CVE-2026-102825 | Low | 3.7 | 2026-09-29 | Russh is a Rust SSH client and server library. Prior to 0.62.6, the USERAUTH_REQUEST path reached from server::run_stream in russh/src/server/encrypted.rs incr… |
CVE-2026-102334 | High | 7.4 | 2026-09-28 | Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses again… |
CVE-2026-100678 | Medium | 6.5 | 2026-09-26 | stoatchat before 0.15.5 fails to enforce account-level attempt limits on MFA login challenges, allowing attackers who know a password to guess TOTP codes with… |
CVE-2026-100501 | Medium | 6.5 | 2026-09-25 | Flame through 2.4.0 contains an improper restriction of excessive authentication attempts vulnerability in the POST /api/auth login endpoint that allows unauth… |
CVE-2026-84461 | | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, the two-factor login step let an attacker try unlimited password guesses fo… |
CVE-2026-49470 | | | 2026-09-25 | GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, the time-based one-time password verification endpoint does not limit failed… |
CVE-2026-37603 | Medium | 6.5 | 2026-09-22 | Improper Restriction of Excessive Authentication Attempts in the administration login of pH7Software pH7Builder (pH7 Social Dating CMS) through 19.2.0. The CAP… |
CVE-2026-85734 | Critical | 9.1 | 2026-09-22 | LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the POST /login endpoint in lightrag/api/lightrag_server.py does not impose a… |
CVE-2026-56682 | Medium | 5.3 | 2026-09-22 | 9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without the sanitizing custom-server.js wrapper… |
CVE-2026-46649 | | | 2026-09-21 | Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's GET /api/login_with_c… |
CVE-2026-58271 | Medium | 6.8 | 2026-09-21 | Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, `POST /api/app/sync/register` accepts… |
CVE-2026-77561 | Medium | 5.3 | 2026-09-21 | Tinyauth is an authentication and authorization server. Prior to 5.1.0, an unauthenticated remote attacker can send POST /api/user/login requests with 257 dist… |
CVE-2026-93650 | Low | 3.7 | 2026-09-18 | A vulnerability was determined in Saleor up to 3.20.118/3.21.54/3.22.47/3.23.14. This vulnerability affects the function get_client_ip of the file saleor/accou… |
CVE-2026-56592 | Medium | 6.5 | 2026-09-18 | HCL BigFix Service Management is affected by an Improper Authentication validation vulnerability related to inadequate account lockouts, which could allow an u… |
CVE-2026-40538 | Low | 3.7 | 2026-09-18 | An improper restriction of excessive authentication attempts vulnerability in Auto block in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-728… |
CVE-2026-92583 | Medium | 6.5 | 2026-09-16 | AVideo through 29.0 contains a race condition in the enforceRateLimit() function that fails to atomically increment rate limit counters, allowing attackers to… |
CVE-2026-91973 | High | 7.5 | 2026-09-15 | Vikunja before 2.6.0 contains an authentication bypass vulnerability in CalDAV BasicAuth endpoints that lack rate limiting protection. Remote unauthenticated a… |
CVE-2026-91972 | High | 7.5 | 2026-09-15 | Vikunja versions before 2.6.0 fail to apply rate limiting to /api/v2 public authentication endpoints including login, register, password-reset, and OAuth token… |
CVE-2026-92082 | | | 2026-09-15 | By default, Payara Server does not limit the number of failed login attempts, which can leave it vulnerable to brute force login attacks. To mitigate this, Pay… |
CVE-2026-55795 | | | 2026-09-14 | Craft Commerce is an ecommerce platform for Craft CMS. From 4.0.0 until 4.11.2 and 5.6.5, CartController in src/controllers/CartController.php activates its Ra… |
CVE-2026-89174 | High | 7.5 | 2026-09-11 | Smart Video Intercom System developed by Kingdom Communication Associated has a Missing Brute-force Protection vulnerability. Unauthenticated remote attackers… |
CVE-2026-88770 | Medium | 6.5 | 2026-09-10 | A flaw was found in the Device Authorization Grant flow of Keycloak, an identity and access management solution. The issue occurs because the token redemption… |
CVE-2026-78490 | High | 7.5 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Restriction of Excessive Au… |
CVE-2026-86729 | High | 7.4 | 2026-09-08 | WWBN AVideo through commit e01e41ecc (no patched version available) exposes get_api_preauthorize in plugin/API/API.php as a second, undocumented login path. Un… |
CVE-2026-6223 | Critical | 9.4 | 2026-09-07 | Improper restriction of excessive authentication attempts vulnerability in Bahçelievler Muncipality BiHayat App allows Authentication Bypass.
