CWE-307 · Improper Restriction of Excessive Authentication Attempts (page 2)
Page 2 of 7 — CVEs classified under CWE-307, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-20882 | High | 7.5 | 2026-03-06 | The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacke… |
CVE-2026-27778 | High | 7.5 | 2026-03-06 | The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacke… |
CVE-2026-27801 | Medium | 5.9 | 2026-03-04 | Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Vaultwarden versions 1.34.3 and prior are susceptible… |
CVE-2026-27981 | High | 7.4 | 2026-03-03 | HomeBox is a home inventory and organization system. Prior to 0.24.0, the authentication rate limiter (authRateLimiter) tracks failed attempts per client IP. I… |
CVE-2025-36363 | Medium | 5.9 | 2026-03-03 | IBM DevOps Plan 3.0.0 through 3.0.5 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. |
CVE-2026-27824 | Medium | 5.3 | 2026-02-27 | calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.4.0, the calibre Content Server's brute… |
CVE-2026-27753 | Medium | 6.5 | 2026-02-27 | SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 contain an authentication bypass vulnerability that allows remote attackers to perform unlimited log… |
CVE-2026-26305 | High | 7.5 | 2026-02-27 | The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attac… |
CVE-2026-24445 | High | 7.5 | 2026-02-27 | The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attac… |
CVE-2026-25945 | High | 7.5 | 2026-02-27 | The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attac… |
CVE-2026-25114 | High | 7.5 | 2026-02-27 | The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attac… |
CVE-2026-25113 | High | 7.5 | 2026-02-27 | The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attac… |
CVE-2026-20792 | High | 7.5 | 2026-02-27 | The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attac… |
CVE-2026-26227 | Low | 3.7 | 2026-02-26 | VideoLAN VLC for Android prior to version 3.7.0 contains an authentication bypass in the Remote Access Server feature due to missing or insufficient rate limit… |
CVE-2026-27521 | High | 7.5 | 2026-02-24 | Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior do not implement rate limiting or account lockout on failed login attempts, ena… |
CVE-2025-7630 | Medium | 5.3 | 2026-02-18 | Improper Restriction of Excessive Authentication Attempts, Improper Authentication vulnerability in Doruk Communication and Automation Industry and Trade Inc… |
CVE-2026-25577 | High | 7.5 | 2026-02-10 | Emmett is a framework designed to simplify your development process. Prior to 1.3.11, the cookies property in mmett_core.http.wrappers.Request does not handle… |
CVE-2026-2110 | Low | 3.7 | 2026-02-07 | A security flaw has been discovered in Tasin1025 SwiftBuy up to 0f5011372e8d1d7edfd642d57d721c9fadc54ec7. Affected by this vulnerability is an unknown function… |
CVE-2025-67853 | High | 7.5 | 2026-02-03 | A flaw was found in Moodle. A remote attacker could exploit a lack of proper rate limiting in the confirmation email service. This vulnerability allows attacke… |
CVE-2026-1685 | Low | 3.7 | 2026-01-30 | A vulnerability was identified in D-Link DIR-823X 250416. This vulnerability affects the function sub_40AC74 of the component Login. Such manipulation leads to… |
CVE-2026-24436 | Critical | 9.8 | 2026-01-26 | Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) do not enforce rate limiting or account lockout mechanisms on authentication end… |
CVE-2026-1409 | Low | 2.0 | 2026-01-26 | A security vulnerability has been detected in Beetel 777VR1 up to 01.00.09/01.00.09_55. This issue affects some unknown processing of the component UART Interf… |
CVE-2025-4319 | Critical | 9.4 | 2026-01-23 | Improper Restriction of Excessive Authentication Attempts, Weak Password Recovery Mechanism for Forgotten Password vulnerability in Birebirsoft Software and Te… |
CVE-2025-53968 | High | 7.5 | 2026-01-22 | This vulnerability arises because there are no limitations on the number of authentication attempts a user can make. An attacker can exploit this weakness by… |
CVE-2026-22278 | High | 8.1 | 2026-01-22 | Dell PowerScale OneFS versions prior to 9.13.0.0 contains an improper restriction of excessive authentication attempts vulnerability. An unauthenticated attack… |
CVE-2026-22603 | Medium | 6.5 | 2026-01-10 | OpenProject is an open-source, web-based project management software. Prior to version 16.6.2, OpenProject’s unauthenticated password-change endpoint (/account… |
CVE-2025-67091 | Medium | 6.5 | 2026-01-08 | An issue in GL Inet GL.Inet AX1800 Version 4.6.4 & 4.6.8 are vulnerable. GL.Inet AX1800 Version 4.6.4 & 4.6.8 in the GL.iNet custom opkg wrapper script located… |
