CVE-2026-43845

Password Reset Mechanism Bypass Enables Authentication Breach

A vulnerability in the password reset mechanism could allow an attacker to bypass the authentication mechanism.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Advantech

Products

Adam-3600

CVE-2026-112035

aircheng-org iWebShop-5 simple.php send_message_mobile password recovery

A security vulnerability has been detected in aircheng-org iWebShop-5 up to 5.16. This affects the function send_message_mobile of the file controllers/simple.php. Such manipulation of the argument user_id leads to weak password recovery. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Aircheng-org

Products

Iwebshop-5

CVE-2026-109204

LogicalDOC Community Edition through 9.3 Forced Password Reset via Unbound PswRecovery Ticket

LogicalDOC Community Edition through 9.3 contains an improper authorization vulnerability in the PswRecovery servlet that fails to bind password recovery tickets to the requesting user. Attackers can obtain a ticket for their own account and reuse it with any userId, including administrators, to reset victims' passwords, lock them out, and reveal their email addresses.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Logicaldoc

Products

Logicaldoc

CVE-2026-21138

Physical Attack Allowed Arbitrary Application Installation via Smart Switch

Insufficient verification of data authenticity in Smart Switch prior to version 3.7.73 allows physical attackers to install arbitrary applications.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Samsung

Products

Smart Switch

CVE-2026-53997

Netherman Portal del Hermano Account Takeover via Password Reset Oracle

Netherman Portal del Hermano (portaldelhermano.es) before 2026-10-06 contains a broken authentication vulnerability in its password-recovery flow at the POST /password/create-access and POST /password/email endpoints, allowing unauthenticated attackers to take over any member account across all tenants by exploiting the lack of rate limiting and distinct error messages that act as oracles for each of the four identity-verification factors (DNI, date of birth, phone number, last four IBAN digits). Attackers can confirm the DNI via the oracle, brute-force the date of birth and IBAN digits, obtain the phone number through open-source intelligence, then submit an attacker-controlled email field so the password reset link is delivered to them, enabling full account takeover including profile data, full IBAN, and fiscal documents.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Netherman

Products

Portal Del Hermano (portaldelhermano.es)

CVE-2026-100760

Sandbox escape in the Security: Process Sandboxing component

Sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-108737

Traccar through 6.16.0 Weak Password Recovery via TokenManager Token Purpose Confusion

Traccar through 6.16.0 contains a weak password recovery vulnerability that allows attackers to reuse password reset tokens as session credentials because TokenManager does not bind tokens to a purpose. Attackers holding a leaked reset link can obtain a full session via /api/session or change passwords via /api/password/update, retaining access for seven days even after the victim resets their password.

CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Traccar

Products

Traccar

CVE-2026-104678

CP Media Player < 1.3.4 - Contributor+ Media Player Settings Update

The CP Media Player WordPress plugin before 1.3.4 does not perform a capability check on its settings-page handler, allowing users with only Contributor-level access to create, modify, duplicate and delete the site-wide media player configurations and change a CP Media Player WordPress plugin before 1.3.4 option that should require administrator access.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Cp Media Player

CVE-2026-82211

Nexi XPay Build <= 7.6.2 - Unauthenticated Payment Completion and Order Key Disclosure

The Nexi XPay Build WordPress plugin through 7.6.2 does not verify the payment result supplied to several of its unauthenticated routes, allowing attackers to mark arbitrary orders as paid or failed, to cancel them, and to obtain order keys which expose guest buyers' details.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Nexi Xpay Build

CVE-2026-19218

Password Reset Code Brute Force Leading to Account Takeover in AKIN Software's MyRezzta

Weak Password Recovery Mechanism for Forgotten Password vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. MyRezzta allows Password Recovery Exploitation. This issue affects MyRezzta: from 2.06.03 before 2.07.01.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Akin

Products

Myrezzta

CVE-2026-107640

Integrics Enswitch 3.13 through 4.4 Authentication Bypass via Password Reset API

Integrics Enswitch 3.13 through 4.4 contains an authentication bypass vulnerability in /api/json/user/password/update/ that allows unauthenticated attackers to change account passwords by omitting the reset parameter. Attackers can target accounts with no pending reset, whose empty reset_key matches the defaulted empty value, to take over administrator accounts after enumerating valid usernames.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Integrics