This issue affec… |
CVE-2026-20514 | Medium | 4.4 | 2026-09-07 | In Audio HAL, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure if a malicious acto… |
CVE-2026-20512 | Medium | 6.7 | 2026-09-07 | In Audio HAL, there is a possible escalation of privilege due to improper input validation. This could lead to local escalation of privilege if a malicious act… |
CVE-2026-86186 | Medium | 6.5 | 2026-09-05 | AVideo API fails to enforce rate limits when clients send a bot User-Agent header, allowing attackers to bypass all eight protected operations including login… |
CVE-2026-85237 | High | 8.1 | 2026-09-03 | A vulnerability in MISP's email-based one-time password (OTP) authentication flow allowed an attacker to perform an unrestricted number of OTP verification att… |
CVE-2026-16675 | | | 2026-09-01 | A privilege escalation security issue exists within FactoryTalk® Activation Manager. The security issue stems from custom actions in the installer that spawn v… |
CVE-2026-13348 | | | 2026-09-01 | CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow an attacker to gain unauthorized access to a user acco… |
CVE-2026-82644 | High | 7.5 | 2026-08-30 | WWBN AVideo (current e01e41ecc and earlier) contains a brute-force rate limiting bypass in enforceRateLimit(), which protects login.json.php and 13 other endpo… |
CVE-2026-82643 | Medium | 6.5 | 2026-08-30 | WWBN AVideo contains an unauthenticated credential submission vulnerability in plugin/Live/api/preauthorize.json.php that accepts credentials over GET without… |
CVE-2026-78617 | | | 2026-08-28 | WatchGuard Dimension's web login endpoint does not enforce effective rate-limiting or account lockout by default allowing a remote attacker to perform automate… |
CVE-2026-76940 | High | 7.5 | 2026-08-28 | The affected Ebyte device does not restrict repeated authentication
attempts through rate limiting or account lockout mechanisms. This could
allow an attacke… |
CVE-2026-18260 | Medium | 5.7 | 2026-08-25 | Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Disable Login Page allows Brute Force. This issue affects Disable Login Page… |
CVE-2026-78655 | Critical | 9.1 | 2026-08-25 | Punk::Plugin::TOTP versions before 0.05 for Perl allow the second-factor attempt limit to be reset by replaying an earlier session cookie because the challenge… |
CVE-2026-62862 | | | 2026-08-25 | Typebot is an open-source chatbot builder. In self-hosted versions up to and including 3.17.1, the default passwordless email magic-link authentication is vuln… |
CVE-2026-75575 | Medium | 5.3 | 2026-08-25 | Rocket.Chat exposes the sendForgotPasswordEmail Meteor method without a DDP rate limit, so an unauthenticated caller may invoke it as often as it likes. The me… |
CVE-2026-78551 | | | 2026-08-24 | RansomLook contains multiple weaknesses in its authentication endpoint that allow an unauthenticated remote attacker to enumerate valid usernames, perform unre… |
CVE-2026-21755 | Medium | 5.3 | 2026-08-24 | HCL Hive is affected by a missing rate limit which could allow an attacker unauthorized access via brute-force or credential stuffing attacks, or cause a denia… |