CVE-2025-67090 | Medium | 5.1 | 2026-01-08 | The LuCI web interface on Gl Inet GL.Inet AX1800 Version 4.6.4 & 4.6.8 are vulnerable. Fix available in version 4.8.2 GL.Inet AX1800 Version 4.6.4 & 4.6.8 lack… |
CVE-2025-1928 | Critical | 9.1 | 2025-12-19 | Improper Restriction of Excessive Authentication Attempts vulnerability in Restajet Information Technologies Inc. Online Food Delivery System allows Password R… |
CVE-2025-65427 | Medium | 6.5 | 2025-12-16 | An issue was discovered in Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router on firmware version V1.0.0 does not implement rate limiting to /api/login allowing… |
CVE-2025-66482 | Medium | 6.5 | 2025-12-16 | Misskey is an open source, federated social media platform. Attackers who use an untrusted reverse proxy or not using a reverse proxy at all can bypass IP rate… |
CVE-2025-66204 | High | 8.1 | 2025-12-09 | WBCE CMS is a content management system. Version 1.6.4 contains a brute-force protection bypass where an attacker can indefinitely reset the counter by modifyi… |
CVE-2025-42615 | | 2025-12-08 | In affected versions, vulnerability-lookup did not track or limit failed One-Time Password (OTP) attempts during Two-Factor Authentication (2FA) verification… | |
CVE-2025-46603 | High | 7.0 | 2025-12-05 | Dell CloudBoost Virtual Appliance, versions 19.13.0.0 and prior, contains an Improper Restriction of Excessive Authentication Attempts vulnerability. An unauth… |
CVE-2025-12995 | High | 8.1 | 2025-12-04 | Medtronic CareLink Network allows an unauthenticated remote attacker to perform a brute force attack on an API endpoint that could be used to determine a valid… |
CVE-2025-64310 | Critical | 9.8 | 2025-11-21 | EPSON WebConfig and Epson Web Control for SEIKO EPSON Projector Products do not restrict excessive authentication attempts. An administrative user's password m… |
CVE-2025-63807 | Critical | 9.8 | 2025-11-20 | An issue was discovered in weijiang1994 university-bbs (aka Blogin) in commit 9e06bab430bfc729f27b4284ba7570db3b11ce84 (2025-01-13). A weak verification code g… |
CVE-2025-59113 | High | 7.5 | 2025-11-18 | Windu CMS implements weak client-side brute-force protection by using parameter loginError. Information about attempt count or timeout is not stored on the ser… |
CVE-2025-11566 | | 2025-11-12 | CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that would allow an attacker on the local network to gain access to the… | |
CVE-2025-10161 | High | 7.3 | 2025-11-11 | Improper Restriction of Excessive Authentication Attempts, Client-Side Enforcement of Server-Side Security, Reliance on Untrusted Inputs in a Security Decision… |
CVE-2025-12896 | Medium | 4.4 | 2025-11-07 | Improper resource management in firmware of some Solidigm DC Products may allow an attacker with local or physical access to gain un-authorized access to a loc… |
CVE-2025-12547 | Low | 3.7 | 2025-10-31 | A vulnerability was identified in LogicalDOC Community Edition up to 9.2.1. This vulnerability affects unknown code of the file /login.jsp of the component Adm… |
CVE-2025-62257 | Medium | 5.3 | 2025-10-30 | Password enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023… |
CVE-2025-10928 | Medium | 6.3 | 2025-10-30 | Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Access code allows Brute Force.This issue affects Access code: from 0.0.0 bef… |
CVE-2025-64102 | Critical | 9.8 | 2025-10-29 | Zitadel is open-source identity infrastructure software. Prior to 4.6.0, 3.4.3, and 2.71.18, an attacker can perform an online brute-force attack on OTP, TOTP… |
CVE-2025-12310 | Medium | 5.3 | 2025-10-27 | A security vulnerability has been detected in VirtFusion up to 6.0.2. This vulnerability affects unknown code of the file /account/_settings of the component E… |
CVE-2025-60424 | High | 7.6 | 2025-10-27 | A lack of rate limiting in the OTP verification component of Nagios Fusion v2024R1.2 and v2024R2 allows attackers to bypass authentication via a bruteforce att… |
CVE-2025-26862 | | 2025-10-27 | Unexpected authentication form rendering in HTML Form Adapter using only non-default redirectless mode in PingFederate allows authentication attempts which may… | |
CVE-2025-62399 | High | 7.5 | 2025-10-23 | Moodle’s mobile and web service authentication endpoints did not sufficiently restrict repeated password attempts, making them susceptible to brute-force attac… |
CVE-2025-56224 | High | 8.1 | 2025-10-20 | A lack of rate limiting in the One-Time Password (OTP) verification endpoint of SigningHub v8.6.8 allows attackers to bypass verification via a bruteforce atta… |
