agentprime: CWE-640Every new CWE-640 Advisory and CVE.https://agentprime.io/CVE-2026-123196: Authorizer before 2.4.2 Password Reset Poisoning via x-authorizer-url gRPC metadatahttps://agentprime.io/advisories/CVE-2026-123196/https://agentprime.io/advisories/CVE-2026-123196/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 18:16:34 GMTCVECVE-2026-114421: Empty initial password permits GINA account takeoverhttps://agentprime.io/advisories/CVE-2026-114421/https://agentprime.io/advisories/CVE-2026-114421/CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 08:42:22 GMTCVECVE-2026-119127: ZITADEL 4.0.0 before 4.19.5 Account Takeover via Login V2 Host Header Injectionhttps://agentprime.io/advisories/CVE-2026-119127/https://agentprime.io/advisories/CVE-2026-119127/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 29 Oct 2026 15:58:09 GMTCVECVE-2026-116214: MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery Codehttps://agentprime.io/advisories/CVE-2026-116214/https://agentprime.io/advisories/CVE-2026-116214/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 26 Oct 2026 13:08:47 GMTCVEcriticalCVE-2026-94380: Host Header Injection in HAVELSAN's Liman MYShttps://agentprime.io/advisories/CVE-2026-94380/https://agentprime.io/advisories/CVE-2026-94380/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 26 Oct 2026 11:15:45 GMTCVECVE-2026-115973: FaveoSuite Faveo Helpdesk ForgotPasswordController.php reset password recoveryhttps://agentprime.io/advisories/CVE-2026-115973/https://agentprime.io/advisories/CVE-2026-115973/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sat, 24 Oct 2026 18:15:15 GMTCVECVE-2026-58202: OpenReception: Confirmation-email links built from the request Host enable pending-account takeover via `POST /api/auth/resend-confirmation`https://agentprime.io/advisories/CVE-2026-58202/https://agentprime.io/advisories/CVE-2026-58202/CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 23 Oct 2026 20:27:36 GMTCVECVE-2026-46347: Goobi viewer: Predictable Replacement Password Allows Account Takeover After Password Resethttps://agentprime.io/advisories/CVE-2026-46347/https://agentprime.io/advisories/CVE-2026-46347/CVSS 6.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 23 Oct 2026 14:14:51 GMTCVECVE-2026-46346: Goobi viewer: Predictable Password Reset Token Allows Unauthorized Password Resethttps://agentprime.io/advisories/CVE-2026-46346/https://agentprime.io/advisories/CVE-2026-46346/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 23 Oct 2026 14:14:39 GMTCVECVE-2026-86055: Part-DB: Password Reset Link Poisoning via Host Header Injection leads to pre-authentication Account Takeoverhttps://agentprime.io/advisories/CVE-2026-86055/https://agentprime.io/advisories/CVE-2026-86055/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 23 Oct 2026 04:09:27 GMTCVECVE-2026-43845: Weak password recovery in Advantech ADAM-3600https://agentprime.io/advisories/CVE-2026-43845/https://agentprime.io/advisories/CVE-2026-43845/CVSS 9.2 (Critical). Critical: CVSS score 9.2: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 20 Oct 2026 08:48:28 GMTCVEcriticalCVE-2026-112035: aircheng-org iWebShop-5 simple.php send_message_mobile password recoveryhttps://agentprime.io/advisories/CVE-2026-112035/https://agentprime.io/advisories/CVE-2026-112035/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 19 Oct 2026 00:30:56 GMTCVECVE-2026-16437: An authentication bypass vulnerability in GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizVizhttps://agentprime.io/advisories/CVE-2026-16437/https://agentprime.io/advisories/CVE-2026-16437/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 15 Oct 2026 08:30:39 GMTCVECVE-2026-16436: An authentication bypass vulnerability in GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizVizhttps://agentprime.io/advisories/CVE-2026-16436/https://agentprime.io/advisories/CVE-2026-16436/CVSS 9.2 (Critical). Critical: CVSS score 9.2: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 15 Oct 2026 08:29:44 GMTCVEcriticalCVE-2026-108337: Password Reset Code Accessible in User Listing APIhttps://agentprime.io/advisories/CVE-2026-108337/https://agentprime.io/advisories/CVE-2026-108337/CVSS 7.