https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 09:57:43 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-00824 bdu:2026-00824 https://cve.radiocsirt.org/vuln/bdu:2026-00824 https://cve.radiocsirt.org/vuln/euvd-2026-344009 EUVD-2026-344009 https://cve.radiocsirt.org/vuln/euvd-2026-344009 https://cve.radiocsirt.org/vuln/fkie_cve-2026-23760 <p>SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. An unauthenticated attacker can supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance. NOTE: SmarterMail system administrator privileges grant the ability to execute operating system commands via built-in management functionality, effectively providing administrative (SYSTEM or root) access on the underlying host.</p> <p>SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. An unauthenticated attacker can supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance. NOTE: SmarterMail system administrator privileges grant the ability to execute operating system commands via built-in management functionality, effectively providing administrative (SYSTEM or root) access on the underlying host.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-23760 https://cve.radiocsirt.org/vuln/ghsa-mj6x-679w-76wr <p>SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. An unauthenticated attacker can supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance.</p> <p>SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. An unauthenticated attacker can supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance.</p> https://cve.radiocsirt.org/vuln/ghsa-mj6x-679w-76wr https://cve.radiocsirt.org/vuln/ncsc-2026-0040 NCSC-2026-0040 https://cve.radiocsirt.org/vuln/ncsc-2026-0040 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0133 <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in SmarterTools SmarterMail ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen und um sich Administratorrechte zu verschaffen oder Code auszuführen.</p> <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in SmarterTools SmarterMail ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen und um sich Administratorrechte zu verschaffen oder Code auszuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0133