Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N N N L N N 6.9 .0025 16.3 —
AFFECTED Product Versions Fixed djangoSIGE unspecified —
TIMELINE Jul 20 Reserved by VulnCheck Jul 21 Published (CNA: VulnCheck) Jul 22 EXPLOIT PUBLISHED — CVE-2026-64822 (thiagopena djangoSIGE). Public exploit reference added.
djangoSIGE through 1.10 (commit a6fe7e8) contains a user enumeration vulnerability in ForgotPasswordView within djangosige/apps/login/views.py that allows unauthenticated attackers to identify valid accounts by observing distinct error messages returned by the password reset endpoint. Attackers can submit arbitrary usernames or email addresses to the POST login/esqueceu/ endpoint and distinguish between existing and non-existing accounts based on observable discrepancies in the application's responses.
| Date | Event | Detail |
|---|---|---|
| July 20, 2026 | Reserved | Reserved by VulnCheck |
| July 21, 2026 | Published | Published (CNA: VulnCheck) |
| July 22, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-64822 (thiagopena djangoSIGE). Public exploit reference added. |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| thiagopena | djangoSIGE | — | — | — |
Authoritative record: CVE-2026-64822 at cve.org
Vendors: thiagopena
Weaknesses: CWE-203
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-64822 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.