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 14 Oct 2026 21:43:08 GMTCVECVE-2026-108335: Password Reset Functionality Missing Brute-Force Protectionhttps://agentprime.io/advisories/CVE-2026-108335/https://agentprime.io/advisories/CVE-2026-108335/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 14 Oct 2026 21:39:17 GMTCVEcriticalCVE-2026-63159: Omnispace Agora Project < 26.10.0 Predictable Password-Reset Token Account Takeoverhttps://agentprime.io/advisories/CVE-2026-63159/https://agentprime.io/advisories/CVE-2026-63159/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 13 Oct 2026 19:46:07 GMTCVEcriticalMicrosoft Security Advisory CVE-2026-70175 - ASP.NET Core Elevation of Privilege Vulnerabilityhttps://agentprime.io/advisories/GHSA-x3vp-85cm-q97r/https://agentprime.io/advisories/GHSA-x3vp-85cm-q97r/Microsoft.AspNetCore.App.Runtime.linux-arm >=8.0.0, <8.0.32 || >=9.0.0, <9.0.21 || >=10.0.0, <10.0.13, fixed in 8.0.32, 9.0.21, 10.0.13. CVSS 8.1 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Tue, 13 Oct 2026 19:44:54 GMTNuGetMicrosoft.AspNetCore.App.Runtime.linux-armMicrosoft.AspNetCore.App.Runtime.linux-arm64Microsoft.AspNetCore.App.Runtime.linux-musl-armMicrosoft.AspNetCore.App.Runtime.linux-musl-arm64Microsoft.AspNetCore.App.Runtime.linux-musl-x64Microsoft.AspNetCore.App.Runtime.linux-x64Microsoft.AspNetCore.App.Runtime.osx-arm64Microsoft.AspNetCore.App.Runtime.osx-x64Microsoft.AspNetCore.App.Runtime.win-armMicrosoft.AspNetCore.App.Runtime.win-arm64Microsoft.AspNetCore.App.Runtime.win-x64Microsoft.AspNetCore.App.Runtime.win-x86CVE-2026-53997: Netherman Portal del Hermano Account Takeover via Password Reset Oraclehttps://agentprime.io/advisories/CVE-2026-53997/https://agentprime.io/advisories/CVE-2026-53997/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 12 Oct 2026 20:48:31 GMTCVEcriticalCVE-2026-109204: LogicalDOC Community Edition through 9.3 Forced Password Reset via Unbound PswRecovery Tickethttps://agentprime.io/advisories/CVE-2026-109204/https://agentprime.io/advisories/CVE-2026-109204/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 12 Oct 2026 13:39:45 GMTCVECVE-2026-108737: Traccar through 6.16.0 Weak Password Recovery via TokenManager Token Purpose Confusionhttps://agentprime.io/advisories/CVE-2026-108737/https://agentprime.io/advisories/CVE-2026-108737/CVSS 7.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Sun, 11 Oct 2026 12:19:42 GMTCVECVE-2026-107640: Integrics Enswitch 3.13 through 4.4 Authentication Bypass via Password Reset APIhttps://agentprime.io/advisories/CVE-2026-107640/https://agentprime.io/advisories/CVE-2026-107640/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 08 Oct 2026 14:10:36 GMTCVEcriticalCVE-2026-19218: Password Reset Code Brute Force Leading to Account Takeover in AKIN Software's MyRezztahttps://agentprime.io/advisories/CVE-2026-19218/https://agentprime.io/advisories/CVE-2026-19218/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 08 Oct 2026 12:03:29 GMTCVEcriticalCVE-2026-105785: Joplin Server password reset accepts tokens issued for unrelated purposeshttps://agentprime.io/advisories/CVE-2026-105785/https://agentprime.io/advisories/CVE-2026-105785/CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 23:12:45 GMTCVECVE-2026-53953: GetSimple CMS: Predictable Password Reset Password Allows Administrator Account Takeoverhttps://agentprime.io/advisories/CVE-2026-53953/https://agentprime.io/advisories/CVE-2026-53953/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 