CVE-2026-91995Critical· 9.1▾ Midnightpig before 4.1.0 contains an authentication bypass vulnerability in the /register/password endpoint where password verification results are discarded, allowing any value as the current password. Remote attackers can submit a username wit…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 50.1 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 18.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.6%
Last analysed / modified upstream
0.6% → 0.9%
pig before 4.1.0 contains an authentication bypass vulnerability in the /register/password endpoint where password verification results are discarded, allowing any value as the current password. Remote attackers can submit a username with an incorrect current password to overwrite any account credential including the admin account and gain full administrative control.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-111343Medium· 4.3pig through 4.1.1 Missing Authorization via GET /admin/user/details/{id}
CVE-2026-115997Medium· 6.3pig-mesh pig SqlFilterArgumentResolver.java orderItem.getColumn sql injection
CVE-2026-112002Medium· 6.8ProjectSend 2.5.0 before 2.7.0 Unverified Password Change via /settings/password
CVE-2026-97380High· 8.8mariadb: mariadb: Privilege escalation via empty password in GRANT PROXY statement (CVE-2026-97380)
CVE-2026-104106Medium· 6.5FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations
CVE-2026-102603Medium· 5.3Gotify server is a simple server for sending and receiving messages in real-time per WebSocket