CVE-2026-32807

CVE-2026-32807 affects dataCycle-CORE prior to 25.07.3, where any user with a DataLink UUID can fetch an attached text file directly, even if expired or unauthenticated. The route is public and mailers embed the direct URL, allowing leaked or forwarded links to expose the attachment. Impact is co...

EUVD-2025-197621

Shopware 6's password recovery link does not expire after email change...

CVE-2020-27422

In Anuko Time Tracker v1.19.23.5311, the password reset link emailed to the user doesn't expire once used, allowing an attacker to use the same link to takeover the account...