Advisories · Technology

blueprintue-self-hosted-edition.

Every CVE that names blueprintue-self-hosted-edition among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-122139 CVE record

CVSS 6.9 Medium

blueprintUE Self-Hosted Edition before 4.3.3 Account Enumeration via Password Reset
- blueprintue-self-hosted-edition
- CWE-204
Not analysed yet 4 Nov 2026
CVE-2026-122138 CVE record

CVSS 6.3 Medium

BlueprintUE Self-Hosted Edition 4.2.0 before 4.3.4 Login Rate Limit Bypass
- blueprintue-self-hosted-edition
- Authentication bypass
Not analysed yet 4 Nov 2026
CVE-2026-121735 CVE record

CVSS 6.3 Medium

blueprintUE Self-Hosted Edition before 4.3.4 Non-Expiring Account Confirmation Tokens
- blueprintue-self-hosted-edition
- Authentication bypass
Not analysed yet 3 Nov 2026
CVE-2026-40588 CVE record

CVSS 8.1 High

blueprintUE: Authenticated Password Change Does Not Verify Current Password
- blueprintue-self-hosted-edition
- CWE-620
Not analysed yet 21 Apr 2026
CVE-2026-40587 CVE record

CVSS 6.5 Medium

blueprintUE: Active Sessions Are Not Invalidated After Password Change or Reset
- blueprintue-self-hosted-edition
- Authentication bypass
Not analysed yet 21 Apr 2026
CVE-2026-40586 CVE record

CVSS 7.5 High

blueprintUE: Login Endpoint Has No Rate Limiting, Lockout, or Brute-Force Protection
- blueprintue-self-hosted-edition
- Authentication bypass
Not analysed yet 21 Apr 2026
CVE-2026-40585 CVE record

CVSS 7.4 High

blueprintUE: Password Reset Tokens Have No Expiry Window
- blueprintue-self-hosted-edition
- CWE-640
Not analysed yet 21 Apr 2026