Is CVE-2026-10836 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-10836 being exploited in the wild.

How severe is CVE-2026-10836?

Informational severity, with a CVSS score of 5.1, published 17 June 2026.

Which products and versions are affected?

Password Manager (eusonlito) Password Manager versions prior to August 7, 2025.

Is there a fix for CVE-2026-10836?

A patch was published on 2025-08-07: Vulnerabilities fixed by the Password Manager team. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-10836 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-10836?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-10836: Password Manager Host header manipulation

CVE-2026-10836 · Severity: info · CVSS 5.1 · Published 2026-06-17

Password Manager, an application used to store and manage credentials, contains a vulnerability in how it processes web requests. An attacker can send specially crafted messages to manipulate the application's internal links and responses. This could lead to users being directed to incorrect services or the exposure of limited sensitive information.

Quick answers

Is CVE-2026-10836 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-10836 being exploited in the wild.
How severe is CVE-2026-10836?: Informational severity, with a CVSS score of 5.1, published 17 June 2026.
Which products and versions are affected?: Password Manager (eusonlito) Password Manager versions prior to August 7, 2025.
Is there a fix for CVE-2026-10836?: A patch was published on 2025-08-07: Vulnerabilities fixed by the Password Manager team. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-10836 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-10836?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Host Header Injection vulnerability (CWE-644) exists in Password Manager due to improper neutralization of HTTP headers. A remote, unauthenticated attacker can manipulate the Host header via specially crafted requests. If the application uses this header to generate absolute URLs in links or password reset emails, it can lead to web cache poisoning or redirection of sensitive data to an attacker-controlled domain. The vulnerability requires some user interaction and was addressed in the update released on August 7, 2025.

Affected products

Password Manager (eusonlito) Password Manager versions prior to August 7, 2025

Timeline

2025-08-07: patched: Vulnerabilities fixed by the Password Manager team.
2026-05-06: disclosed: Initial disclosure by INCIBE-CERT.
2026-06-17: advisory: NVD publication date.

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-password-manager

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.