cve.bz

pglombardo passwordpusher vulnerabilities in 2026, newest first

Filter

By year: all 2026 2025 2024 2023 2022 2021

  1. 6.3CVE-2026-126400EPSS 0.1%

    Password Pusher from 1.49.0 before 2.17.0 contains an IP spoofing vulnerability that allows remote clients to forge the recorded request IP via unanchored trusted-proxy regular expressions. Clients in 110.0.0.0/8 or 210.0.0.0/8, or connect…

  2. 8.7CVE-2026-87816EPSS 0.4%

    PasswordPusher before 2.11.1 contains a time-of-check-to-time-of-use race condition in view limit enforcement that allows unauthenticated attackers to bypass expire_after_views limits. Attackers can send concurrent requests to the show end…

  3. 6.9CVE-2026-62382ExploitEPSS 1.2%

    PasswordPusher versions v1.45.11 through v2.9.5 contain an improper authorization vulnerability in the push deletion logic. The ownership check compares @push.user against current_user; for an anonymously created push both values are nil, …

  4. 8.7CVE-2026-61458EPSS 0.4%

    PasswordPusher before 2.9.2 contains a brute-force vulnerability in the POST /p/:token/access endpoint that lacks route-specific rate limiting and per-push lockout mechanisms. Attackers who know a push token can systematically guess passph…