87551 matches found
CVE-2026-84699 Team Password Manager before 14.184.308 Authentication Bypass in Password Reset
Team Password Manager before 14.184.308 fails to enforce authentication requirements in the local account password reset flow. Unauthenticated attackers can reset local account passwords and authenticate as those users to gain unauthorized access...
CVE-2026-84699
Team Password Manager before 14.184.308 fails to enforce authentication requirements in the local account password reset flow, allowing unauthenticated attackers to reset local account passwords and authenticate as those users, resulting in unauthorized access. The vulnerability is rated CVSS 3.1...
EUVD-2026-69722
WWBN AVideo fails to validate password recovery token expiration in userRecoverPassSave.json.php, allowing attackers to use expired tokens to reset account passwords indefinitely. Attackers who obtain a recovery token can use it at any time to change the target account's password and gain full...
PT-2026-84578
Name of the Vulnerable Software and Affected Versions Team Password Manager versions prior to 14.184.308 Description An issue exists where the software fails to enforce authentication requirements during the local account password reset flow. This allows unauthenticated attackers to reset local...
PT-2026-84857
UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recover the master password and decrypt vault contents by reading a retained backup key from the process memory of UpSignOn.exe, even after the vault has been re-locked. Attackers ca...
PT-2026-84603
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not verify that the requester is authorized to edit the targeted user account in the update-user action of its front-end Forms module; it only checks a capability when the submitted role is administrator or super admin. On ...
PT-2026-84608
The Gutentor WordPress plugin before 4.0.6 does not apply the correct context restriction to one of its REST endpoints, exposing the plaintext passwords of password-protected posts to any authenticated user with at least the Subscriber role...
PT-2026-84743
The vulnerability allows any authenticated user to change their own password without providing the current password or having an active elevated session. It also allows the attacker to change other users’ passwords if the attacker’s account has Edit users permission which doesn’t allow changing...
CVE-2025-8945: Incorrect Authorization
The Wp Edit Password Protected WordPress plugin before 1.3.5 allows protecting page content, but this protection can be bypassed by using the REST API...
PT-2026-84653
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The reset password.html page parses query string parameters and uses the url parameter as a redirection target via window.location = url following a password...
PT-2026-84712
The Passster WordPress plugin before 4.2.24 does not handle input properly in an AJAX action, allowing unauthenticated users to retrieve the value of password protected content...
CVE-2026-75135: Cleartext Storage of Sensitive Information in Memory
UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recover the master password and decrypt vault contents by reading a retained backup key from the process memory of UpSignOn.exe, even after the vault has been re-locked. Attackers ca...
CVE-2026-84699: Weak Password Recovery Mechanism for Forgotten Password
Team Password Manager before 14.184.308 fails to enforce authentication requirements in the local account password reset flow. Unauthenticated attackers can reset local account passwords and authenticate as those users to gain unauthorized access...
CVE-2025-15489: Incorrect Authorization
The Passster WordPress plugin before 4.2.24 does not handle input properly in an AJAX action, allowing unauthenticated users to retrieve the value of password protected content...
CVE-2026-84801: Missing Authorization
Craft CMS versions before 5.10.11 fail to validate admin status in the actionGetPasswordResetUrl endpoint, allowing non-admin users with administrateUsers permission to mint password reset URLs for administrator accounts. Attackers can generate a valid reset URL for any admin user and set a new...
CVE-2026-79989: Improper Authorization
The vulnerability allows any authenticated user to change their own password without providing the current password or having an active elevated session. It also allows the attacker to change other users’ passwords if the attacker’s account has Edit users permission which doesn’t allow changing...
CVE-2026-14828: Improper Neutralization of Special Elements used in an SQL Command
Zohocorp ManageEngine Password Manager Pro versions before 13235, PAM360 versions before 8561, and Access Manager Plus versions before 4405 are vulnerable to an authenticated SQL Injection vulnerability...
PT-2026-84645
Zohocorp ManageEngine Password Manager Pro versions before 13235, PAM360 versions before 8561, and Access Manager Plus versions before 4405 are vulnerable to an authenticated SQL Injection vulnerability...
Linux Distros Unpatched Vulnerability : CVE-2026-53683
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - resetpassword.html parses query string parameters and uses the 'url' parameter as a redirection target window.location = url after password reset, optionally...
PT-2026-84674
Craft CMS versions before 5.10.11 fail to validate admin status in the actionGetPasswordResetUrl endpoint, allowing non-admin users with administrateUsers permission to mint password reset URLs for administrator accounts. Attackers can generate a valid reset URL for any admin user and set a new...