Posts tagged

#cve

2posts

CVE-2026-14850: Arbitrary Password Reset in MobiAPParc

Sep 17, 2026

A client-controlled user_id in MobiAPParc’s password recovery flow allowed arbitrary password resets. Predictable IDs, email enumeration, and missing rate limiting increased the impact.

Read the article

CVE-2026-48117 - Account Takeover via Pre-Registration Attack in DroneAware Node

May 25, 2026

A pre-registration flaw in DroneAware Node allowed silent account takeover — any user authenticating via Google SSO or email verification could have their account hijacked.

Read the article