CVE-2026-69183 | High | 7.5 | 2026-08-20 | Monkeytype is a minimalistic and customizable typing test. In 26.26.0 and earlier, the backend rate-limit key generator in backend/src/middlewares/rate-limit.t… |
CVE-2026-76213 | High | 7.4 | 2026-08-19 | phpMyFAQ before 4.1.7 contains a brute-force vulnerability in the two-factor authentication step where the failure counter is session-scoped and reset on each… |
CVE-2026-73529 | Medium | 5.3 | 2026-08-18 | Plainpad through 1.1.1, fixed in commit d3823fc, contains a missing rate limiting vulnerability that allows unauthenticated attackers to send unbounded login r… |
CVE-2026-75773 | Low | 3.7 | 2026-08-18 | A vulnerability was found in karakeep-app karakeep up to 0.32.0. The affected element is the function authorize of the file apps/web/server/auth.ts of the comp… |
CVE-2026-74868 | High | 7.5 | 2026-08-17 | SiYuan versions before 3.7.4 contain an unthrottled brute-force vulnerability in the Publish Service Basic Auth implementation (PublishServiceTransport.RoundTr… |
CVE-2026-73056 | Critical | 9.8 | 2026-08-16 | SiYuan kernel versions before 3.7.4 contain an improper restriction of excessive authentication attempts vulnerability in the CheckAuth() middleware. The middl… |
CVE-2026-73046 | Critical | 9.8 | 2026-08-15 | SiYuan before v3.7.4 improperly restricts excessive authentication attempts in the CheckAuth() middleware. The HTTP Basic Authentication branch, which guards n… |
CVE-2026-73045 | High | 7.5 | 2026-08-15 | SiYuan before 3.7.4 contains an improper restriction of excessive authentication attempts vulnerability in the authFilePublishAccess endpoint that allows unaut… |
CVE-2026-19898 | Low | 3.7 | 2026-08-15 | A vulnerability was found in VictoriaMetrics up to 1.146.0. Impacted is the function requestHandler of the file app/vmauth/main.go of the component VMAuth Auth… |
CVE-2026-19897 | Low | 3.7 | 2026-08-15 | A vulnerability has been found in mangroup dtale up to 3.22.0. This issue affects the function Login of the file dtale/auth.py of the component Login Endpoint… |
CVE-2026-19895 | Low | 3.7 | 2026-08-15 | A vulnerability was detected in opensourcepos Open Source Point of Sale up to 3.4.2. This affects the function Login::index of the file app/Config/Filters.php… |
CVE-2026-19297 | Critical | 9.1 | 2026-08-13 | IBM Langflow OSS 1.0.0 through 1.9.6 could allow a remote attacker to obtain unauthorized access to user accounts due to improper restriction of excessive auth… |
CVE-2025-62314 | Medium | 5.6 | 2026-08-13 | HCL AION is affected by a vulnerability where certain endpoints lack sufficient anti-automation controls. Automated or scripted requests may be submitted witho… |
CVE-2026-66340 | Medium | 5.3 | 2026-08-11 | The Mira cloud authentication endpoints do not enforce per-account rate limiting, per-IP throttling, or account lockout after repeated failed login attempts. A… |
CVE-2026-65948 | High | 7.3 | 2026-08-10 | UnixAuth lacks brute-force protection in Apache Ranger versions <= 2.8.0.
Note: UnixAuth is NOT a recommended option for production deployments.
