CVE-2026-19898 | Low | 3.7 | 2026-08-15 | A vulnerability was found in VictoriaMetrics up to 1.146.0. Impacted is the function requestHandler of the file app/vmauth/main.go of the component VMAuth Auth… |
CVE-2026-19897 | Low | 3.7 | 2026-08-15 | A vulnerability has been found in mangroup dtale up to 3.22.0. This issue affects the function Login of the file dtale/auth.py of the component Login Endpoint… |
CVE-2026-19895 | Low | 3.7 | 2026-08-15 | A vulnerability was detected in opensourcepos Open Source Point of Sale up to 3.4.2. This affects the function Login::index of the file app/Config/Filters.php… |
CVE-2026-19297 | Critical | 9.1 | 2026-08-13 | IBM Langflow OSS 1.0.0 through 1.9.6 could allow a remote attacker to obtain unauthorized access to user accounts due to improper restriction of excessive auth… |
CVE-2025-62314 | Medium | 5.6 | 2026-08-13 | HCL AION is affected by a vulnerability where certain endpoints lack sufficient anti-automation controls. Automated or scripted requests may be submitted witho… |
CVE-2026-66340 | Medium | 5.3 | 2026-08-11 | The Mira cloud authentication endpoints do not enforce per-account rate limiting, per-IP throttling, or account lockout after repeated failed login attempts. A… |
CVE-2026-65948 | High | 7.3 | 2026-08-10 | UnixAuth lacks brute-force protection in Apache Ranger versions <= 2.8.0.
Note: UnixAuth is NOT a recommended option for production deployments.
Users are r… |
CVE-2026-48084 | High | 7.4 | 2026-08-06 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Versions prior to 1.0.2 don't throttle failed passp… |
CVE-2026-48071 | Medium | 5.8 | 2026-08-06 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.4, the PIN-type challenge thro… |
CVE-2026-16619 | High | 7.5 | 2026-08-06 | The miniOrange 2FA WordPress plugin before 6.2.8 does not correctly limit the number of second-factor verification attempts, tracking them against a client-sup… |
CVE-2026-71213 | Critical | 9.1 | 2026-08-05 | Typemill's login endpoint (POST /tm/login, ControllerWebAuth::login) performs no rate-limiting, failed-attempt counting, or account lockout when captcha is dis… |
CVE-2026-71205 | Medium | 6.5 | 2026-08-05 | changedetection.io's /login route checks the submitted password against a single PBKDF2-HMAC-SHA256 hash with no per-IP or per-session rate limiting, failed-at… |
CVE-2026-8793 | | | 2026-08-03 | PaperCut NG/MF does not properly restrict excessive authentication attempts within its login component. An unauthenticated remote attacker can exploit this vul… |
CVE-2026-15144 | High | 7.3 | 2026-07-29 | @fastify/rate-limit before 11.2.0 keys rate-limit buckets by the verbatim client IP string returned from request.ip. Because a single IPv6 client can control a… |
CVE-2026-16347 | High | 8.8 | 2026-07-28 | MikroTik RouterOS contains a weakness in its API authentication handling that lacks effective safeguards against excessive login attempts. The system does not… |
CVE-2026-55977 | Low | 3.3 | 2026-07-28 | Successful exploitation of this vulnerability
could allow an attacker with local network access to bypass the application's
rate-limiting mechanism, enabling b… |
CVE-2026-65894 | | | 2026-07-27 | This vulnerability exists in CP PLUS EZ-P21 IP Camera due to improper authentication of HTTP endpoints. A remote attacker could exploit this vulnerability by c… |
CVE-2026-8285 | Medium | 4.3 | 2026-07-21 | Improper restriction of excessive authentication attempts vulnerability in Universal Software Inc. FlexCity allows Excessive Allocation.
