CVE-2026-111356 | High | 7.4 | 2026-10-15 | MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, allowing unauthenticated attackers to take over member accou… |
CVE-2026-61611 | High | 7.5 | 2026-10-15 | Lychee is a free, open-source photo-management tool. Prior to 7.6.1, POST /api/v2/Album::unlock has no throttle, attempt counter, backoff, CAPTCHA, or lockout… |
CVE-2026-110861 | Low | 3.7 | 2026-10-14 | Better Auth @better-auth/drizzle-adapter and better-auth from 1.6.17 before 1.7.7, and @better-auth/kysely-adapter from 1.6.17 before 1.7.0, contain a race con… |
CVE-2026-69193 | Medium | 6.5 | 2026-10-14 | FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.21.0, FileRise tracks failed logins only by… |
CVE-2026-103977 | High | 8.1 | 2026-10-14 | FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise stores failed TOTP verificati… |
CVE-2026-110770 | High | 8.1 | 2026-10-14 | Databasus 3.7.0 through 3.61.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to brute-force password reset codes via PO… |
CVE-2026-93637 | Low | 3.7 | 2026-10-14 | An authentication rate-limit bypass in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to make repeated password guesses thr… |
CVE-2026-93346 | Medium | 5.3 | 2026-10-13 | Wazuh from 4.0.0 before 4.14.8 contains a race condition in API login throttling that allows unauthenticated attackers to bypass max_login_attempts by sending… |
CVE-2026-109949 | Medium | 6.5 | 2026-10-13 | FreeRDP 3.0.0 before 3.32.0 contains an improper restriction of excessive authentication attempts in its virtual smartcard GIDS implementation, which stores th… |
CVE-2026-18318 | Medium | 5.3 | 2026-10-13 | IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform brute-force attacks to obtain credentials due to improper authentication. |
CVE-2026-53997 | High | 7.4 | 2026-10-12 | Netherman Portal del Hermano (portaldelhermano.es) before 2026-10-06 contains a broken authentication vulnerability in its password-recovery flow at the POST /… |
CVE-2026-108580 | Medium | 6.5 | 2026-10-10 | AniWorld Downloader before 5.3.0 contains an improper restriction of authentication attempts vulnerability in the WebUI /login POST handler that allows unauthe… |
CVE-2026-108163 | Medium | 6.5 | 2026-10-10 | Pingvin Share X before 1.22.0 contains an ineffective rate limiting vulnerability because throttler TTL values specified in seconds are interpreted as millisec… |
CVE-2026-108109 | Critical | 9.1 | 2026-10-09 | PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password reset flow in system/controllers/forgot.php that allows unauth… |
CVE-2026-76779 | High | 7.4 | 2026-10-09 | Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Restriction of Excessive Authentication Attempts vulnerabi… |
CVE-2026-107638 | Medium | 6.8 | 2026-10-08 | pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an improper restriction of authentication attempts vulnerability that allows attackers to bypass two-… |
CVE-2026-105866 | High | 7.5 | 2026-10-06 | Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an unauthenticated… |
CVE-2026-105835 | High | 7.4 | 2026-10-06 | PLANKA 2.2.0 through 2.2.1 fails to limit incorrect TOTP codes submitted to POST /api/access-tokens/verify-totp, allowing attackers to brute force two-factor a… |
CVE-2026-105638 | Critical | 9.1 | 2026-10-05 | Plane is an open-source project management tool. Prior to 1.4.0, Plane's magic-code email login uses a six-digit numeric OTP with approximately 20 bits of entr… |
CVE-2026-105237 | Low | 3.7 | 2026-10-05 | A vulnerability was detected in linlinjava litemall up to 1.8.0. This affects an unknown part of the file litemall-admin-api/src/main/java/org/linlinjava/litem… |
CVE-2026-97363 | High | 7.5 | 2026-10-02 | The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacke… |
CVE-2026-102825 | Low | 3.7 | 2026-09-29 | Russh is a Rust SSH client and server library. Prior to 0.62.6, the USERAUTH_REQUEST path reached from server::run_stream in russh/src/server/encrypted.rs incr… |
CVE-2026-102334 | High | 7.4 | 2026-09-28 | Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses again… |
