE-2026-39923 Flarum < 1.8.16 Password Reset Token Expiry Bypass via POST /reset

Flarum before 1.8.16 contains a password reset token expiry bypass vulnerability that allows unauthenticated attackers to reuse expired password reset tokens by submitting them directly to the reset processing endpoint. The SavePasswordController::handle method calls PasswordToken::findOrFail...

CVE-2026-71273

OpenBK7231T firmware exposes a CSRF flaw in the /cfg_wifi_set endpoint: configuration changes are accepted via an unauthenticated GET request without a CSRF token. If the web_admin_password_enabled parameter is omitted, an else-branch silently clears the device’s web admin password to an empty st...

CVE-2026-71238

The CVE-2026-71238 entry affects DjangoCRM where a hardcoded Django SECRET_KEY is stored in webcrm/settings.py instead of reading from the environment. This secret key is used for session signing, CSRF token generation, and password reset tokens, allowing anyone with access to the public reposito...

CVE-2026-71238

DjangoCRM ships with its Django SECRETKEY hardcoded directly in the committed webcrm/settings.py rather than read from an environment variable. Since this key is used for session signing, CSRF token generation, and password reset tokens, anyone who reads the public repository can forge valid...

CVE-2026-71238 DjangoCRM - Hardcoded Django SECRET_KEY Enables Session and CSRF Token Forgery

DjangoCRM ships with its Django SECRETKEY hardcoded directly in the committed webcrm/settings.py rather than read from an environment variable. Since this key is used for session signing, CSRF token generation, and password reset tokens, anyone who reads the public repository can forge valid...

EUVD-2026-53311

DjangoCRM ships with its Django SECRETKEY hardcoded directly in the committed webcrm/settings.py rather than read from an environment variable. Since this key is used for session signing, CSRF token generation, and password reset tokens, anyone who reads the public repository can forge valid...

CVE-2026-9273

The Membership Plugin – Kadence Memberships plugin for WordPress formerly Restrict Content is vulnerable to password reset link poisoning leading to account takeover in all versions up to, and including, 4.0.0. This is due to the legacy lost-password handler rcprocesslostpasswordform consuming th...