CVE-2026-122139Medium· 5.3▾ SunlitblueprintUE Self-Hosted Edition before 4.3.3 contains an account enumeration vulnerability in ForgotPasswordMiddleware.php that allows unauthenticated attackers to identify registered email addresses. Attackers can compare password reset…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
blueprintUE Self-Hosted Edition before 4.3.3 contains an account enumeration vulnerability in ForgotPasswordMiddleware.php that allows unauthenticated attackers to identify registered email addresses. Attackers can compare password reset redirect targets for submitted emails, and failed lookups are never rate-limited, enabling unlimited enumeration attempts.
blueprintue-self-hosted-edition < 4.3.3Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-122138Medium· 5.3BlueprintUE Self-Hosted Edition 4.2.0 before 4.3.4 Login Rate Limit Bypass
CVE-2026-121735Low· 3.7blueprintUE Self-Hosted Edition before 4.3.4 Non-Expiring Account Confirmation Tokens
CVE-2026-100362Medium· 6.9SuiteCRM: V8 OAuth2 Username Enumeration
CVE-2026-85286Low· 3.7HomeBox: Timing Side-Channel in Login Endpoint Allows User Enumeration via Bcrypt Hashing Delay
CVE-2026-97702Medium· 5.3Open edX: Support "manage_course_team" REST API omits the `require_support_permission` gate its sibling support views enforce
CVE-2026-119700Medium· 5.3WPGraphQL before 2.24.2 Object Existence Disclosure via Media and Comment Mutations