https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T00:16:32.293436+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-85182 CVE-2026-85182 — vhr Missing Authorization in PUT /hr/pass Allows Cross-Account Password Change 2026-10-06T00:16:32.309464+00:00

Affected: lenve vhr

vhr through commit 03abbd3 fails to verify that the account ID in PUT /hr/pass requests belongs to the authenticated caller. Authenticated attackers can change arbitrary account passwords by supplying a target account ID and that account's current password in the request body.