CVE-2025-56221 | Critical | 9.8 | 2025-10-17 | A lack of rate limiting in the login mechanism of SigningHub v8.6.8 allows attackers to bypass authentication via a brute force attack. |
CVE-2025-9551 | Medium | 6.5 | 2025-10-10 | Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Protected Pages allows Brute Force.This issue affects Protected Pages: from 0… |
CVE-2025-11441 | Low | 3.7 | 2025-10-08 | A vulnerability was identified in JhumanJ OpnForm up to 1.9.3. The affected element is an unknown function of the component HTTP Header Handler. The manipulati… |
CVE-2025-58587 | Medium | 6.5 | 2025-10-06 | The application does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it possible for an… |
CVE-2025-8679 | Critical | 9.8 | 2025-10-01 | In ExtremeGuest Essentials before 25.5.0, captive-portal may permit unauthorized access via manual brute-force procedure. Under certain ExtremeGuest Essentials… |
CVE-2025-8118 | Medium | 6.5 | 2025-09-30 | PAD CMS implements weak client-side brute-force protection by utilizing two cookies: login_count and login_timeout. Information about attempt count or timeout… |
CVE-2025-36064 | Medium | 5.9 | 2025-09-22 | IBM Sterling Connect:Express for Microsoft Windows 3.1.0.0 through 3.1.0.22 uses an inadequate account lockout setting that could allow a remote attacker to br… |
CVE-2025-35041 | High | 7.5 | 2025-09-22 | Airship AI Acropolis allows unlimited MFA attempts for 15 minutes after a user has logged in with valid credentials. A remote attacker with valid credentials c… |
CVE-2025-10761 | Low | 3.7 | 2025-09-21 | A vulnerability has been found in Harness 3.3.0. Affected is an unknown function of the file /api/v1/login of the component Login Endpoint. The manipulation le… |
CVE-2025-10658 | Medium | 6.5 | 2025-09-20 | The SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including… |
CVE-2025-54860 | High | 7.7 | 2025-09-18 | Cognex In-Sight Explorer and In-Sight Camera Firmware expose a telnet-based service on port 23 in order to allow management operations on the device such as f… |
CVE-2025-36758 | | 2025-09-10 | It is possible to bypass the clipping level of authentication attempts in SolaX Cloud through the use of the 'Forgot Password' functionality as an oracle. | |
CVE-2025-57815 | Medium | 6.5 | 2025-09-08 | Fides is an open-source privacy engineering platform. Prior to version 2.69.1, the Fides Admin UI login endpoint relies on a general IP-based rate limit for al… |
CVE-2025-2417 | High | 8.6 | 2025-09-04 | Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft e-Mutabakat allows Authentication Bypass. This issue affects e-Mutabakat… |
CVE-2025-2411 | High | 8.6 | 2025-09-04 | Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft TaskPano allows Authentication Bypass. This issue affects TaskPano: from s… |
CVE-2025-2416 | High | 8.6 | 2025-09-03 | Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft LimonDesk allows Authentication Bypass. This issue affects LimonDesk: from… |
CVE-2025-2415 | High | 8.6 | 2025-09-03 | Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft MyRezzta allows Authentication Bypass. This issue affects MyRezzta: from s… |
CVE-2025-1740 | Critical | 9.8 | 2025-09-03 | Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft MyRezzta allows Authentication Bypass, Password Recovery Exploitation, Brut… |
CVE-2025-2413 | High | 8.6 | 2025-09-02 | Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft ProKuafor allows Authentication Bypass. This issue affects ProKuafor: from… |
CVE-2025-2414 | High | 8.6 | 2025-09-02 | Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft OctoCloud allows Authentication Bypass. This issue affects OctoCloud: from… |
CVE-2025-2412 | High | 8.6 | 2025-09-01 | Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft QR Menu allows Authentication Bypass. This issue affects QR Menu: from s1… |
CVE-2025-9004 | Low | 3.7 | 2025-08-15 | A vulnerability was found in mtons mblog up to 3.5.0. This issue affects some unknown processing of the file /settings/password. The manipulation leads to impr… |
CVE-2025-8927 | Low | 3.7 | 2025-08-13 | A vulnerability was determined in mtons mblog up to 3.5.0. Affected by this issue is some unknown functionality of the file /email/send_code of the component V… |
CVE-2025-52392 | Medium | 5.4 | 2025-08-13 | Soosyze CMS 2.0 allows brute-force login attacks via the /user/login endpoint due to missing rate-limiting and lockout mechanisms. An attacker can repeatedly s… |
