Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 673

Export CSV
CVE-2026-26747

Host Header Poisoning in Monica 4.1.2 Enables Phished Password Reset Links

A Host Header Poisoning vulnerability exists in Monica 4.1.2 due to improper handling of the HTTP Host header in app/Providers/AppServiceProvider.php, combined with the default misconfiguration where the "app.force_url" is not set and default is "false". The application generates absolute URLs (such as those used in password reset emails) using the user-supplied Host header. This allows remote attackers to poison the password reset link sent to a victim,

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Monicahq
Products
Monica
CVE-2026-2895

funadmin Member.php repass password recovery

A security flaw has been discovered in funadmin up to 7.1.0-rc4. Affected by this issue is the function repass of the file app/frontend/controller/Member.php. Performing a manipulation of the argument forget_code/vercode results in weak password recovery. Remote exploitation of the attack is possible. The attack's complexity is rated as high. The exploitation is known to be difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Funadmin
Products
Funadmin
CVE-2026-1325

Sangfor Operation and Maintenance Security Management System edit_pwd_mall password recovery

A security flaw has been discovered in Sangfor Operation and Maintenance Security Management System up to 3.0.12. This affects the function edit_pwd_mall of the file /fort/login/edit_pwd_mall. The manipulation of the argument flag results in weak password recovery. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Sangfor
Products
Operation And Maintenance Security Management System
CVE-2026-22922

Apache Airflow: Airflow externalLogUrl Permission Bypass

Apache Airflow versions 3.1.0 through 3.1.6 contain an authorization flaw that can allow an authenticated user with custom permissions limited to task access to view task logs without having task log access. Users are recommended to upgrade to Apache Airflow 3.1.7 or later, which resolves this issue.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Airflow
CVE-2026-24343

Apache HertzBeat: Uncontrolled Resource Consumption via Crafted XPath Expressions

Improper Neutralization of Data within XPath Expressions ('XPath Injection') vulnerability in Apache HertzBeat. This issue affects Apache HertzBeat: from 1.7.1 before 1.8.0. Users are recommended to upgrade to version 1.8.0, which fixes the issue.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Hertzbeat
CVE-2026-26273

Known affected by Account Takeover via Password Reset Token Leakage

Known is a social publishing platform. Prior to 1.6.3, a Critical Broken Authentication vulnerability exists in Known 1.6.2 and earlier. The application leaks the password reset token within a hidden HTML input field on the password reset page. This allows any unauthenticated attacker to retrieve the reset token for any user by simply querying the user's email, leading to full Account Takeover (ATO) without requiring access to the victim's email inbox. This vulnerability is fixed in 1.6.3.

CVSS 3.0 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Idno Withknown
Products
Known Known
CVE-2026-2564

Intelbras VIP 3260 Z IA OutsideCmd password recovery

A security flaw has been discovered in Intelbras VIP 3260 Z IA 2.840.00IB005.0.T. Affected by this vulnerability is an unknown functionality of the file /OutsideCmd. The manipulation results in weak password recovery. It is possible to launch the attack remotely. Attacks of this nature are highly complex. The exploitation appears to be difficult. It is recommended to upgrade the affected component.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Intelbras
Products
Vip 3260 Z Ia
CVE-2026-28268

Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse

Vikunja is an open-source self-hosted task management platform. Versions prior to 2.1.0 have a business logic vulnerability exists in the password reset mechanism of vikunja/api that allows password reset tokens to be reused indefinitely. Due to a failure to invalidate tokens upon use and a critical logic bug in the token cleanup cron job, reset tokens remain valid forever. This allows an attacker who intercepts a single reset token (via logs, browser history, or phishing) to perform a complete, persistent account takeover at any point in the future, bypassing standard authentication controls. Version 2.1.0 contains a patch for the issue.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Go-vikunja Vikunja
Products
Vikunja Vikunja
CVE-2026-33707

Weak Password Recovery Mechanism for Forgotten Password in chamilo/chamilo-lms

Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, the default password reset mechanism generates tokens using sha1($email) with no random component, no expiration, and no rate limiting. An attacker who knows a user's email can compute the reset token and change the victim's password without authentication. This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3.

