https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 08:10:01 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-274089 EUVD-2026-274089 https://cve.radiocsirt.org/vuln/euvd-2026-274089 https://cve.radiocsirt.org/vuln/fkie_cve-2026-28358 <p>NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the password forgot endpoint returned different responses for registered and unregistered emails, allowing user enumeration. This issue has been patched in version 0.301.3.</p> <p>NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the password forgot endpoint returned different responses for registered and unregistered emails, allowing user enumeration. This issue has been patched in version 0.301.3.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-28358 https://cve.radiocsirt.org/vuln/ghsa-387m-j3p9-3php <p><strong>Affected:</strong> npm: nocodb</p> <p>### Summary The password forgot endpoint returned different responses for registered and unregistered emails, allowing user enumeration.</p> <p>### Details `POST /api/v2/auth/password/forgot` returned a success message for registered emails but `&#39;Your email has not been registered.&#39;` for unknown emails. The fix returns a uniform response regardless of whether the email exists.</p> <p>### Impact An unauthenticated attacker can determine whether an email is registered. No credentials or data are exposed.</p> <p>### Credit This issue was reported by [@Tulgaaaaaaaa](https://github.com/Tulgaaaaaaaa).</p> <p><strong>Affected:</strong> npm: nocodb</p> <p>### Summary The password forgot endpoint returned different responses for registered and unregistered emails, allowing user enumeration.</p> <p>### Details `POST /api/v2/auth/password/forgot` returned a success message for registered emails but `&#39;Your email has not been registered.&#39;` for unknown emails. The fix returns a uniform response regardless of whether the email exists.</p> <p>### Impact An unauthenticated attacker can determine whether an email is registered. No credentials or data are exposed.</p> <p>### Credit This issue was reported by [@Tulgaaaaaaaa](https://github.com/Tulgaaaaaaaa).</p> https://cve.radiocsirt.org/vuln/ghsa-387m-j3p9-3php