Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

7 records

Vendor: blueprintue Clear all filters
TI-2026-85180 CVE-2026-122139 · GHSA-6v33-jwgx-fxf7

Account enumeration via password reset in blueprintUE Self-Hosted Edition

Priority LOW 30

blueprintUE Self-Hosted Edition before 4.3.3 contains an account enumeration vulnerability in ForgotPasswordMiddleware.php that allows unauthenticated attackers to identify registered email addresses.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00348 Published 2026-11-04 Fixed in 4.3.3 CWE-204
TI-2026-85179 CVE-2026-122138 · GHSA-3x4w-vq7f-5f76

Login rate limit bypass in BlueprintUE Self-Hosted Edition

Priority LOW 28

BlueprintUE Self-Hosted Edition 4.2.0 before 4.3.4 contains a login rate limit bypass vulnerability in LoginMiddleware.php that keys failed-login counters on case-sensitive usernames.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00331 Published 2026-11-04 Fixed in 4.3.4 CWE-307
TI-2026-84856 CVE-2026-121735 · GHSA-pc87-6hr3-m9jr

Stale confirmation tokens activate accounts in blueprintUE Self-Hosted Edition

Priority LOW 28

blueprintUE self-hosted edition before 4.3.4 contains an insufficient session expiration vulnerability that allows attackers to confirm accounts using stale tokens because UserModel::findUserIDWithConfirmedToken ignores…

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.0023 Published 2026-11-03 Fixed in 4.3.4 CWE-613