CVE-2024-11318

CVE-2024-11318 IDOR - AbsysNet 2.3.1 User Hijacking DISCLAIMER This tool is designed to help identify and exploit whether an application is vulnerable to this specific CVE-2024-11318. It is intended for use by cybersecurity professionals, researchers, and penetration testers to assess security in...

CVE-2026-36959

CVE-2026-36959: Missing Rate Limiting on Login Endpoint CVE ID: CVE-2026-36959 Date: 2026-04-29 Discoverer: Kirubel Solomne Vendor: U-SPEED Product: U-SPEED Router Firmware Version: V1.0.0 CWE: CWE-307 - Improper Restriction of Excessive Authentication Attempts Description The U-SPEED Router...

Pyrit

Please Read Pyrit is old, is outdated and it's still Python2 I am currently attempting to rewrite it from scratch, so thanks for all the stars but remember to keep an eye for Python3 version. Pyrit Pyrit allows you to create massive databases of pre-computed WPA/WPA2-PSK authentication phase in a...

CVE-2021-29156

CVE-2021-29156 Proof-of-Concept c 2021 GuidePoint Security Charlton Trezevant [email protected] Background Today GuidePoint is pleased to release a functional Proof-of-Concept tool for CVE-2021-29156, an LDAP injection vulnerability in ForgeRock OpenAM v13.0.0. This vulnerability allows an...

grafana-bruteforce

grafana-bruteforce A tool that takes a combo username and password list and will attempt to bruteforce grafana login page. Grafana will lock you out after 5 attempts so you need to ensure your proxy has multiple external ip's. How to Run Use supplied combo list python3 grafana-brute.py -u...

CVE-2025-61560

A race condition vulnerability in the SessionManager of CNCF: Cloud Native Computing Foundation Argo CD v3.0.6 allows attackers to bypass rate limiting and perform a brute force attack via repeated crafted requests...

CVE-2025-61560

A race condition vulnerability in the SessionManager of CNCF: Cloud Native Computing Foundation Argo CD v3.0.6 allows attackers to bypass rate limiting and perform a brute force attack via repeated crafted requests...

Rocky Linux 9 [CIQ] Security Update: openssh / openssh-askpass / openssh-askpass-debuginfo / etc (crlsa-2026_73955)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202673955 advisory. openssh: OpenSSH: Brute-force attacks facilitated due to insufficient authentication delay CVE-2026-60001 Tenable has extracted the preceding description block...

Rocky Linux 8 [CIQ] Security Update: mailman / mailman-debuginfo / mailman-debugsource Multiple Vulnerabilities (crlsa-2021_4826)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20214826 advisory. mailman: CSRF token bypass allows to perform CSRF attacks and account takeover CVE-2021-42097 mailman: CSRF token derived from admin password allows offlin...

CVE-2026-100501 Flame through 2.4.0 Brute-Force Attack via Login Endpoint

Flame through 2.4.0 contains an improper restriction of excessive authentication attempts vulnerability in the POST /api/auth login endpoint that allows unauthenticated attackers to brute-force the admin password. Attackers can submit unlimited password guesses without rate limiting, attempt...

CVE-2026-97469 PostgreSQL Anonymizer: RESTRICTED functions are reachable through a subLink

PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to repeatedly call the anon.hash function and collects seed, hashoutput pairs to perform an offline brute-force attack and deduce the salt. A masked role can run a RESTRICTED function when the call is placed insi...

CVE-2026-97469

PostgreSQL Anonymizer contains a vulnerability allowing authenticated, unprivileged masked users to bypass access restrictions by embedding function calls within a subquery . This allows the execution of RESTRICTED functions, such as anon.hash() . An attacker can repeatedly invoke these functions...

PT-2026-99068

Name of the Vulnerable Software and Affected Versions GLPI versions 11.0.0 through 11.0.7 Description The time-based one-time password TOTP verification endpoint does not limit failed submissions per user. An attacker with a user's primary authentication credentials can repeatedly submit TOTP...

CVE-2026-85734 LightRAG: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the POST /login endpoint in lightrag/api/lightragserver.py does not impose a rate limit, account lockout, delay, or counter for failed authentication attempts. A network attacker can submit password guesses at full...

PT-2026-96825

Name of the Vulnerable Software and Affected Versions LightRAG versions prior to 1.5.5 Description The 'POST /login' endpoint in lightrag/api/lightrag server.py does not implement rate limiting, account lockout, delays, or counters for failed authentication attempts. This allows a network attacke...

CVE-2026-56592: Improper Restriction of Excessive Authentication Attempts

HCL BigFix Service Management is affected by an Improper Authentication validation vulnerability related to inadequate account lockouts, which could allow an unauthenticated attacker to execute sustained brute-force attacks against the login interface, resulting in unauthorized system access...

CVE-2026-40538: Improper Restriction of Excessive Authentication Attempts

An improper restriction of excessive authentication attempts vulnerability in Auto block in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to read limited files via brute-force attacks...

CVE-2026-92921: Use of Password Hash With Insufficient Computational Effort

admin3 through 3.0.0 stores account passwords using single-round MD5 with only the username as salt and no key derivation function. Attackers with database access can recover plaintext passwords through offline dictionary or brute-force attacks due to negligible computational effort...

PT-2026-94252

Name of the Vulnerable Software and Affected Versions admin3 versions 3.0.0 through 3.0.0 Description Account passwords are stored using a single-round MD5 hash with only the username as salt and no key derivation function a method used to strengthen passwords by adding computational cost. This...

Azure Cosmos DB Authentication Bypass

The vulnerability of the Azure Cosmos DB database management system is related to the ability to bypass authentication using a user-controlled key. Exploiting this vulnerability allows an attacker to perform brute-force attacks remotely...