EUVD-2026-60010

A vulnerability was determined in automad up to 2.0.0-beta.32. This vulnerability affects the function requestPasswordResetToken of the file automad/src/server/Controllers/API/UserController.php of the component Password Reset Endpoint. This manipulation of the argument name-or-email causes...

CVE-2026-19965 automad Password Reset Endpoint UserController.php requestPasswordResetToken response discrepancy

A vulnerability was determined in automad up to 2.0.0-beta.32. This vulnerability affects the function requestPasswordResetToken of the file automad/src/server/Controllers/API/UserController.php of the component Password Reset Endpoint. This manipulation of the argument name-or-email causes...

CVE-2026-19965 automad Password Reset Endpoint UserController.php requestPasswordResetToken response discrepancy

A vulnerability was determined in automad up to 2.0.0-beta.32. This vulnerability affects the function requestPasswordResetToken of the file automad/src/server/Controllers/API/UserController.php of the component Password Reset Endpoint. This manipulation of the argument name-or-email causes...

EUVD-2026-60354

An issue in Squirro Cognitive Search 3.14.2 allows a remote attacker to execute arbitrary code via a crafted payload to the password reset function...

Metabase Authentication Bypass / SQL Injection

Metabase versions x.58.0 through x.63.4 contain an unauthenticated SQL injection vulnerability in the password reset functionality that can allow a remote attacker to manipulate database queries and obtain administrator access. This proof of concept exploits the vulnerable password reset endpoint...

PT-2026-76798

Name of the Vulnerable Software and Affected Versions Crawlab affected versions not specified Description An issue exists where the software fails to verify user ownership or administrative roles on the password-change endpoint. This allows any authenticated user to reset the password of any...

PT-2026-76744

Name of the Vulnerable Software and Affected Versions Squirro Cognitive Search versions prior to 3.14.2 Description A remote attacker can execute arbitrary code by sending a crafted payload to the password reset function. Recommendations Update Squirro Cognitive Search to version 3.14.2 or later...

CVE-2026-50772

An issue in Squirro Cognitive Search 3.14.2 allows a remote attacker to execute arbitrary code via a crafted payload to the password reset function...

CVE-2026-50772: Improper Control of Generation of Code

An issue in Squirro Cognitive Search 3.14.2 allows a remote attacker to execute arbitrary code via a crafted payload to the password reset function...

CVE-2026-50772

An issue in Squirro Cognitive Search 3.14.2 allows a remote attacker to execute arbitrary code via a crafted payload to the password reset function...

PT-2026-73180

A vulnerability was determined in automad up to 2.0.0-beta.32. This vulnerability affects the function requestPasswordResetToken of the file automad/src/server/Controllers/API/UserController.php of the component Password Reset Endpoint. This manipulation of the argument name-or-email causes...

CVE-2026-50772

An issue in Squirro Cognitive Search 3.14.2 allows a remote attacker to execute arbitrary code via a crafted payload to the password reset function...

CVE-2026-50772

An issue in Squirro Cognitive Search versions prior to 3.14.2 allows a remote attacker to achieve arbitrary code execution . This vulnerability is triggered by sending a crafted payload to the application's password reset function . The severity is rated as CRITICAL (CVSS 9.8) due to the potentia...

Weak Password Recovery Mechanism for Forgotten Password

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Weak Password Recovery Mechanism for Forgotten Password in the ResetCredentialEmail.action flow in...

CVE-2026-19965: Observable Response Discrepancy

A vulnerability was determined in automad up to 2.0.0-beta.32. This vulnerability affects the function requestPasswordResetToken of the file automad/src/server/Controllers/API/UserController.php of the component Password Reset Endpoint. This manipulation of the argument name-or-email causes...

CVE-2026-15689

Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset link poisoning via the request Host header in defaultemailpasswordreset and defaultwelcomesend. Both default emails emit a link of the form $base/login/$code, whose authority comes from the request Host header,...

CVE-2026-15689 Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset link poisoning via the request Host header in _default_email_password_reset and _default_welcome_send

Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset link poisoning via the request Host header in defaultemailpasswordreset and defaultwelcomesend. Both default emails emit a link of the form $base/login/$code, whose authority comes from the request Host header,...

CVE-2026-15689 Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset link poisoning via the request Host header in _default_email_password_reset and _default_welcome_send

Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset link poisoning via the request Host header in defaultemailpasswordreset and defaultwelcomesend. Both default emails emit a link of the form $base/login/$code, whose authority comes from the request Host header,...

CVE-2026-15689

Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset link poisoning via the request Host header in defaultemailpasswordreset and defaultwelcomesend. Both default emails emit a link of the form $base/login/$code, whose authority comes from the request Host header,...

CVE-2026-15689

The Dancer2::Plugin::Auth::Extensible Perl plugin (versions through 0.713 ) is vulnerable to password reset link poisoning . The issue exists in the _default_email_password_reset and _default_welcome_send functions because the application derives the link authority from the untrusted Host header ...