Products

Enswitch

CVE-2026-105785

Joplin Server password reset accepts tokens issued for unrelated purposes

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to Joplin Server 3.7.2, packages/server/src/models/TokenModel.ts stores CSRF, account-confirmation, email-change, and password-reset tokens without a purpose, and packages/server/src/models/UserModel.ts allows UserModel.resetPassword to accept any token returned by TokenModel.userFromToken. An attacker who obtains a victim's CSRF or confirmation token through a separate disclosure channel can submit it to the public password-reset endpoint, replace the victim's password, and cause the existing sessions and API applications to be deleted. This issue is fixed in Joplin Server 3.7.2.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Laurent 22

Products

Joplin

CVE-2026-102115

Kiteworks Core Authentication Bypass in the Password Reset Workflow

Kiteworks Core did not correctly validate a parameter submitted to the password reset workflow. An unauthenticated attacker who knew the email address of a user with a locally stored password could potentially reset that account's password without access to the emailed reset link and then authenticate as that user, including where the account holds administrative privileges.

CVSS 3.1 · 9.8 Critical EPSS 1.0% KEV · Not listed

Vendors

Accellion Kiteworks

Products

Kiteworks Core

CVE-2026-100870

Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 Admin Password Reset Poisoning via Host Header

Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 build administrator password-reset links using the request Host header without validation, allowing unauthenticated attackers to redirect reset tokens to attacker-controlled domains. Attackers can request password resets for known administrator email addresses with forged Host headers to intercept valid reset tokens and take over administrator accounts.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Sylius

Products

Sylius

CVE-2026-53953

GetSimple CMS: Predictable Password Reset Password Allows Administrator Account Takeover

GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. In version 3.3.22, the password reset endpoint can be accessed without authentication. When a reset request is submitted for an existing user, the application generates a new temporary password and immediately stores its hash as the user's new password. The temporary password is generated using PHP rand() seeded with microtime(). Because this seed is time-based and has a limited effective search space, an attacker can generate possible reset password candidates. Since the admin login endpoint does not enforce rate limiting or account lockout, these candidates can be tested online until the correct password is found. Successful exploitation may lead to administrator account takeover. At time of publication, there are no publicly available patches.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Getsimple-ce

Products

Getsimple Cms

CVE-2026-101188

Netcore POWER13 ubus routerd.passwd_set password recovery

A security vulnerability has been detected in Netcore POWER13 2.0.240730.162638. This issue affects the function routerd.passwd_set of the file /ubus. Such manipulation leads to weak password recovery. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Netcore

Products

Power13

CVE-2026-96200

Payments for Hubtel < 1.0.2 - Unauthenticated Payment Confirmation Forgery via Delayed Payment Callback

The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that payment notifications received by its payment callback come from the payment provider, allowing unauthenticated attackers to mark arbitrary orders as paid without payment.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Payments For Hubtel

CVE-2026-93340

Gladys Assistant < 5.1.0 Password Reset Link Poisoning via forgot_password Endpoint

Gladys Assistant before 5.1.0 contains a password reset link poisoning vulnerability that allows unauthenticated remote attackers to obtain valid password reset tokens for any account by exploiting the client-supplied origin parameter in the forgot_password endpoint without server-side validation. Attackers can send a crafted request specifying an attacker-controlled origin, causing the victim to receive a poisoned reset link that discloses the session token to the attacker, enabling full account takeover including administrator accounts.

CVSS 4.0 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Gladysassistant

Products

Gladys Assistant

CVE-2026-13019

Missing Authentication

Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes have a missing authentication for critical function vulnerability allows a remote, unauthenticated attacker to access an unprotected API. The following versions are known to be affected: Portal for ArcGIS 12.1 and earlier. Other unsupported versions may also be affected. Esri recommends that users apply the Portal for ArcGIS Security 2026 Update 2 Patch to remediate this vulnerability.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Esri Kubernetes Linux and 1 more

Products

Portal For Arcgis Kubernetes Linux Kernel and 1 more

CVE-2026-6285

Improper Authentication in Ankaref's LIBRID/LIBREF

Weak Password Recovery Mechanism for Forgotten Password vulnerability in Ankaref Innovation and Technology Inc. LIBRID/LIBREF allows Password Recovery Exploitation. This issue affects LIBRID/LIBREF: from 2.01.0.2183 before 18.9.26.2319.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Ankaref Innovation And Technology Inc.

Products

Librid/libref