cve.bz

blueprintue blueprintue-self-hosted-edition vulnerabilities, newest first

Filter
  1. 8.7CVE-2026-126659

    BlueprintUE Self-Hosted Edition 1.0.0 before 4.3.5 contains a resource exhaustion vulnerability that allows unauthenticated attackers to fill server storage by repeatedly creating anonymous blueprints. Attackers can send large requests to …

  2. 6.9CVE-2026-122139EPSS 0.3%

    blueprintUE Self-Hosted Edition before 4.3.3 contains an account enumeration vulnerability in ForgotPasswordMiddleware.php that allows unauthenticated attackers to identify registered email addresses. Attackers can compare password reset r…

  3. 6.3CVE-2026-122138EPSS 0.3%

    BlueprintUE Self-Hosted Edition 4.2.0 before 4.3.4 contains a login rate limit bypass vulnerability in LoginMiddleware.php that keys failed-login counters on case-sensitive usernames. Unauthenticated attackers can vary username casing agai…

  4. 6.3CVE-2026-121735EPSS 0.2%

    blueprintUE self-hosted edition before 4.3.4 contains an insufficient session expiration vulnerability that allows attackers to confirm accounts using stale tokens because UserModel::findUserIDWithConfirmedToken ignores confirmed_sent_at. …

  5. 8.1CVE-2026-40588EPSS 0.3%

    blueprintUE is a tool to help Unreal Engine developers. Prior to 4.2.0, the password change form at /profile/{slug}/edit/ does not include a current_password field and does not verify the user's existing password before accepting a new one…

  6. 6.5CVE-2026-40587EPSS 0.2%

    blueprintUE is a tool to help Unreal Engine developers. Prior to 4.2.0, when a user changes their password via the profile edit page, or when a password reset is completed via the reset link, neither operation invalidates existing authenti…

  7. 7.5CVE-2026-40586EPSS 0.4%

    blueprintUE is a tool to help Unreal Engine developers. Prior to 4.2.0, the login form handler performs no throttling of any kind. Failed authentication attempts are processed at full network speed with no IP-based rate limiting, no per-ac…

  8. 7.4CVE-2026-40585EPSS 0.3%

    blueprintUE is a tool to help Unreal Engine developers. Prior to 4.2.0, when a password reset is initiated, a 128-character CSPRNG token is generated and stored alongside a password_reset_at timestamp. However, the token redemption functio…