Users are r… |
CVE-2026-48084 | High | 7.4 | 2026-08-06 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Versions prior to 1.0.2 don't throttle failed passp… |
CVE-2026-48071 | Medium | 5.8 | 2026-08-06 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.4, the PIN-type challenge thro… |
CVE-2026-16619 | High | 7.5 | 2026-08-06 | The miniOrange 2FA WordPress plugin before 6.2.8 does not correctly limit the number of second-factor verification attempts, tracking them against a client-sup… |
CVE-2026-71213 | Critical | 9.1 | 2026-08-05 | Typemill's login endpoint (POST /tm/login, ControllerWebAuth::login) performs no rate-limiting, failed-attempt counting, or account lockout when captcha is dis… |
CVE-2026-71205 | Medium | 6.5 | 2026-08-05 | changedetection.io's /login route checks the submitted password against a single PBKDF2-HMAC-SHA256 hash with no per-IP or per-session rate limiting, failed-at… |
CVE-2026-8793 | | | 2026-08-03 | PaperCut NG/MF does not properly restrict excessive authentication attempts within its login component. An unauthenticated remote attacker can exploit this vul… |
CVE-2026-15144 | High | 7.3 | 2026-07-29 | @fastify/rate-limit before 11.2.0 keys rate-limit buckets by the verbatim client IP string returned from request.ip. Because a single IPv6 client can control a… |
CVE-2026-16347 | High | 8.8 | 2026-07-28 | MikroTik RouterOS contains a weakness in its API authentication handling that lacks effective safeguards against excessive login attempts. The system does not… |
CVE-2026-55977 | Low | 3.3 | 2026-07-28 | Successful exploitation of this vulnerability
could allow an attacker with local network access to bypass the application's
rate-limiting mechanism, enabling b… |
CVE-2026-65894 | | | 2026-07-27 | This vulnerability exists in CP PLUS EZ-P21 IP Camera due to improper authentication of HTTP endpoints. A remote attacker could exploit this vulnerability by c… |
CVE-2026-8285 | Medium | 4.3 | 2026-07-21 | Improper restriction of excessive authentication attempts vulnerability in Universal Software Inc. FlexCity allows Excessive Allocation.
This issue affects Fl… |
CVE-2026-32825 | High | 7.3 | 2026-07-20 | dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core p… |
CVE-2026-62220 | Medium | 5.3 | 2026-07-17 | OpenClaw 2026.2.25 before 2026.5.26 allow a lower-trust caller or configured input path to bypass non-browser rate limits on WebSocket authentication attempts… |
CVE-2026-44596 | Medium | 6.5 | 2026-07-16 | Yamcs is a mission control framework. Prior to 5.12.7, the authentication endpoint POST /auth/token in yamcs-core, handled by yamcs-core/src/main/java/org/yamc… |
CVE-2026-14254 | | | 2026-07-16 | A race condition in the account lockout mechanism in Delphix Continous Data allowed the lockout threshold to be bypassed through concurrent authentication requ… |
CVE-2026-61458 | High | 7.5 | 2026-07-13 | PasswordPusher before 2.9.2 contains a brute-force vulnerability in the POST /p/:token/access endpoint that lacks route-specific rate limiting and per-push loc… |
CVE-2026-42952 | High | 7.5 | 2026-07-10 | Previously, there was no throttling on repeated authentication attempts
to the charging station backend, which could allow an attacker to
execute a denial-of… |
CVE-2026-11915 | Medium | 5.9 | 2026-07-10 | vulnerability in Drupal Brute force attack protection allows . This issue affects Brute force attack protection versions: *.*. |
CVE-2026-15079 | Medium | 5.4 | 2026-07-10 | Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Login Disable allows Brute Force. This issue affects Login Disable versions… |
CVE-2026-55501 | High | 7.3 | 2026-07-10 | 9Router is an AI router & token saver. Prior to 0.4.80, the dashboard login rate limiter in src/lib/auth/loginLimiter.js derives the client identity from the a… |
CVE-2026-53904 | High | 7.1 | 2026-07-01 | MCO is vulnerable to Account Denial of Service due to improper implementation of password reset functionality. Each password reset request invalidates previous… |
CVE-2026-35098 | | | 2026-06-30 | KTM System e-BOK does not implement any limit or timeout on consecutive login attempts, allowing an attacker to perform unlimited authentication requests. This… |