This issue affects Fl… |
CVE-2026-32825 | High | 7.3 | 2026-07-20 | dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core p… |
CVE-2026-62220 | Medium | 5.3 | 2026-07-17 | OpenClaw 2026.2.25 before 2026.5.26 allow a lower-trust caller or configured input path to bypass non-browser rate limits on WebSocket authentication attempts… |
CVE-2026-44596 | Medium | 6.5 | 2026-07-16 | Yamcs is a mission control framework. Prior to 5.12.7, the authentication endpoint POST /auth/token in yamcs-core, handled by yamcs-core/src/main/java/org/yamc… |
CVE-2026-14254 | | | 2026-07-16 | A race condition in the account lockout mechanism in Delphix Continous Data allowed the lockout threshold to be bypassed through concurrent authentication requ… |
CVE-2026-61458 | High | 7.5 | 2026-07-13 | PasswordPusher before 2.9.2 contains a brute-force vulnerability in the POST /p/:token/access endpoint that lacks route-specific rate limiting and per-push loc… |
CVE-2026-42952 | High | 7.5 | 2026-07-10 | Previously, there was no throttling on repeated authentication attempts
to the charging station backend, which could allow an attacker to
execute a denial-of… |
CVE-2026-11915 | Medium | 5.9 | 2026-07-10 | vulnerability in Drupal Brute force attack protection allows . This issue affects Brute force attack protection versions: *.*. |
CVE-2026-15079 | Medium | 5.4 | 2026-07-10 | Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Login Disable allows Brute Force. This issue affects Login Disable versions… |
CVE-2026-55501 | High | 7.3 | 2026-07-10 | 9Router is an AI router & token saver. Prior to 0.4.80, the dashboard login rate limiter in src/lib/auth/loginLimiter.js derives the client identity from the a… |
CVE-2026-53904 | High | 7.1 | 2026-07-01 | MCO is vulnerable to Account Denial of Service due to improper implementation of password reset functionality. Each password reset request invalidates previous… |
CVE-2026-35098 | | | 2026-06-30 | KTM System e-BOK does not implement any limit or timeout on consecutive login attempts, allowing an attacker to perform unlimited authentication requests. This… |
CVE-2026-11779 | | | 2026-06-26 | An Improper Authorization vulnerability exists in PayloadCMS version 3.84.1 due to insufficient access control on the account unlock operation. |
CVE-2026-50176 | High | 7.5 | 2026-06-25 | The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacke… |
CVE-2026-47380 | | | 2026-06-23 | NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, sign-in response timing differed between known and unknown email addresses becau… |
CVE-2026-56234 | Medium | 5.3 | 2026-06-23 | Capgo before 12.128.2 contains a credential validation vulnerability in the POST /functions/v1/private/validate_password_compliance endpoint that is callable u… |
CVE-2026-56450 | | | 2026-06-22 | AIL did not restrict repeated failed attempts to verify a two-factor authentication (OTP) code. An attacker who had reached the 2FA verification step, such as… |
CVE-2026-47203 | | | 2026-06-19 | Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-on (SSO) for applications via a web port… |
CVE-2026-6853 | Critical | 9.8 | 2026-06-12 | Improper restriction of excessive authentication attempts vulnerability in Başbelen Group Food Cafe Businesses Industry and Trade Ltd. Co. Pause+ Mobile App al… |
CVE-2026-3329 | High | 7.5 | 2026-06-11 | A remote unauthenticated attacker may be able to conduct credential-guessing attacks against user accounts in Sonatype Nexus Repository via authentication endp… |
CVE-2026-43926 | | | 2026-06-04 | FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, the password reset confirmation endpoint `/client/reset-passwo… |
CVE-2026-36612 | Medium | 6.4 | 2026-06-03 | Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 enables WPS 2.0 by default with a weak lockout policy (60-second lockout after 10 attempts). |
