The vulnerability of the iavf_reset_task() function in the drivers/net/ethernet/intel/iavf/iavf_main.c file of the Intel Ethernet network adapter driver for the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the iavfresettask function in the drivers/net/ethernet/intel/iavf/iavfmain.c file of the Intel Ethernet network adapter driver for the Linux operating system is related to the improper shutdown or release of resources. Exploiting this vulnerability could allow an attacker to...

Vulnerability of the kszphy_config_reset() function in the drivers/net/phy/micrel.c module – A network physical layer PHY driver for the Linux operating system, which allows a hacker to cause a service failure

Vulnerability of the kszphyconfigReset function in the drivers/net/phy/micrel.c module – The Linux physical layer network driver relies on the assignment of the NULL pointer. Exploiting this vulnerability could allow an attacker to cause a service failure...

PT-2026-23723

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.3.7 Description Snipe-IT instances running versions prior to 8.3.7 are susceptible to unauthorized modification of user account details due to insufficient protection of sensitive user attributes against mass...

Internet Routing Registry Daemon 授权问题漏洞

The Internet Routing Registry Daemon IRRd is a routing registry daemon. Versions of IRRd from 4.4.0 to 4.4.5 and from 4.5.0 to 4.5.1 had an authorization issue. This issue stemmed from the ability for attackers to manipulate the HTTP Host header in password reset or account creation requests,...

PT-2026-23705

Name of the Vulnerable Software and Affected Versions ServerZilla version 1.0 Description ServerZilla version 1.0 contains an SQL injection issue that allows unauthenticated attackers to manipulate database queries. Attackers can send POST requests to the ''reset.php'' endpoint with malicious...

CVE-2026-21622

Insufficient Session Expiration vulnerability in hexpm hexpm/hexpm 'Elixir.Hexpm.Accounts.PasswordReset' module allows Account Takeover. Password reset tokens generated via the "Reset your password" flow do not expire. When a user requests a password reset, Hex sends an email containing a reset...

EUVD-2025-208327

A host header injection vulnerability in the mailer component of @perfood/couch-auth v0.26.0 allows attackers to obtain reset tokens and execute an account takeover via spoofing the HTTP Host header...

HTTP Header Injection

Overview @perfood/couch-auth is an Easy and secure authentication for CouchDB/Cloudant. Based on SuperLogin, updated and rewritten in Typescript. Affected versions of this package are vulnerable to HTTP Header Injection via the mailer component. An attacker can gain unauthorized access to reset...

GHSA-QW8V-34WW-6Q9P @perfood/couch-auth has a host header injection vulnerability

A host header injection vulnerability in the mailer component of @perfood/couch-auth v0.26.0 allows attackers to obtain reset tokens and execute an account takeover via spoofing the HTTP Host header...

EUVD-2026-9841

A broken access control vulnerability in the password reset functionality of Tata Consultancy Services Cognix Recon Client v3.0 allows authenticated users to reset passwords of arbitrary user accounts via crafted requests...

CVE-2026-21622 Password Reset Tokens Do Not Expire

Insufficient Session Expiration vulnerability in hexpm hexpm/hexpm 'Elixir.Hexpm.Accounts.PasswordReset' module allows Account Takeover. Password reset tokens generated via the "Reset your password" flow do not expire. When a user requests a password reset, Hex sends an email containing a reset...

CVE-2026-21622 Password Reset Tokens Do Not Expire

Insufficient Session Expiration vulnerability in hexpm hexpm/hexpm 'Elixir.Hexpm.Accounts.PasswordReset' module allows Account Takeover. Password reset tokens generated via the "Reset your password" flow do not expire. When a user requests a password reset, Hex sends an email containing a reset...

EUVD-2026-9876

Insufficient Session Expiration vulnerability in hexpm hexpm/hexpm 'Elixir.Hexpm.Accounts.PasswordReset' module allows Account Takeover. Password reset tokens generated via the "Reset your password" flow do not expire. When a user requests a password reset, Hex sends an email containing a reset...

CVE-2026-21622

Insufficient Session Expiration vulnerability in hexpm hexpm/hexpm 'Elixir.Hexpm.Accounts.PasswordReset' module allows Account Takeover. Password reset tokens generated via the "Reset your password" flow do not expire. When a user requests a password reset, Hex sends an email containing a reset...

CVE-2026-21622

The CVE-2026-21622 vulnerability affects hexpm (Elixir.Hexpm.Accounts.PasswordReset) where password reset tokens do not expire. The issue arises in the PasswordReset flow (lib/hexpm/accounts/password_reset.ex; Elixir.Hexpm.Accounts.PasswordReset:can_reset?/3), allowing tokens to remain valid inde...

EEF-CVE-2026-21622 Password Reset Tokens Do Not Expire

Summary Insufficient Session Expiration vulnerability in hexpm hexpm/hexpm 'Elixir.Hexpm.Accounts.PasswordReset' module allows Account Takeover. Password reset tokens generated via the "Reset your password" flow do not expire. When a user requests a password reset, Hex sends an email containing a...

CVE-2026-21622 Password Reset Tokens Do Not Expire

Insufficient Session Expiration vulnerability in hexpm hexpm/hexpm 'Elixir.Hexpm.Accounts.PasswordReset' module allows Account Takeover. Password reset tokens generated via the "Reset your password" flow do not expire. When a user requests a password reset, Hex sends an email containing a reset...

CVE-2026-26417

A broken access control vulnerability in the password reset functionality of Tata Consultancy Services Cognix Recon Client v3.0 allows authenticated users to reset passwords of arbitrary user accounts via crafted requests...

CVE-2026-26417

A broken access control vulnerability in the password reset functionality of Tata Consultancy Services Cognix Recon Client v3.0 allows authenticated users to reset passwords of arbitrary user accounts via crafted requests...

EUVD-2025-208295

Suprema’s BioStar 2 in version 2.9.11.6 allows users to set new password without providing the current one. Exploiting this flaw combined with other vulnerabilities can lead to unauthorized account access and potential system compromise...