CVE-2026-100678 | Medium | 6.5 | 2026-09-26 | stoatchat before 0.15.5 fails to enforce account-level attempt limits on MFA login challenges, allowing attackers who know a password to guess TOTP codes with… |
CVE-2026-100501 | Medium | 6.5 | 2026-09-25 | Flame through 2.4.0 contains an improper restriction of excessive authentication attempts vulnerability in the POST /api/auth login endpoint that allows unauth… |
CVE-2026-84461 | | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, the two-factor login step let an attacker try unlimited password guesses fo… |
CVE-2026-49470 | | | 2026-09-25 | GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, the time-based one-time password verification endpoint does not limit failed… |
CVE-2026-37603 | Medium | 6.5 | 2026-09-22 | Improper Restriction of Excessive Authentication Attempts in the administration login of pH7Software pH7Builder (pH7 Social Dating CMS) through 19.2.0. The CAP… |
CVE-2026-85734 | Critical | 9.1 | 2026-09-22 | LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the POST /login endpoint in lightrag/api/lightrag_server.py does not impose a… |
CVE-2026-56682 | Medium | 5.3 | 2026-09-22 | 9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without the sanitizing custom-server.js wrapper… |
CVE-2026-46649 | | | 2026-09-21 | Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's GET /api/login_with_c… |
CVE-2026-58271 | Medium | 6.8 | 2026-09-21 | Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, `POST /api/app/sync/register` accepts… |
CVE-2026-77561 | Medium | 5.3 | 2026-09-21 | Tinyauth is an authentication and authorization server. Prior to 5.1.0, an unauthenticated remote attacker can send POST /api/user/login requests with 257 dist… |
CVE-2026-93650 | Low | 3.7 | 2026-09-18 | A vulnerability was determined in Saleor up to 3.20.118/3.21.54/3.22.47/3.23.14. This vulnerability affects the function get_client_ip of the file saleor/accou… |
CVE-2026-56592 | Medium | 6.5 | 2026-09-18 | HCL BigFix Service Management is affected by an Improper Authentication validation vulnerability related to inadequate account lockouts, which could allow an u… |
CVE-2026-40538 | Low | 3.7 | 2026-09-18 | An improper restriction of excessive authentication attempts vulnerability in Auto block in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-728… |
CVE-2026-92583 | Medium | 6.5 | 2026-09-16 | AVideo through 29.0 contains a race condition in the enforceRateLimit() function that fails to atomically increment rate limit counters, allowing attackers to… |
CVE-2026-91973 | High | 7.5 | 2026-09-15 | Vikunja before 2.6.0 contains an authentication bypass vulnerability in CalDAV BasicAuth endpoints that lack rate limiting protection. Remote unauthenticated a… |
CVE-2026-91972 | High | 7.5 | 2026-09-15 | Vikunja versions before 2.6.0 fail to apply rate limiting to /api/v2 public authentication endpoints including login, register, password-reset, and OAuth token… |
CVE-2026-92082 | | | 2026-09-15 | By default, Payara Server does not limit the number of failed login attempts, which can leave it vulnerable to brute force login attacks. To mitigate this, Pay… |
CVE-2026-55795 | | | 2026-09-14 | Craft Commerce is an ecommerce platform for Craft CMS. From 4.0.0 until 4.11.2 and 5.6.5, CartController in src/controllers/CartController.php activates its Ra… |
CVE-2026-89174 | High | 7.5 | 2026-09-11 | Smart Video Intercom System developed by Kingdom Communication Associated has a Missing Brute-force Protection vulnerability. Unauthenticated remote attackers… |
CVE-2026-88770 | Medium | 6.5 | 2026-09-10 | A flaw was found in the Device Authorization Grant flow of Keycloak, an identity and access management solution. The issue occurs because the token redemption… |
CVE-2026-78490 | High | 7.5 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Restriction of Excessive Au… |
CVE-2026-86729 | High | 7.4 | 2026-09-08 | WWBN AVideo through commit e01e41ecc (no patched version available) exposes get_api_preauthorize in plugin/API/API.php as a second, undocumented login path. Un… |
CVE-2026-6223 | Critical | 9.4 | 2026-09-07 | Improper restriction of excessive authentication attempts vulnerability in Bahçelievler Muncipality BiHayat App allows Authentication Bypass.