01 Oct 2026 19:36:17 GMTCVEcriticalCVE-2026-102115: Kiteworks Core Authentication Bypass in the Password Reset Workflowhttps://agentprime.io/advisories/CVE-2026-102115/https://agentprime.io/advisories/CVE-2026-102115/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 30 Sep 2026 20:19:55 GMTCVEcriticalCVE-2026-101188: Netcore POWER13 ubus routerd.passwd_set password recoveryhttps://agentprime.io/advisories/CVE-2026-101188/https://agentprime.io/advisories/CVE-2026-101188/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 28 Sep 2026 21:00:08 GMTCVECVE-2026-93340: Gladys Assistant < 5.1.0 Password Reset Link Poisoning via forgot_password Endpointhttps://agentprime.io/advisories/CVE-2026-93340/https://agentprime.io/advisories/CVE-2026-93340/CVSS 7.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 21 Sep 2026 21:21:58 GMTCVECVE-2026-93453: SOGo before 5.12.11 Password Reset Token Interception via Origin Headerhttps://agentprime.io/advisories/CVE-2026-93453/https://agentprime.io/advisories/CVE-2026-93453/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 17 Sep 2026 23:25:12 GMTCVECVE-2026-14850: Weak password recovery mechanism for forgotten password in MobiAPParchttps://agentprime.io/advisories/CVE-2026-14850/https://agentprime.io/advisories/CVE-2026-14850/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 17 Sep 2026 13:26:26 GMTCVECVE-2026-90522: jaychouchannel Tourism-Management-System Password Recovery UsersController.java resetPass password recoveryhttps://agentprime.io/advisories/CVE-2026-90522/https://agentprime.io/advisories/CVE-2026-90522/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 13 Sep 2026 13:00:16 GMTCVECVE-2026-81905: Concrete CMS below 9.5.3 does not enforce validation-hash type on redemption, allowing a hash issued for one purpose to be redeemed for another.https://agentprime.io/advisories/CVE-2026-81905/https://agentprime.io/advisories/CVE-2026-81905/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 10 Sep 2026 23:16:31 GMTCVECVE-2026-6285: Improper Authentication in Ankaref's LIBRID/LIBREFhttps://agentprime.io/advisories/CVE-2026-6285/https://agentprime.io/advisories/CVE-2026-6285/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 10 Sep 2026 13:32:23 GMTCVECVE-2026-86260: sfturing hosp_order Password Recovery CommonUserController.java modifyPassWord unverified password changehttps://agentprime.io/advisories/CVE-2026-86260/https://agentprime.io/advisories/CVE-2026-86260/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 07 Sep 2026 02:00:12 GMTCVECVE-2026-71625: An issue in slimkit plus ThinkSNS+ v.2.4 allows a remote attacker to escalate privileges via the ResetPasswordController.php componenthttps://agentprime.io/advisories/CVE-2026-71625/https://agentprime.io/advisories/CVE-2026-71625/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 04 Sep 2026 00:00:00 GMTCVEcriticalCVE-2026-100870: Administrator password-reset link is built from the request Host header, allowing reset-token thefthttps://agentprime.io/advisories/GHSA-77w3-2367-7xvq/https://agentprime.io/advisories/GHSA-77w3-2367-7xvq/sylius/sylius >=1.12.0, <1.12.25 || >=1.13.0, <1.13.17 || >=1.14.0, <1.14.20 || >=2.0.0, <2.1.0 || >=2.1.0, <2.1.16 || >=2.2.0, <2.2.9, fixed in 1.12.25, 1.13.17, 1.14.20, 2.1.0, 2.1.16, 2.2.9. CVSS 8.7 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Wed, 02 Sep 2026 13:28:00 GMTPackagistsylius/syliusCVE-2026-84699: Team Password Manager before 14.184.308 Authentication Bypass in Password Resethttps://agentprime.io/advisories/CVE-2026-84699/https://agentprime.io/advisories/CVE-2026-84699/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 02 Sep 2026 00:37:54 GMTCVEcriticalCVE-2026-82487: Beetel 450TC3 password