https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 16 Oct 2026 18:03:51 +0000 https://db.gcve.eu/vuln/cve-2026-110130 <p><strong>Affected:</strong> Finsys dockhand</p> <p>Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-asset extension such as .js, including /api/* routes, and the user-mutation handlers fail open for unauthenticated callers. Unauthenticated remote attackers can send a PUT request to /api/users/&lt;id&gt;.js to reset the admin&#39;s or any user&#39;s password and take over the account.</p> <p><strong>Affected:</strong> Finsys dockhand</p> <p>Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-asset extension such as .js, including /api/* routes, and the user-mutation handlers fail open for unauthenticated callers. Unauthenticated remote attackers can send a PUT request to /api/users/&lt;id&gt;.js to reset the admin&#39;s or any user&#39;s password and take over the account.</p> https://db.gcve.eu/vuln/cve-2026-110130