CVSS 3.1 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Chamilo
Products
Chamilo Lms
CVE-2026-26234

JUNG Smart Visu Server - Improper Neutralization of HTTP Headers for Scripting Syntax

JUNG Smart Visu Server 1.1.1050 contains a request header manipulation vulnerability that allows unauthenticated attackers to override request URLs by injecting arbitrary values in the X-Forwarded-Host header. Attackers can manipulate proxied requests to generate tainted responses, enabling cache poisoning, potential phishing, and redirecting users to malicious domains.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Albrecht Jung Jung-group
Products
Jung Smart Visu Server Smart Visu Server Smart Visu Server Firmware
CVE-2026-27593

Statamic is vulnerable to account takeover via password reset link injection

Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 6.3.3 and 5.73.10, an attacker may leverage a vulnerability in the password reset feature to capture a user's token and reset the password on their behalf. The attacker must know the email address of a valid account on the site, and the actual user must blindly click the link in their email even though they didn't request the reset. This has been fixed in 6.3.3 and 5.73.10.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Statamic
Products
Cms Statamic
CVE-2026-1698

HTTP Host header vulnerability in WebClient and WebScheduler web apps

A HTTP Host header attack vulnerability affects WebClient and the WebScheduler web apps of PcVue in version 15.0.0 through 16.3.3 included, allowing a remote attacker to inject harmful payloads that manipulate server-side behavior. This vulnerability only affects the endpoints /Authentication/ExternalLogin, /Authentication/AuthorizationCodeCallback and /Authentication/Logout of the WebClient and WebScheduler web apps.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Arcinfo
Products
Pcvue
CVE-2026-28213

EverShop Vulnerable to Arbitrary Customer Account Takeover via Exposure of Password Reset Token in API Response

EverShop is a TypeScript-first eCommerce platform. Versions prior to 2.1.1 have a vulnerability in the "Forgot Password" functionality. When specifying a target email address, the API response returns the password reset token. This allows an attacker to take over the associated account. Version 2.1.1 fixes the issue.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Evershop
Products
Evershop
CVE-2026-25907

Overly Restrictive Account Lockout Mechanism Causing Denial of Service in Dell PowerScale OneFS

Dell PowerScale OneFS, version 9.13.0.0, contains an overly restrictive account lockout mechanism vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to denial of service.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Dell
Products
Powerscale Onefs
CVE-2026-35625

OpenClaw < 2026.3.25 - Privilege Escalation via Silent Local Shared-Auth Reconnect

OpenClaw before 2026.3.25 contains a privilege escalation vulnerability where silent local shared-auth reconnects auto-approve scope-upgrade requests, widening paired device permissions from operator.read to operator.admin. Attackers can exploit this by triggering local reconnection to silently escalate privileges and achieve remote code execution on the node.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Openclaw
Products
Openclaw
CVE-2026-35645

OpenClaw < 2026.3.25 - Privilege Escalation via Synthetic operator.admin in deleteSession

OpenClaw before 2026.3.25 contains a privilege escalation vulnerability in the gateway plugin subagent fallback deleteSession function that uses a synthetic operator.admin runtime scope. Attackers can exploit this by triggering session deletion without a request-scoped client to execute privileged operations with unintended administrative scope.

CVSS 4.0 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Openclaw
Products
Openclaw
CVE-2026-20126

Cisco Catalyst SD-WAN Manager Privilege Escalation Vulnerability

A vulnerability in Cisco Catalyst SD-WAN Manager could allow an authenticated, local attacker with low privileges to gain root privileges on the underlying operating system. This vulnerability is due to an insufficient user authentication mechanism in the REST API. An attacker could exploit this vulnerability by sending a request to the REST API of the affected system. A successful exploit could allow the attacker to&nbsp;gain root privileges on the underlying operating system.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Cisco
Products
Catalyst Sd-wan Manager
CVE-2026-25858

macrozheng mall <= 1.0.3 Unauthenticated Password Reset via OTP Disclosure

macrozheng mall version 1.0.3 and prior contains an authentication vulnerability in the mall-portal password reset workflow that allows an unauthenticated attacker to reset arbitrary user account passwords using only a victim’s telephone number. The password reset flow exposes the one-time password (OTP) directly in the API response and validates password reset requests solely by comparing the provided OTP to a value stored by telephone number, without verifying user identity or ownership of the telephone number. This enables remote account takeover of any user with a known or guessable telephone number.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Macrozheng Newbee-mall Project
Products
Mall Newbee-mall
CVE-2026-35639

OpenClaw < 2026.3.22 - Privilege Escalation via device.pair.approve Scope Validation

OpenClaw before 2026.3.22 contains a privilege escalation vulnerability in the device.pair.approve method that allows an operator.pairing approver to approve pending device requests with broader operator scopes than the approver actually holds. Attackers can exploit insufficient scope validation to escalate privileges to operator.admin and achieve remote code execution on the Node infrastructure.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Openclaw
Products
Openclaw
CVE-2026-34751

Payload has Unvalidated Input in Password Recovery Endpoints

Payload is a free and open source headless content management system. Prior to version 3.79.1 in @payloadcms/graphql and payload, a vulnerability in the password recovery flow could allow an unauthenticated attacker to perform actions on behalf of a user who initiates a password reset. This issue has been patched in version 3.79.1 for @payloadcms/graphql and payload.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Payloadcms
Products
Payload