Section

Vulnerabilities

CVE records from NVD, ZDI advisories and the CISA KEV catalog, with CVSS, EPSS, SSVC and exploitation state.

6 matching records.

1. 38
   CVE NVD 2h ago

   blueprintUE Self-Hosted Edition before 4.3.7 contains an insecure default configuration in its Docker Compose examples that sets…

   blueprintUE Self-Hosted Edition before 4.3.7 contains an insecure default configuration in its Docker Compose examples that sets MYSQL_ALLOW_EMPTY_PASSWORD=yes in database.env and publishes MariaDB on port 3306. Unauthenticated…

   CVSS 9.8 CVE-2026-126812 Blueprintue Database
2. 25
   CVE NVD 10h ago

   BlueprintUE Self-Hosted Edition 1.0.0 before 4.3.5 contains a resource exhaustion vulnerability that allows unauthenticated attackers to fill server…

   BlueprintUE Self-Hosted Edition 1.0.0 before 4.3.5 contains a resource exhaustion vulnerability that allows unauthenticated attackers to fill server storage by repeatedly creating anonymous blueprints. Attackers can send large…

   CVSS 7.5 CVE-2026-126659 Blueprintue
3. 15
   CVE NVD 2h ago

   blueprintUE Self-Hosted Edition before 4.3.6 contains an iframe injection vulnerability that allows authenticated users to embed arbitrary…

   blueprintUE Self-Hosted Edition before 4.3.6 contains an iframe injection vulnerability that allows authenticated users to embed arbitrary third-party content by abusing the PeerTube video URL matcher in…

   CVSS 3.5 CVE-2026-126814 Blueprintue
4. 14
   CVE NVD 7d ago

   BlueprintUE Self-Hosted Edition 4.2.0 before 4.3.4 contains a login rate limit bypass vulnerability in LoginMiddleware.php that keys failed-login…

   BlueprintUE Self-Hosted Edition 4.2.0 before 4.3.4 contains a login rate limit bypass vulnerability in LoginMiddleware.php that keys failed-login counters on case-sensitive usernames. Unauthenticated attackers can vary username…

   CVSS 5.3 CVE-2026-122138 Blueprintue Database
5. 3
   CVE NVD 7d ago

   blueprintUE Self-Hosted Edition before 4.3.3 contains an account enumeration vulnerability in ForgotPasswordMiddleware.php that allows…

   blueprintUE Self-Hosted Edition before 4.3.3 contains an account enumeration vulnerability in ForgotPasswordMiddleware.php that allows unauthenticated attackers to identify registered email addresses. Attackers can compare…

   CVSS 5.3 CVE-2026-122139 Blueprintue
6. 0
   CVE NVD 8d ago

   blueprintUE self-hosted edition before 4.3.4 contains an insufficient session expiration vulnerability that allows attackers to confirm accounts…

   blueprintUE self-hosted edition before 4.3.4 contains an insufficient session expiration vulnerability that allows attackers to confirm accounts using stale tokens because UserModel::findUserIDWithConfirmedToken ignores…

   CVSS 3.7 CVE-2026-121735 Blueprintue

Same filters as JSON: /api/items?category=vuln&window=30d&vendor=Blueprintue&limit=100. RSS for this section: feed.xml.