blueprintue has 3 CVEs on record. 3 were published in the last 90 days. The busiest recent month was November 2026 with 3. The median CVSS is 5.3 (medium).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.3
- Publish → KEV
- —
- Last 90 days
- 3 prev 0
Worst active — by depth score
CVE-2026-122139Medium· 5.3blueprintUE Self-Hosted Edition before 4.3.3 Account Enumeration via Password Reset29CVE-2026-122138Medium· 5.3BlueprintUE Self-Hosted Edition 4.2.0 before 4.3.4 Login Rate Limit Bypass29CVE-2026-121735Low· 3.7blueprintUE Self-Hosted Edition before 4.3.4 Non-Expiring Account Confirmation Tokens20
blueprintue vulnerabilities
CVEs affecting blueprintue, newest first. Open any entry for full detail, references, and exploit status.
3 CVEsRSS
CVE-2026-122138Medium· 5.3BlueprintUE Self-Hosted Edition 4.2.0 before 4.3.4 Login Rate Limit Bypass
BlueprintUE Self-Hosted Edition 4.2.0 before 4.3.4 contains a login rate limit bypass vulnerability in LoginMiddleware.php that keys failed-login counters on case-sensitive usernames. Unauthenticated attackers can vary username casing ag…
CVE-2026-122139Medium· 5.3blueprintUE Self-Hosted Edition before 4.3.3 Account Enumeration via Password Reset
blueprintUE Self-Hosted Edition before 4.3.3 contains an account enumeration vulnerability in ForgotPasswordMiddleware.php that allows unauthenticated attackers to identify registered email addresses. Attackers can compare password reset…
CVE-2026-121735Low· 3.7blueprintUE Self-Hosted Edition before 4.3.4 Non-Expiring Account Confirmation Tokens
blueprintUE self-hosted edition before 4.3.4 contains an insufficient session expiration vulnerability that allows attackers to confirm accounts using stale tokens because UserModel::findUserIDWithConfirmedToken ignores confirmed_sent_at…