https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T22:39:14.270944+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-318168 EUVD-2026-318168 2026-10-06T22:39:14.317017+00:00 EUVD-2026-318168 https://cve.radiocsirt.org/vuln/fkie_cve-2026-44306 fkie_cve-2026-44306 2026-10-06T22:39:14.317053+00:00

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.21 and 6.15.0, responses from the forgot password forms hinted at whether an account existed for a given email address. An unauthenticated attacker could use this to enumerate valid users, which can aid in follow-up credential-based attacks. This vulnerability is fixed in 5.73.21 and 6.15.0.

 https://cve.radiocsirt.org/vuln/ghsa-m24v-f7g5-gq67 GHSA-m24v-f7g5-gq67 — Statamic CMS vulnerable to email enumeration via forgot password endpoint 2026-10-06T22:39:14.317086+00:00

Affected: Packagist: statamic/cms

### Impact

Responses from the forgot password forms hinted at whether an account existed for a given email address. An unauthenticated attacker could use this to enumerate valid users, which can aid in follow-up credential-based attacks.

### Patches

This has been fixed in 5.73.21 and 6.15.0. The forgot password forms now return the same generic response regardless of whether the submitted email matches a registered user.