CVE-2026-36607 | High | 8.8 | 2026-06-03 | Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 allows unauthenticated brute-force attacks via the TDDP password change endpoint (code=10), whi… |
CVE-2026-10216 | Low | 3.7 | 2026-06-01 | A vulnerability was detected in unitedbyai droidclaw up to 0.5.3. The affected element is an unknown function of the file server/src/routes/pairing.ts of the c… |
CVE-2026-49324 | Medium | 4.6 | 2026-05-29 | Uncontrolled resource consumption in the Wireless Control Module (WCM) of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an adjacent-network… |
CVE-2026-45364 | High | 7.3 | 2026-05-28 | Better Auth is an authentication and authorization library for TypeScript. Prior to 1.4.17 and 1.5.0-beta.9, Better Auth's HTTP rate limiter keyed each request… |
CVE-2026-35675 | High | 8.2 | 2026-05-28 | phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in the password reset endpoint that allows unauthenticated attackers to reset any user ac… |
CVE-2026-8760 | Critical | 9.8 | 2026-05-27 | The Login with OTP plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.6. This is due to an incomplete fix for… |
CVE-2026-1816 | Medium | 6.3 | 2026-05-21 | Improper restriction of excessive authentication attempts vulnerability in Turkiye Electricity Transmission Corporation (TEİAŞ) Mobile Application allows Brute… |
CVE-2020-37228 | Critical | 9.8 | 2026-05-16 | iDS6 DSSPro Digital Signage System 6.2 contains a CAPTCHA security bypass vulnerability that allows attackers to bypass authentication by requesting the autoLo… |
CVE-2026-45010 | Critical | 9.1 | 2026-05-15 | phpMyFAQ before 4.1.2 contains an improper restriction of excessive authentication attempts vulnerability in the /admin/check endpoint, which accepts arbitrary… |
CVE-2025-64526 | Medium | 5.3 | 2026-05-14 | Strapi is an open source headless content management system. In Strapi versions prior to 5.45.0, the rate-limit middleware in the users-permissions plugin deri… |
CVE-2025-62313 | Medium | 5.4 | 2026-05-14 | HCL AION is affected by a vulnerability where adequate protections against brute-force attempts are not enforced. This may allow repeated authentication attemp… |
CVE-2026-44195 | Medium | 5.3 | 2026-05-13 | OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.7, a logic flaw in the OPNsense lockout_handler allows an unauthenticated attacker to… |
CVE-2026-7255 | Medium | 6.5 | 2026-05-12 | ** UNSUPPORTED WHEN ASSIGNED ** An improper restriction of excessive authentication attempts vulnerability in the web management interface of Zyxel WRE6505 v2… |
CVE-2026-43914 | High | 7.3 | 2026-05-11 | Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.4, there is a security vulnerability in Vaultwarden that allows bypassing the login… |
CVE-2026-7820 | Medium | 6.5 | 2026-05-11 | Improper restriction of excessive authentication attempts (CWE-307) in pgAdmin 4.
pgAdmin enforces MAX_LOGIN_ATTEMPTS only inside its custom /authenticate/log… |
CVE-2026-41893 | High | 7.5 | 2026-05-09 | Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.25.0, the HTTP login endpoints (POST /login and POST /signalk/… |
CVE-2025-2514 | Medium | 5.3 | 2026-05-07 | Improper restriction of excessive authentication attempts vulnerability in Hitachi Virtual Storage Platform G130, G150, G350, G370, G700, G900, F350, F370, F70… |
CVE-2023-54347 | High | 7.5 | 2026-05-05 | OpenEMR 7.0.1 contains an authentication brute force vulnerability that allows attackers to bypass rate limiting protections by sending repeated login attempts… |
CVE-2026-7671 | Low | 3.7 | 2026-05-03 | A vulnerability has been found in CodeWise Tornet Scooter Mobile App 4.75 on iOS/Android. The impacted element is an unknown function of the file /TwoFactor. S… |