This issue affec… |
CVE-2026-20514 | Medium | 4.4 | 2026-09-07 | In Audio HAL, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure if a malicious acto… |
CVE-2026-20512 | Medium | 6.7 | 2026-09-07 | In Audio HAL, there is a possible escalation of privilege due to improper input validation. This could lead to local escalation of privilege if a malicious act… |
CVE-2026-86186 | Medium | 6.5 | 2026-09-05 | AVideo API fails to enforce rate limits when clients send a bot User-Agent header, allowing attackers to bypass all eight protected operations including login… |
CVE-2026-85237 | High | 8.1 | 2026-09-03 | A vulnerability in MISP's email-based one-time password (OTP) authentication flow allowed an attacker to perform an unrestricted number of OTP verification att… |
CVE-2026-16675 | | | 2026-09-01 | A privilege escalation security issue exists within FactoryTalk® Activation Manager. The security issue stems from custom actions in the installer that spawn v… |
CVE-2026-13348 | | | 2026-09-01 | CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow an attacker to gain unauthorized access to a user acco… |
CVE-2026-82644 | High | 7.5 | 2026-08-30 | WWBN AVideo (current e01e41ecc and earlier) contains a brute-force rate limiting bypass in enforceRateLimit(), which protects login.json.php and 13 other endpo… |
CVE-2026-82643 | Medium | 6.5 | 2026-08-30 | WWBN AVideo contains an unauthenticated credential submission vulnerability in plugin/Live/api/preauthorize.json.php that accepts credentials over GET without… |
CVE-2026-78617 | | | 2026-08-28 | WatchGuard Dimension's web login endpoint does not enforce effective rate-limiting or account lockout by default allowing a remote attacker to perform automate… |
CVE-2026-76940 | High | 7.5 | 2026-08-28 | The affected Ebyte device does not restrict repeated authentication
attempts through rate limiting or account lockout mechanisms. This could
allow an attacke… |
CVE-2026-18260 | Medium | 5.7 | 2026-08-25 | Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Disable Login Page allows Brute Force. This issue affects Disable Login Page… |
CVE-2026-78655 | Critical | 9.1 | 2026-08-25 | Punk::Plugin::TOTP versions before 0.05 for Perl allow the second-factor attempt limit to be reset by replaying an earlier session cookie because the challenge… |
CVE-2026-62862 | | | 2026-08-25 | Typebot is an open-source chatbot builder. In self-hosted versions up to and including 3.17.1, the default passwordless email magic-link authentication is vuln… |
CVE-2026-75575 | Medium | 5.3 | 2026-08-25 | Rocket.Chat exposes the sendForgotPasswordEmail Meteor method without a DDP rate limit, so an unauthenticated caller may invoke it as often as it likes. The me… |
CVE-2026-78551 | | | 2026-08-24 | RansomLook contains multiple weaknesses in its authentication endpoint that allow an unauthenticated remote attacker to enumerate valid usernames, perform unre… |
CVE-2026-21755 | Medium | 5.3 | 2026-08-24 | HCL Hive is affected by a missing rate limit which could allow an attacker unauthorized access via brute-force or credential stuffing attacks, or cause a denia… |