CVE-2025-55003 | Medium | 5.7 | 2025-08-09 | OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 2.3.1 and… |
CVE-2025-54998 | Medium | 5.3 | 2025-08-09 | OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 0.1.0 thro… |
CVE-2025-8742 | Low | 3.7 | 2025-08-08 | A vulnerability was found in macrozheng mall 1.0.3. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Adm… |
CVE-2025-46414 | High | 8.1 | 2025-08-08 | The affected product does not limit the number of attempts for inputting the correct PIN for a registered product, which may allow an attacker to gain unauth… |
CVE-2025-53544 | High | 7.5 | 2025-08-05 | Trilium Notes is an open-source, cross-platform hierarchical note taking application with focus on building large personal knowledge bases. In versions below 0… |
CVE-2025-6015 | Medium | 5.7 | 2025-08-01 | Vault and Vault Enterprise’s (“Vault”) login MFA rate limits could be bypassed and TOTP tokens could be reused. Fixed in Vault Community Edition 1.20.1 and Vau… |
CVE-2025-6004 | Medium | 5.3 | 2025-08-01 | Vault and Vault Enterprise’s (“Vault”) user lockout feature could be bypassed for Userpass and LDAP authentication methods. Fixed in Vault Community Edition 1… |
CVE-2023-32251 | Low | 3.7 | 2025-07-31 | A vulnerability has been identified in the Linux kernel's ksmbd component (kernel SMB/CIFS server). A security control designed to prevent dictionary attacks… |
CVE-2025-54833 | Medium | 5.3 | 2025-07-31 | OPEXUS FOIAXpress Public Access Link (PAL) version v11.1.0 allows attackers to bypass account-lockout and CAPTCHA protections. Unauthenticated remote attackers… |
CVE-2025-28172 | Medium | 6.5 | 2025-07-29 | Grandstream Networks UCM6510 v1.0.20.52 and before is vulnerable to Improper Restriction of Excessive Authentication Attempts. An attacker can perform an arbit… |
CVE-2024-49342 | High | 7.5 | 2025-07-28 | IBM Informix Dynamic Server 12.10 and 14.10 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. |
CVE-2025-7393 | Critical | 9.8 | 2025-07-21 | Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Mail Login allows Brute Force.This issue affects Mail Login: from 3.0.0 befor… |
CVE-2025-7882 | Low | 3.1 | 2025-07-20 | A vulnerability was found in Mercusys MW301R 1.0.2 Build 190726 Rel.59423n. It has been rated as problematic. This issue affects some unknown processing of the… |
CVE-2024-9342 | Critical | 9.8 | 2025-07-16 | In Eclipse GlassFish versions before 8.0.3 it is possible to perform Login Brute Force attacks as there is no limitation in the number of failed login attempts… |
CVE-2025-27456 | High | 7.5 | 2025-07-03 | The SMB server's login mechanism does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it… |
CVE-2025-27449 | High | 7.5 | 2025-07-03 | The MEAC300-FNADE4 does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it susceptible t… |
CVE-2025-1710 | High | 7.5 | 2025-07-03 | The maxView Storage Manager does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it susc… |
CVE-2025-52997 | Medium | 5.9 | 2025-06-30 | File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to ver… |
CVE-2025-4383 | Critical | 9.3 | 2025-06-24 | Improper Restriction of Excessive Authentication Attempts vulnerability in Art-in Bilişim Teknolojileri ve Yazılım Hizm. Tic. Ltd. Şti. Wi-Fi Cloud Hotspot all… |
CVE-2025-6533 | Medium | 5.6 | 2025-06-24 | A vulnerability, which was classified as critical, has been found in xxyopen/201206030 novel-plus up to 5.1.3. Affected by this issue is the function ajaxLogin… |
CVE-2025-2171 | | 2025-06-23 | Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 do not enforce rate limiting on password reset attempts, allowing adversaries to brute forc… | |
CVE-2025-52916 | Low | 2.2 | 2025-06-21 | Yealink RPS before 2025-06-04 lacks SN verification attempt limits, enabling brute-force enumeration (last five digits). |
CVE-2025-47951 | Medium | 4.9 | 2025-06-16 | Weblate is a web based localization tool. Prior to version 5.12, the verification of the second factor was not subject to rate limiting. The absence of rate li… |
CVE-2025-6030 | | 2025-06-13 | Use of fixed learning codes, one code to lock the car and the other code to unlock it, in the Key Fob Transmitter in Cyclone Matrix TRF Smart Keyless Entry Sy… | |
CVE-2025-6029 | | 2025-06-13 | Use of fixed learning codes, one code to lock the car and the other code to unlock it, the Key Fob Transmitter in KIA-branded Aftermarket Generic Smart Keyles… | |
CVE-2025-43863 | Critical | 9.8 | 2025-06-12 | vantage6 is an open source framework built to enable, manage and deploy privacy enhancing technologies like Federated Learning and Multi-Party Computation. If… |