EUVD-2026-76987

LangBot before 4.10.11 generates password recovery keys with only 24 bits of entropy and applies no rate limiting to the unauthenticated reset-password endpoint. Remote attackers knowing the administrator email can exhaust the keyspace through concurrent requests to reset the admin password and...

PT-2026-90833

CVE-2026-90562 isn't a prompt injection zero-day. it's a password reset bug straight out of the OWASP Top 10 circa 2005, wearing an "agentic AI" badge. LangBot orchestrates LLM agents across Discord, Telegram, Slack bridges. the CVE lets an attacker hit the password reset endpoint and walk straig...