CVE-2026-69183 | High | 7.5 | 2026-08-20 | Monkeytype is a minimalistic and customizable typing test. In 26.26.0 and earlier, the backend rate-limit key generator in backend/src/middlewares/rate-limit.t… |
CVE-2026-76213 | High | 7.4 | 2026-08-19 | phpMyFAQ before 4.1.7 contains a brute-force vulnerability in the two-factor authentication step where the failure counter is session-scoped and reset on each… |
CVE-2026-73529 | Medium | 5.3 | 2026-08-18 | Plainpad through 1.1.1, fixed in commit d3823fc, contains a missing rate limiting vulnerability that allows unauthenticated attackers to send unbounded login r… |
CVE-2026-75773 | Low | 3.7 | 2026-08-18 | A vulnerability was found in karakeep-app karakeep up to 0.32.0. The affected element is the function authorize of the file apps/web/server/auth.ts of the comp… |
CVE-2026-74868 | High | 7.5 | 2026-08-17 | SiYuan versions before 3.7.4 contain an unthrottled brute-force vulnerability in the Publish Service Basic Auth implementation (PublishServiceTransport.RoundTr… |
CVE-2026-73056 | Critical | 9.8 | 2026-08-16 | SiYuan kernel versions before 3.7.4 contain an improper restriction of excessive authentication attempts vulnerability in the CheckAuth() middleware. The middl… |
CVE-2026-73046 | Critical | 9.8 | 2026-08-15 | SiYuan before v3.7.4 improperly restricts excessive authentication attempts in the CheckAuth() middleware. The HTTP Basic Authentication branch, which guards n… |
CVE-2026-73045 | High | 7.5 | 2026-08-15 | SiYuan before 3.7.4 contains an improper restriction of excessive authentication attempts vulnerability in the authFilePublishAccess endpoint that allows unaut… |
CVE-2026-19898 | Low | 3.7 | 2026-08-15 | A vulnerability was found in VictoriaMetrics up to 1.146.0. Impacted is the function requestHandler of the file app/vmauth/main.go of the component VMAuth Auth… |
CVE-2026-19897 | Low | 3.7 | 2026-08-15 | A vulnerability has been found in mangroup dtale up to 3.22.0. This issue affects the function Login of the file dtale/auth.py of the component Login Endpoint… |
CVE-2026-19895 | Low | 3.7 | 2026-08-15 | A vulnerability was detected in opensourcepos Open Source Point of Sale up to 3.4.2. This affects the function Login::index of the file app/Config/Filters.php… |
CVE-2026-19297 | Critical | 9.1 | 2026-08-13 | IBM Langflow OSS 1.0.0 through 1.9.6 could allow a remote attacker to obtain unauthorized access to user accounts due to improper restriction of excessive auth… |
CVE-2025-62314 | Medium | 5.6 | 2026-08-13 | HCL AION is affected by a vulnerability where certain endpoints lack sufficient anti-automation controls. Automated or scripted requests may be submitted witho… |
CVE-2026-66340 | Medium | 5.3 | 2026-08-11 | The Mira cloud authentication endpoints do not enforce per-account rate limiting, per-IP throttling, or account lockout after repeated failed login attempts. A… |
CVE-2026-65948 | High | 7.3 | 2026-08-10 | UnixAuth lacks brute-force protection in Apache Ranger versions <= 2.8.0.
Note: UnixAuth is NOT a recommended option for production deployments.
