CVE-2026-60046
An unauthenticated remote attacker can perform password resets for any user with known username and email without rate limiting. This can re
CVSS
7.5
Alto
EPSS
0.3%
p25
KEV
—
Exploit Today
7
0-100
Publicado: 10 nov 2026 · Última mod.: 10 nov 2026 · CWE-640
Sin historial EPSS suficiente todavía.
An unauthenticated remote attacker can perform password resets for any user with known username and email without rate limiting. This can result in a total loss of availabilit since the password will be reseted.
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-1187418.1 ALT—
——0Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.11hCVE-2026-1250747.3 ALT22.2%
——7A flaw has been found in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This affects an unknown function of the file reset_password.php of the component Password Reset. This manipulation of the argument username/password causes weak password recovery. The attack is possible to be carried out remotely. The exploit has been published and may be used.1dCVE-2026-118459—25.5%
——8A time-derived emergency password can be derived from publicly available application code, enabling authentication without legitimate credentials.2dCVE-2026-1231968.1 ALT29.7%
——9Authorizer before 2.4.2 contains a password reset poisoning vulnerability that allows unauthenticated attackers to control emailed link hosts by supplying x-authorizer-url gRPC metadata. Attackers can send this metadata to the gRPC port or a Grpc-Metadata-X-Authorizer-Url header through the REST gateway to capture reset or magic-link tokens and take over accounts.2dCVE-2026-114421—23.1%
——7SEPPmail Secure Email Gateway before 15.1.1 permits password recovery for a created but unregistered GINA account whose initial password is empty without adequately verifying ownership. A remote unauthenticated attacker who identifies such an account can set a new password, authenticate as that account, and prevent the intended recipient from using it until recovery.1dCVE-2026-1191278.1 ALT20.4%
——6ZITADEL 4.0.0 before 4.19.5 contains a host header injection vulnerability in the Login V2 UI that allows unauthenticated attackers to poison password-reset, invite, and email-verification links by supplying untrusted x-zitadel-public-host, x-zitadel-forward-host, or x-forwarded-host headers. Attackers knowing a victim's login name can point the links in genuine emails at their host, harvest the single-use codes when the links are opened, and take over accounts including instance administrators.7d