CVE-2026-11779 | | | 2026-06-26 | An Improper Authorization vulnerability exists in PayloadCMS version 3.84.1 due to insufficient access control on the account unlock operation. |
CVE-2026-50176 | High | 7.5 | 2026-06-25 | The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacke… |
CVE-2026-47380 | | | 2026-06-23 | NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, sign-in response timing differed between known and unknown email addresses becau… |
CVE-2026-56234 | Medium | 5.3 | 2026-06-23 | Capgo before 12.128.2 contains a credential validation vulnerability in the POST /functions/v1/private/validate_password_compliance endpoint that is callable u… |
CVE-2026-56450 | | | 2026-06-22 | AIL did not restrict repeated failed attempts to verify a two-factor authentication (OTP) code. An attacker who had reached the 2FA verification step, such as… |
CVE-2026-47203 | | | 2026-06-19 | Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-on (SSO) for applications via a web port… |
CVE-2026-6853 | Critical | 9.8 | 2026-06-12 | Improper restriction of excessive authentication attempts vulnerability in Başbelen Group Food Cafe Businesses Industry and Trade Ltd. Co. Pause+ Mobile App al… |
CVE-2026-3329 | High | 7.5 | 2026-06-11 | A remote unauthenticated attacker may be able to conduct credential-guessing attacks against user accounts in Sonatype Nexus Repository via authentication endp… |
CVE-2026-43926 | | | 2026-06-04 | FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, the password reset confirmation endpoint `/client/reset-passwo… |
CVE-2026-36612 | Medium | 6.4 | 2026-06-03 | Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 enables WPS 2.0 by default with a weak lockout policy (60-second lockout after 10 attempts). |
CVE-2026-36607 | High | 8.8 | 2026-06-03 | Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 allows unauthenticated brute-force attacks via the TDDP password change endpoint (code=10), whi… |
CVE-2026-10216 | Low | 3.7 | 2026-06-01 | A vulnerability was detected in unitedbyai droidclaw up to 0.5.3. The affected element is an unknown function of the file server/src/routes/pairing.ts of the c… |
CVE-2026-49324 | Medium | 4.6 | 2026-05-29 | Uncontrolled resource consumption in the Wireless Control Module (WCM) of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an adjacent-network… |
CVE-2026-45364 | High | 7.3 | 2026-05-28 | Better Auth is an authentication and authorization library for TypeScript. Prior to 1.4.17 and 1.5.0-beta.9, Better Auth's HTTP rate limiter keyed each request… |
CVE-2026-35675 | High | 8.2 | 2026-05-28 | phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in the password reset endpoint that allows unauthenticated attackers to reset any user ac… |
CVE-2026-8760 | Critical | 9.8 | 2026-05-27 | The Login with OTP plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.6. This is due to an incomplete fix for… |
CVE-2026-1816 | Medium | 6.3 | 2026-05-21 | Improper restriction of excessive authentication attempts vulnerability in Turkiye Electricity Transmission Corporation (TEİAŞ) Mobile Application allows Brute… |
CVE-2020-37228 | Critical | 9.8 | 2026-05-16 | iDS6 DSSPro Digital Signage System 6.2 contains a CAPTCHA security bypass vulnerability that allows attackers to bypass authentication by requesting the autoLo… |
CVE-2026-45010 | Critical | 9.1 | 2026-05-15 | phpMyFAQ before 4.1.2 contains an improper restriction of excessive authentication attempts vulnerability in the /admin/check endpoint, which accepts arbitrary… |
CVE-2025-64526 | Medium | 5.3 | 2026-05-14 | Strapi is an open source headless content management system. In Strapi versions prior to 5.45.0, the rate-limit middleware in the users-permissions plugin deri… |
CVE-2025-62313 | Medium | 5.4 | 2026-05-14 | HCL AION is affected by a vulnerability where adequate protections against brute-force attempts are not enforced. This may allow repeated authentication attemp… |
CVE-2026-44195 | Medium | 5.3 | 2026-05-13 | OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.7, a logic flaw in the OPNsense lockout_handler allows an unauthenticated attacker to… |