ROS-20260914-73-0080

The vulnerability of the Paint component in Google Chrome and Microsoft Edge browsers relates to the ability to bypass authentication by using a user-controlled password. Exploiting this vulnerability allows an attacker to manipulate data integrity through a specially created HTML page...

ROS-20260914-73-0034

The vulnerability of the Password Manager component in Google Chrome and Microsoft Edge is related to a lack of mechanisms for verifying the source of the data. Exploiting this vulnerability could allow an attacker to gain access to confidential data through a specially created HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-72709

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SPIP before version 4.4.18 contains a missing authorization vulnerability in sensitive actions under ecrire/action/ that allows unauthenticated attackers to...

ROS-20260914-73-0101

The vulnerability of the Password component in the Google Chrome browser is related to a flaw in data protection mechanisms. Exploiting this vulnerability could allow an attacker, operating remotely, to gain access to protected information through a specially created HTML page...

ROS-20260914-73-0033

The vulnerability of the Password Manager component in Google Chrome and Microsoft Edge is related to a lack of mechanisms for verifying the source of the data. Exploiting this vulnerability could allow an attacker to gain access to confidential data through a specially created HTML page...

ROS-20260914-73-0095

The vulnerability of the Password component in Google Chrome browser is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions through a specially created HTML page...

ROS-20260914-73-0011

The vulnerability of the Password Manager component in Google Chrome and Microsoft Edge browsers is related to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to cause a service failure through a specially created HTML page...

Flowise-CVE-2025-58434-PasswordReset

CVE-2025-58434 — Restablecimiento de Contraseña No Autenticado en Flowise AI Resumen ID CVE: CVE-2025-58434 Software Afectado: Flowise AI Versiones Vulnerables: = 3.0.5 Versión Corregida: 3.0.6 y posteriores Gravedad: Crítica Autor: r3nsi15 Fecha: 2025 Descripción Las versiones de Flowise AI hast...

CVE-2026-90522

A vulnerability was determined in jaychouchannel Tourism-Management-System up to d984d172dceca907f8b447efbdb06dc233f7938d. Impacted is the function resetPass of the file UsersController.java of the component Password Recovery. This manipulation causes weak password recovery. The attack can be...

CVE-2026-90522

CVE-2026-90522 affects the jaychouchannel Tourism-Management-System (up to commit d984d172). The vulnerability resides in the resetPass function of UsersControllers.java within the Password Recovery component, resulting in a weak password recovery mechanism. The flaw is remotely exploitable with ...

CVE-2026-90522 jaychouchannel Tourism-Management-System Password Recovery UsersController.java resetPass password recovery

A vulnerability was determined in jaychouchannel Tourism-Management-System up to d984d172dceca907f8b447efbdb06dc233f7938d. Impacted is the function resetPass of the file UsersController.java of the component Password Recovery. This manipulation causes weak password recovery. The attack can be...

CVE-2026-90522 jaychouchannel Tourism-Management-System Password Recovery UsersController.java resetPass password recovery

A vulnerability was determined in jaychouchannel Tourism-Management-System up to d984d172dceca907f8b447efbdb06dc233f7938d. Impacted is the function resetPass of the file UsersController.java of the component Password Recovery. This manipulation causes weak password recovery. The attack can be...

EUVD-2026-77020

A vulnerability was determined in jaychouchannel Tourism-Management-System up to d984d172dceca907f8b447efbdb06dc233f7938d. Impacted is the function resetPass of the file UsersController.java of the component Password Recovery. This manipulation causes weak password recovery. The attack can be...

CVE-2026-90522 jaychouchannel Tourism-Management-System Password Recovery UsersController.java resetPass password recovery

A vulnerability was determined in jaychouchannel Tourism-Management-System up to d984d172dceca907f8b447efbdb06dc233f7938d. Impacted is the function resetPass of the file UsersController.java of the component Password Recovery. This manipulation causes weak password recovery. The attack can be...

CVE-2026-90562

LangBot before 4.10.11 generates password recovery keys with only 24 bits of entropy and applies no rate limiting to the unauthenticated reset-password endpoint. Remote attackers knowing the administrator email can exhaust the keyspace through concurrent requests to reset the admin password and...

CVE-2026-90562 LangBot before 4.10.11 Authentication Bypass via Weak Recovery Key

LangBot before 4.10.11 generates password recovery keys with only 24 bits of entropy and applies no rate limiting to the unauthenticated reset-password endpoint. Remote attackers knowing the administrator email can exhaust the keyspace through concurrent requests to reset the admin password and...

CVE-2026-90562 LangBot before 4.10.11 Authentication Bypass via Weak Recovery Key

LangBot before 4.10.11 generates password recovery keys with only 24 bits of entropy and applies no rate limiting to the unauthenticated reset-password endpoint. Remote attackers knowing the administrator email can exhaust the keyspace through concurrent requests to reset the admin password and...

EUVD-2026-76987

LangBot before 4.10.11 generates password recovery keys with only 24 bits of entropy and applies no rate limiting to the unauthenticated reset-password endpoint. Remote attackers knowing the administrator email can exhaust the keyspace through concurrent requests to reset the admin password and...

CVE-2026-90562 LangBot before 4.10.11 Authentication Bypass via Weak Recovery Key

LangBot before 4.10.11 generates password recovery keys with only 24 bits of entropy and applies no rate limiting to the unauthenticated reset-password endpoint. Remote attackers knowing the administrator email can exhaust the keyspace through concurrent requests to reset the admin password and...

CVE-2026-90501

A security vulnerability has been detected in lenve vhr 1.0-SNAPSHOT. This issue affects the function HrInfoController.updateHr of the file HrMapper.xml. Such manipulation of the argument Password leads to improper privilege management. The attack may be performed from remote. The exploit has bee...