Exploit for CVE-2026-18963

CVE-2026-18963 — Keycloak reset-credentials bypass → unauthent...

CVE-2026-72843

EverShop 's updateCustomer route (packages/evershop/src/modules/customer/api/updateCustomer/route.json) is declared "access": "public", so the admin auth middleware calls next() without verifying the caller and no session guard protects the route. The handler in updateCustomer.js loads a customer...

EUVD-2026-44820

Qinglong has an incomplete fix for CVE-2026-3965: Improper Authentication...

Qinglong has an incomplete fix for CVE-2026-3965: Improper Authentication

Summary The init guard middleware in Qinglong only checks /api/user/init paths but not /open/user/init, which is whitelisted from JWT authentication and rewritten to /api/user/init after the guard has already passed, allowing unauthenticated admin credential reset on initialized instances. Affect...

GHSA-V667-GC2R-2XM7 Qinglong has an incomplete fix for CVE-2026-3965: Improper Authentication

Summary The init guard middleware in Qinglong only checks /api/user/init paths but not /open/user/init, which is whitelisted from JWT authentication and rewritten to /api/user/init after the guard has already passed, allowing unauthenticated admin credential reset on initialized instances. Affect...

CVE-2026-69183

Monkeytype (a typing test application) versions 26.26.0 and earlier contain a rate-limit bypass in the backend key generator (backend/src/middlewares/rate-limit.ts). The generator prioritizes client-controlled cf-connecting-ip and x-forwarded-for headers over the trust-proxy-derived req.ip, allow...

WordPress Chama plugin < 1.0.13 - Unauthenticated Arbitrary User Password Reset vulnerability

Unauthenticated Arbitrary User Password Reset vulnerability discovered by moonge in WordPress Plugin ChamaWP versions 1.0.13...

PT-2026-80746

Summary MyAccountController::postAccountInfoForm allows an authenticated user to update the authentication column default: email without verifying their current password. Because email is the account-recovery anchor, this enables account takeover after the attacker's session ends: the new email...

Keycloak 26.4.x < 26.4.15 / 26.6.x < 26.6.6 Unauthenticated Account Takeover

The version of Keycloak installed on the remote host is 26.4.x prior to 26.4.15, or 26.6.x prior to 26.6.6. It is, therefore, affected by a vulnerability: - A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access...

CVE-2026-76377

CVE-2026-76377 affects the Azure AD Graph app for Splunk SOAR in versions below 2.5.3 . The root cause is that the temp_password parameter in the reset password action is not marked as a password field, causing it to be displayed in cleartext in the Splunk SOAR user interface. Any user with a rol...

CVE-2026-53547

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the POST /database/export endpoint creates a user export that includes the global settings table even though the rest of the export is user-scoped. The settings table...

CVE-2026-53547 Termix: Account Takeover via Global Settings Disclosure

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the POST /database/export endpoint creates a user export that includes the global settings table even though the rest of the export is user-scoped. The settings table...

CVE-2026-53547 Termix: Account Takeover via Global Settings Disclosure

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the POST /database/export endpoint creates a user export that includes the global settings table even though the rest of the export is user-scoped. The settings table...

CVE-2026-53547

A low-privileged authenticated user on Termix (prior to 2.3.2) can call POST /database/export to retrieve a global settings table containing reset_code_ and temp_reset_token_ artifacts for other accounts, enabling account takeover and admin compromise via the normal password-reset flow. Upgrade t...

EUVD-2026-62856

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the POST /database/export endpoint creates a user export that includes the global settings table even though the rest of the export is user-scoped. The settings table...

CVE-2026-53547 Termix: Account Takeover via Global Settings Disclosure

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the POST /database/export endpoint creates a user export that includes the global settings table even though the rest of the export is user-scoped. The settings table...

CVE-2026-49976

Snipe-IT is an IT asset/license management system. Prior to 8.6.1, a user with the import permission can use CSV update mode to overwrite the email address of a non-admin user and then request a password reset to take over that account. app/Importer/UserImporter.php applies the canEditAuthFields...

CVE-2026-50550 Snipe-IT: 2FA reset privilege bypass

Snipe-IT is an IT asset/license management system. Prior to 8.5.0, a user who can edit other users can reset a superadmin's two-factor authentication through app/Http/Controllers/Api/UsersController.php postTwoFactorReset. The endpoint authorizes update access but does not enforce canEditAuthFiel...

CVE-2026-50550

CVE-2026-50550 is a missing authorization vulnerability in Snipe-IT , an IT asset and license management system built on Laravel, affecting versions prior to 8.5.0 . The postTwoFactorReset() endpoint in app/Http/Controllers/Api/UsersController.php checks for general update access but fails to enf...

CVE-2026-49976 Snipe-IT: User Account Escalation via CSV Import

Snipe-IT is an IT asset/license management system. Prior to 8.6.1, a user with the import permission can use CSV update mode to overwrite the email address of a non-admin user and then request a password reset to take over that account. app/Importer/UserImporter.php applies the canEditAuthFields...