CVE-2026-36959 | High | 7.5 | 2026-04-30 | U-SPEED N300 router V1.0.0 does not implement rate limiting or account lockout protections on the /api/login endpoint. This allows an attacker on the local net… |
CVE-2026-26206 | Medium | 6.5 | 2026-04-29 | Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.0.0 to before version 4.14.4, Wazuh's server API b… |
CVE-2026-35902 | Medium | 6.2 | 2026-04-27 | The RTSP service of MERCURY IP camera MIPC252W 1.0.5 Build 230306 has an issue handling failed Digest authentication attempts. By repeatedly sending RTSP reque… |
CVE-2026-6947 | High | 7.5 | 2026-04-24 | DWM-222W USB Wi-Fi Adapter developed by D-Link has a Brute-Force Protection Bypass vulnerability, allowing unauthenticated adjacent network attackers to bypass… |
CVE-2026-41213 | Medium | 5.9 | 2026-04-23 | @node-oauth/oauth2-server is a module for implementing an OAuth2 server in Node.js. The token exchange path accepts RFC7636-invalid code_verifier values (inclu… |
CVE-2026-40586 | High | 7.5 | 2026-04-21 | blueprintUE is a tool to help Unreal Engine developers. Prior to 4.2.0, the login form handler performs no throttling of any kind. Failed authentication attemp… |
CVE-2025-14362 | High | 7.3 | 2026-04-21 | The login limit is not enforced on the SFTP service of Fortra's GoAnywhere MFT prior to 7.10.0 if the Web User attempting to be logged in to is configured to l… |
CVE-2026-41037 | High | 8.8 | 2026-04-21 | This vulnerability exists in Quantum Networks router due to missing rate limiting and CAPTCHA protection for failed login attempts in the web-based management… |
CVE-2026-40485 | Medium | 5.3 | 2026-04-18 | ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the public API login endpoint (/api/public/user/login) returns distinguishabl… |
CVE-2025-46606 | Medium | 6.2 | 2026-04-17 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 8.4 through 8.5 contain an improper restriction of excessiv… |
CVE-2026-22616 | Medium | 6.5 | 2026-04-16 | Eaton Intelligent Power Protector (IPP) software allows repeated authentication attempts against the web interface login page due to insufficient rate‑limiting… |
CVE-2026-33667 | High | 7.4 | 2026-04-15 | OpenProject is an open-source project management application. In versions prior to 17.3.0, 2FA OTP verification in the confirm_otp action of the two_factor_aut… |
CVE-2026-2402 | Medium | 5.3 | 2026-04-14 | CWE-307 Improper Restriction of Excessive Authentication Attempts vulnerability exists that would allow an attacker to gain access to the user account by perfo… |
CVE-2025-31991 | Medium | 6.8 | 2026-04-13 | Rate Limiting for attempting a user login is not being properly enforced, making HCL DevOps Velocity susceptible to brute-force attacks past the unsuccessful l… |
CVE-2026-35597 | Medium | 5.9 | 2026-04-10 | Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the TOTP failed-attempt lockout mechanism is non-functional due to a database t… |
CVE-2026-35646 | Medium | 4.8 | 2026-04-09 | OpenClaw before 2026.3.25 contains a pre-authentication rate-limit bypass vulnerability in webhook token validation that allows attackers to brute-force weak w… |
CVE-2026-35628 | Medium | 4.8 | 2026-04-09 | OpenClaw before 2026.3.25 contains a missing rate limiting vulnerability in Telegram webhook authentication that allows attackers to brute-force weak webhook s… |
CVE-2026-35623 | Medium | 4.8 | 2026-04-09 | OpenClaw before 2026.3.25 contains a missing rate limiting vulnerability in webhook authentication that allows attackers to brute-force weak webhook passwords… |
CVE-2026-33580 | Medium | 6.5 | 2026-03-31 | OpenClaw before 2026.3.28 contains a missing rate limiting vulnerability in the Nextcloud Talk webhook authentication that allows attackers to brute-force weak… |
CVE-2026-34505 | Medium | 6.5 | 2026-03-31 | OpenClaw before 2026.3.12 applies rate limiting only after successful webhook authentication, allowing attackers to bypass rate limits and brute-force webhook… |
