Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-126815

Pre-account hijacking via planted password

Pre-account hijacking in the authentication flow in Lagarto Chivato 0.4.1 and earlier on Web allows remote unauthenticated attackers to take over arbitrary accounts via a password planted on an unregistered email address that becomes valid upon the victim’s first passwordless login.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Xauendevs
Products
Lagarto Chivato
CVE-2026-126784

Uncontrolled resource consumption via post_notice

Missing rate limiting, per-account submission quota and geographic validation in the publicar_aviso RPC function in Lagarto Chivato 0.4.1 and earlier on Web allows remote authenticated attackers to flood the moderation queue via unlimited submission of notices with arbitrary coordinates.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Xauendevs
Products
Lagarto Chivato