CVE-2026-64822 djangoSIGE 1.10 User Enumeration via ForgotPasswordView

djangoSIGE through 1.10 commit a6fe7e8 contains a user enumeration vulnerability in ForgotPasswordView within djangosige/apps/login/views.py that allows unauthenticated attackers to identify valid accounts by observing distinct error messages returned by the password reset endpoint. Attackers can...

CVE-2026-64822

The CVE-2026-64822 entry describes a user enumeration vulnerability in djangoSIGE

CVE-2026-63913

A flaw was found in the Linux kernel's netfilter conntrack TCP state machine. A remote attacker can exploit this vulnerability by sending a specially crafted sequence of TCP Transmission Control Protocol packets, specifically a SYN synchronize packet followed by an RST reset packet with an invali...

SUSE CVE-2026-63972

In the Linux kernel, the following vulnerability has been resolved: net: mana: Skip redundant detach on already-detached port When manaperportqueueresetworkhandler runs after a previous detach succeeded but attach failed, the port is left in a detached state with apc-txqp and apc-rxqs already...

SUSE CVE-2026-64115

In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: fix UAF when peer resets connection during handshake vmcitransportrecvconnectingserver returned err = 0 for a peer RST in its default switch arm: err = pkt-type == VMCITRANSPORTPACKETTYPERST ? 0 : -EINVAL; That made...

CVE-2026-63974

A flaw was found in the Bluetooth hcisync component of the Linux kernel. When the hcidevclosesync function is called during a device reset, the system may experience queuing timeouts. This occurs because the HCICMDDRAINWORKQUEUE flag is not properly set, which can lead to system instability or a...

CVE-2026-13439

The Easy Form Builder by WhiteStudio plugin for WordPress is vulnerable to Unauthenticated Privilege Escalation to Administrator in versions up to, and including, 4.0.11 This is due to the password recovery flow using the publicly-visible session identifier 'sid' as the password reset token store...

EUVD-2026-46156

The Easy Form Builder by WhiteStudio plugin for WordPress is vulnerable to Unauthenticated Privilege Escalation to Administrator in versions up to, and including, 4.0.11 This is due to the password recovery flow using the publicly-visible session identifier 'sid' as the password reset token store...

CVE-2026-32824

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, a low-privileged authenticated API user can supply forwardToUrl and...

CVE-2026-32824 dataCycle User API Password Reset And Confirmation Flows Trust Attacker- Controlled Redirect Targets

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, a low-privileged authenticated API user can supply forwardToUrl and...

CVE-2026-32824

The CVE affects dataCycle-CORE (dataCycle data management system). Before and including version 25.07.3, a low-privileged authenticated API user could supply forwardToUrl and redirectUrl during password reset/confirmation flows, which were embedded into outgoing emails without host allowlisting. ...

CVE-2026-32824

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, a low-privileged authenticated API user can supply forwardToUrl and...

CVE-2026-12724

The Kirki WordPress plugin before 6.0.12 does not sanitise or escape the email subject and body values supplied in a request before including them in the password-reset email it sends as HTML, allowing unauthenticated users to inject arbitrary HTML into the message delivered to a registered user,...

CVE-2026-12724

The Kirki WordPress plugin before 6.0.12 does not sanitise or escape the email subject and body values supplied in a request before including them in the password-reset email it sends as HTML, allowing unauthenticated users to inject arbitrary HTML into the message delivered to a registered user,...

CVE-2026-12724 Kirki < 6.0.12 - Unauthenticated HTML Injection in Password Reset Email via kirki-forgot-password

The Kirki WordPress plugin before 6.0.12 does not sanitise or escape the email subject and body values supplied in a request before including them in the password-reset email it sends as HTML, allowing unauthenticated users to inject arbitrary HTML into the message delivered to a registered user,...

EUVD-2026-45883

The Kirki WordPress plugin before 6.0.12 does not sanitise or escape the email subject and body values supplied in a request before including them in the password-reset email it sends as HTML, allowing unauthenticated users to inject arbitrary HTML into the message delivered to a registered user,...

CVE-2026-12724

The Kirki WordPress plugin (pre-6.0.12) is affected by an HTML injection in the password-reset email: unsigned/unsanitized email subject/body values allow unauthenticated users to inject HTML into the delivered message, enabling phishing. Root cause: lack of sanitization/escaping in the password-...

CVE-2026-64115

A flaw was found in the vsock/vmci component of the Linux kernel. A remote attacker could exploit a Use-After-Free UAF vulnerability when a peer resets a connection during the handshake process. This occurs because the system incorrectly handles reset packets, leading to a pending socket being le...

Linux Distros Unpatched Vulnerability : CVE-2026-63972

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: net: mana: Skip redundant detach on already-detached port When...

CVE-2026-64147

In the Linux kernel, the following vulnerability has been resolved: pdscore: fix debugfslookup dentry leak and error handling debugfslookup returns a dentry with an elevated reference count that must be released with dput. The current code discards the returned dentry without calling dput, causin...