Users are r… |
CVE-2026-48084 | High | 7.4 | 2026-08-06 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Versions prior to 1.0.2 don't throttle failed passp… |
CVE-2026-48071 | Medium | 5.8 | 2026-08-06 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.4, the PIN-type challenge thro… |
CVE-2026-16619 | High | 7.5 | 2026-08-06 | The miniOrange 2FA WordPress plugin before 6.2.8 does not correctly limit the number of second-factor verification attempts, tracking them against a client-sup… |
CVE-2026-71213 | Critical | 9.1 | 2026-08-05 | Typemill's login endpoint (POST /tm/login, ControllerWebAuth::login) performs no rate-limiting, failed-attempt counting, or account lockout when captcha is dis… |
CVE-2026-71205 | Medium | 6.5 | 2026-08-05 | changedetection.io's /login route checks the submitted password against a single PBKDF2-HMAC-SHA256 hash with no per-IP or per-session rate limiting, failed-at… |
CVE-2026-8793 | | | 2026-08-03 | PaperCut NG/MF does not properly restrict excessive authentication attempts within its login component. An unauthenticated remote attacker can exploit this vul… |
CVE-2026-15144 | High | 7.3 | 2026-07-29 | @fastify/rate-limit before 11.2.0 keys rate-limit buckets by the verbatim client IP string returned from request.ip. Because a single IPv6 client can control a… |
CVE-2026-16347 | High | 8.8 | 2026-07-28 | MikroTik RouterOS contains a weakness in its API authentication handling that lacks effective safeguards against excessive login attempts. The system does not… |
CVE-2026-55977 | Low | 3.3 | 2026-07-28 | Successful exploitation of this vulnerability
could allow an attacker with local network access to bypass the application's
rate-limiting mechanism, enabling b… |
CVE-2026-65894 | | | 2026-07-27 | This vulnerability exists in CP PLUS EZ-P21 IP Camera due to improper authentication of HTTP endpoints. A remote attacker could exploit this vulnerability by c… |
CVE-2026-8285 | Medium | 4.3 | 2026-07-21 | Improper restriction of excessive authentication attempts vulnerability in Universal Software Inc. FlexCity allows Excessive Allocation.
This issue affects Fl… |
CVE-2026-32825 | High | 7.3 | 2026-07-20 | dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core p… |
CVE-2026-62220 | Medium | 5.3 | 2026-07-17 | OpenClaw 2026.2.25 before 2026.5.26 allow a lower-trust caller or configured input path to bypass non-browser rate limits on WebSocket authentication attempts… |
CVE-2026-44596 | Medium | 6.5 | 2026-07-16 | Yamcs is a mission control framework. Prior to 5.12.7, the authentication endpoint POST /auth/token in yamcs-core, handled by yamcs-core/src/main/java/org/yamc… |
CVE-2026-14254 | | | 2026-07-16 | A race condition in the account lockout mechanism in Delphix Continous Data allowed the lockout threshold to be bypassed through concurrent authentication requ… |
CVE-2026-61458 | High | 7.5 | 2026-07-13 | PasswordPusher before 2.9.2 contains a brute-force vulnerability in the POST /p/:token/access endpoint that lacks route-specific rate limiting and per-push loc… |
CVE-2026-42952 | High | 7.5 | 2026-07-10 | Previously, there was no throttling on repeated authentication attempts
to the charging station backend, which could allow an attacker to
execute a denial-of… |
CVE-2026-11915 | Medium | 5.9 | 2026-07-10 | vulnerability in Drupal Brute force attack protection allows . This issue affects Brute force attack protection versions: *.*. |
CVE-2026-15079 | Medium | 5.4 | 2026-07-10 | Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Login Disable allows Brute Force. This issue affects Login Disable versions… |
CVE-2026-55501 | High | 7.3 | 2026-07-10 | 9Router is an AI router & token saver. Prior to 0.4.80, the dashboard login rate limiter in src/lib/auth/loginLimiter.js derives the client identity from the a… |
CVE-2026-53904 | High | 7.1 | 2026-07-01 | MCO is vulnerable to Account Denial of Service due to improper implementation of password reset functionality. Each password reset request invalidates previous… |
CVE-2026-35098 | | | 2026-06-30 | KTM System e-BOK does not implement any limit or timeout on consecutive login attempts, allowing an attacker to perform unlimited authentication requests. This… |
CVE-2026-11779 | | | 2026-06-26 | An Improper Authorization vulnerability exists in PayloadCMS version 3.84.1 due to insufficient access control on the account unlock operation. |