Vulnerability Instance
Lookup for vulnerabilities affecting packages.
GET /api/vulnerabilities/70735?format=api
{ "url": "http://public2.vulnerablecode.io/api/vulnerabilities/70735?format=api", "vulnerability_id": "VCID-9msv-tm48-8fb4", "summary": "Known is a social publishing platform. Prior to 1.6.3, a Critical Broken Authentication vulnerability exists in Known 1.6.2 and earlier. The application leaks the password reset token within a hidden HTML input field on the password reset page. This allows any unauthenticated attacker to retrieve the reset token for any user by simply querying the user's email, leading to full Account Takeover (ATO) without requiring access to the victim's email inbox. This vulnerability is fixed in 1.6.3.", "aliases": [ { "alias": "CVE-2026-26273" }, { "alias": "GHSA-78wq-6gcv-w28r" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/39175?format=api", "purl": "pkg:composer/idno/known@1.6.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-r4xw-g2d1-63az" }, { "vulnerability": "VCID-s48j-nt53-bub4" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/idno/known@1.6.3" } ], "affected_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/575272?format=api", "purl": "pkg:composer/idno/known@1.0.0-rc.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4atb-vqed-nydx" }, { "vulnerability": "VCID-7jnu-xc23-rkat" }, { "vulnerability": "VCID-9msv-tm48-8fb4" }, { "vulnerability": "VCID-jkfu-rn7s-w3c5" }, { "vulnerability": "VCID-r4xw-g2d1-63az" }, { "vulnerability": "VCID-s48j-nt53-bub4" }, { "vulnerability": "VCID-tbn2-4npp-3uee" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/idno/known@1.0.0-rc.1" }, { "url": "http://public2.vulnerablecode.io/api/packages/575273?format=api", "purl": "pkg:composer/idno/known@1.0.0-rc.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4atb-vqed-nydx" }, { "vulnerability": "VCID-7jnu-xc23-rkat" }, { "vulnerability": "VCID-9msv-tm48-8fb4" }, { "vulnerability": "VCID-jkfu-rn7s-w3c5" }, { "vulnerability": "VCID-r4xw-g2d1-63az" }, { "vulnerability": "VCID-s48j-nt53-bub4" }, { "vulnerability": "VCID-tbn2-4npp-3uee" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/idno/known@1.0.0-rc.3" }, { "url": "http://public2.vulnerablecode.io/api/packages/575274?format=api", "purl": "pkg:composer/idno/known@1.0.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4atb-vqed-nydx" }, { "vulnerability": "VCID-7jnu-xc23-rkat" }, { "vulnerability": "VCID-9msv-tm48-8fb4" }, { "vulnerability": "VCID-jkfu-rn7s-w3c5" }, { "vulnerability": "VCID-r4xw-g2d1-63az" }, { "vulnerability": "VCID-s48j-nt53-bub4" }, { "vulnerability": "VCID-tbn2-4npp-3uee" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/idno/known@1.0.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/575275?format=api", "purl": "pkg:composer/idno/known@1.2.2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4atb-vqed-nydx" }, { "vulnerability": "VCID-7jnu-xc23-rkat" }, { "vulnerability": "VCID-9msv-tm48-8fb4" }, { "vulnerability": "VCID-jkfu-rn7s-w3c5" }, { "vulnerability": "VCID-r4xw-g2d1-63az" }, { "vulnerability": "VCID-s48j-nt53-bub4" }, { "vulnerability": "VCID-tbn2-4npp-3uee" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/idno/known@1.2.2" }, { "url": "http://public2.vulnerablecode.io/api/packages/943818?format=api", "purl": "pkg:composer/idno/known@1.5", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-9msv-tm48-8fb4" }, { "vulnerability": "VCID-r4xw-g2d1-63az" }, { "vulnerability": "VCID-s48j-nt53-bub4" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/idno/known@1.5" }, { "url": "http://public2.vulnerablecode.io/api/packages/39174?format=api", "purl": "pkg:composer/idno/known@1.6.2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-9msv-tm48-8fb4" }, { "vulnerability": "VCID-r4xw-g2d1-63az" }, { "vulnerability": "VCID-s48j-nt53-bub4" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/idno/known@1.6.2" } ], "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-26273", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00329", "scoring_system": "epss", "scoring_elements": "0.56327", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.00329", "scoring_system": "epss", "scoring_elements": "0.56341", "published_at": "2026-06-13T12:55:00Z" }, { "value": "0.00329", "scoring_system": "epss", "scoring_elements": "0.56207", "published_at": "2026-06-11T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-26273" }, { "reference_url": "https://github.com/idno/known", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/idno/known" }, { "reference_url": "https://github.com/idno/known/releases/tag/1.6.3", "reference_id": "1.6.3", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track*", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2026-02-17T20:00:43Z/" } ], "url": "https://github.com/idno/known/releases/tag/1.6.3" }, { "reference_url": "https://github.com/idno/known/commit/8439a0747471559fb1ea9f074b929d390f27e66a", "reference_id": "8439a0747471559fb1ea9f074b929d390f27e66a", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track*", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2026-02-17T20:00:43Z/" } ], "url": "https://github.com/idno/known/commit/8439a0747471559fb1ea9f074b929d390f27e66a" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26273", "reference_id": "CVE-2026-26273", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26273" }, { "reference_url": "https://github.com/advisories/GHSA-78wq-6gcv-w28r", "reference_id": "GHSA-78wq-6gcv-w28r", "reference_type": "", "scores": [ { "value": "CRITICAL", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-78wq-6gcv-w28r" }, { "reference_url": "https://github.com/idno/known/security/advisories/GHSA-78wq-6gcv-w28r", "reference_id": "GHSA-78wq-6gcv-w28r", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track*", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2026-02-17T20:00:43Z/" } ], "url": "https://github.com/idno/known/security/advisories/GHSA-78wq-6gcv-w28r" } ], "weaknesses": [ { "cwe_id": 200, "name": "Exposure of Sensitive Information to an Unauthorized Actor", "description": "The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information." }, { "cwe_id": 640, "name": "Weak Password Recovery Mechanism for Forgotten Password", "description": "The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak." }, { "cwe_id": 937, "name": "OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities", "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013." }, { "cwe_id": 1035, "name": "OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities", "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017." } ], "exploits": [], "severity_range_score": "9.0 - 10.0", "exploitability": "0.5", "weighted_severity": "9.0", "risk_score": 4.5, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-9msv-tm48-8fb4" }