CVE-2026-33879 | Critical | 9.8 | 2026-03-27 | Federated Learning and Interoperability Platform (FLIP) is an open-source platform for federated training and evaluation of medical imaging AI models across he… |
CVE-2026-33763 | Medium | 5.3 | 2026-03-27 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `get_api_video_password_is_correct` API endpoint allows any unauthentic… |
CVE-2026-33935 | High | 7.5 | 2026-03-27 | MyTube is a self-hosted downloader and player for several video websites Prior to version 1.8.72, an unauthenticated attacker can lock out administrator and vi… |
CVE-2026-33640 | Critical | 9.8 | 2026-03-26 | Outline is a service that allows for collaborative documentation. Outline implements an Email OTP login flow for users not associated with an Identity Provider… |
CVE-2026-33152 | Critical | 9.1 | 2026-03-26 | Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior to 2.6.0, Tandoor Recipes configures Dja… |
CVE-2026-33419 | High | 7.5 | 2026-03-24 | MinIO is a high-performance object storage system. Prior to RELEASE.2026-03-17T21-25-16Z, MinIO AIStor's STS (Security Token Service) AssumeRoleWithLDAPIdentit… |
CVE-2026-31851 | Critical | 9.8 | 2026-03-23 | Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 does not implement rate limiting or account lockout mechanisms on authentication interfaces. A… |
CVE-2026-31904 | High | 7.5 | 2026-03-20 | The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacke… |
CVE-2026-31903 | High | 7.5 | 2026-03-20 | The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacke… |
CVE-2026-32025 | High | 7.5 | 2026-03-19 | OpenClaw versions prior to 2026.2.25 contain an authentication hardening gap in browser-origin WebSocket clients that allows attackers to bypass origin checks… |
CVE-2026-32295 | High | 7.5 | 2026-03-17 | JetKVM before 0.5.4 does not rate limit login requests, enabling brute-force attempts to guess credentials. |
CVE-2026-32292 | High | 7.5 | 2026-03-17 | The GL-iNet Comet (GL-RM1) KVM web interface does not limit login requests, enabling brute-force attempts to guess credentials. |
CVE-2026-32729 | High | 8.1 | 2026-03-16 | Runtipi is a personal homeserver orchestrator. Prior to 4.8.1, The Runtipi /api/auth/verify-totp endpoint does not enforce any rate limiting, attempt counting… |
CVE-2025-69246 | Critical | 9.8 | 2026-03-16 | Raytha CMS does not have any brute force protection mechanism implemented. It allows an attacker to send multiple automated logon requests without triggering l… |
CVE-2026-31863 | Low | 3.6 | 2026-03-11 | Anytype Heart is the middleware library for Anytype. The challenge-based authentication for the local gRPC client API can be bypassed, allowing an attacker to… |
CVE-2025-66413 | High | 7.4 | 2026-03-10 | Git for Windows is the Windows port of Git. Prior to 2.53.0(2), it is possible to obtain a user's NTLM hash by tricking them into cloning from a malicious serv… |
CVE-2026-30959 | Medium | 5.0 | 2026-03-10 | OneUptime is a solution for monitoring and managing online services. The resend-verification-code endpoint allows any authenticated user to trigger a verificat… |
CVE-2026-22629 | Low | 3.7 | 2026-03-10 | An improper restriction of excessive authentication attempts vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4 all versions, Forti… |
CVE-2025-69615 | Critical | 9.1 | 2026-03-10 | Incorrect Access Control via missing 2FA rate-limiting allowing unlimited brute-force retries and full MFA bypass with no user interaction required. Affected P… |
CVE-2026-24696 | High | 7.5 | 2026-03-06 | The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacke… |
CVE-2026-20882 | High | 7.5 | 2026-03-06 | The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacke… |
CVE-2026-27778 | High | 7.5 | 2026-03-06 | The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacke… |