recoveryhttps://agentprime.io/advisories/CVE-2026-82487/https://agentprime.io/advisories/CVE-2026-82487/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 30 Aug 2026 09:45:09 GMTCVEPimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account with 2FA bypasshttps://agentprime.io/advisories/GHSA-h854-c3m3-mh5v/https://agentprime.io/advisories/GHSA-h854-c3m3-mh5v/pimcore/studio-backend-bundle <2025.4.6 || >=2026.1.0, <2026.1.6, fixed in 2025.4.6, 2026.1.6. CVSS 8.8 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Fri, 28 Aug 2026 19:04:16 GMTPackagistpimcore/studio-backend-bundleCVE-2026-19632: TranslatePress – Multilingual <= 3.3.1 - Unauthenticated Account Takeover via Password Reset Link Disclosurehttps://agentprime.io/advisories/CVE-2026-19632/https://agentprime.io/advisories/CVE-2026-19632/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 26 Aug 2026 03:39:22 GMTCVEcriticalCVE-2026-77264: Automation Web Platform <= 4.8.6 - Unauthenticated Authentication Bypass via 'otp_transient' Token Disclosurehttps://agentprime.io/advisories/CVE-2026-77264/https://agentprime.io/advisories/CVE-2026-77264/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 21 Aug 2026 07:39:24 GMTCVEcriticalKeycloak: Unauthenticated account takeover via reset-credentials flow bypasshttps://agentprime.io/advisories/GHSA-4gv3-mc9p-5wqc/https://agentprime.io/advisories/GHSA-4gv3-mc9p-5wqc/org.keycloak:keycloak-services >=26.0.0, <26.4.15 || >=26.5.0, <26.6.6 || >=26.7.0, <26.7.2, fixed in 26.4.15, 26.6.6, 26.7.2. CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.Tue, 18 Aug 2026 18:32:00 GMTMavenorg.keycloak:keycloak-servicescriticalCVE-2026-15689: Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset link poisoning via the request Host header in _default_email_password_reset and _default_welcome_sendhttps://agentprime.io/advisories/CVE-2026-15689/https://agentprime.io/advisories/CVE-2026-15689/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Sat, 15 Aug 2026 13:25:26 GMTCVEcriticalCVE-2026-12949: Wishlist Member X <= 3.34.1 - Unauthenticated Account Takeover via 'mergewith' Parameterhttps://agentprime.io/advisories/CVE-2026-12949/https://agentprime.io/advisories/CVE-2026-12949/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 14 Aug 2026 05:30:43 GMTCVEcriticalCVE-2026-72856: Budibase before 3.40.0 Authentication Bypass via Tenant Owner Emailhttps://agentprime.io/advisories/CVE-2026-72856/https://agentprime.io/advisories/CVE-2026-72856/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 13 Aug 2026 21:54:45 GMTCVECVE-2026-66691: WordPress Nokri theme <= 1.6.6 - Broken Access Control vulnerabilityhttps://agentprime.io/advisories/CVE-2026-66691/https://agentprime.io/advisories/CVE-2026-66691/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 13 Aug 2026 13:37:16 GMTCVEcriticalCVE-2026-61967: WordPress miniorange otp verification plugin <= 5.5.1 - Privilege Escalation vulnerabilityhttps://agentprime.io/advisories/CVE-2026-61967/https://agentprime.io/advisories/CVE-2026-61967/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 13 Aug 2026 13:36:43 GMTCVEcriticalCVE-2026-12571: Authentication Bypass Leading to Account Takeoverhttps://agentprime.io/advisories/CVE-2026-12571/https://agentprime.io/advisories/CVE-2026-12571/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 11 Aug 2026 16:52:14 GMTCVEcriticalCVE-2026-19361: macrozheng mall mall-portal getAuthCode password recoveryhttps://agentprime.io/advisories/CVE-2026-19361/https://agentprime.io/advisories/CVE-2026-19361/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 09 Aug 2026 17:15:09 GMTCVECVE-2026-14364: TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary Password Reset via 'tbab-userid'https://agentprime.io/advisories/CVE-2026-14364/https://agentprime.io/advisories/CVE-2026-14364/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 07 Aug 2026 04:25:56 GMTCVEcritical