EUVD-2026-95994

Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access...

CVE-2026-43926

FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, the password reset confirmation endpoint /client/reset-password-confirm/:hash is handled by a non-API controller and is not covered by FOSSBilling's rate limiter, which only applies to /api/ routes...