CVE-2026-84473

CVE-2026-84473: ownCloud server lacks brute-force protection, enabling unlimited password guessing. Vulnerability Classification CWE-307: Improper Restriction of Excessive Authentication Attempts Severity CVSS v3.1: 8.1 High CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N The score reflects the impa...

vaultwarden-ip-header-spoof

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · vaultwarden-ip-header-spoof Write-up: https://abraxaslabs.tech/research/vaultwarden-ip-header-spoof vaultwarden-ip-header-spoof Vaultwarden 1.37.3 - dani-garcia Default IPHEADER=X-Real-IP plus...

CVE-2026-8793

CVE-2026-8793 — Missing Brute-Force Protection on PaperCut NG Login Form Field| Details ---|--- CVE ID| CVE-2026-8793 Product| PaperCut NG Affected Version| 25.0.11 Build 75758 and earlier CWE| CWE-307 — Improper Restriction of Excessive Authentication Attempts CVSS Score| 5.3 Medium — standalone...

CVE-2026-112205 Bruteforce Protection Bypass in WidzialniCMS

WidzialniCMS is vulnerable to Bruteforce Protection Bypass in the login functionality. The cookie-based lockout can be bypassed by omitting the logincount and logintimeout cookies, allowing an unauthenticated attacker to perform an unlimited number of login attempts. This issue has been fixed in...

EUVD-2026-118402

Authentication Bypass / Missing Brute-Force Protection in remote.php/webdav/ in ownCloud ownCloud server 10.16.3 allows an unauthenticated remote attacker to perform unlimited online password guessing against WebDAV accounts via repeated HTTP Basic Authentication requests to the WebDAV endpoint...

CVE-2026-84473 CVE-2026-84473

Authentication Bypass / Missing Brute-Force Protection in remote.php/webdav/ in ownCloud ownCloud server 10.16.3 allows an unauthenticated remote attacker to perform unlimited online password guessing against WebDAV accounts via repeated HTTP Basic Authentication requests to the WebDAV endpoint...

keycloak-services: keycloak-services: Device Authorization Grant issues tokens to brute-force-locked accounts

A flaw was found in the Device Authorization Grant flow of Keycloak, an identity and access management solution. The issue occurs because the token redemption process fails to check if a user account is currently locked due to brute-force protection. If an attacker has an active session for a...

PT-2026-137402

Name of the Vulnerable Software and Affected Versions All In One Login versions prior to 2.5.0 Description The passwordless email login feature, which is enabled by default, fails to adequately restrict the number of attempts for the short numeric code. Additionally, these failed attempts are not...

CVE-2026-119746

ProSoft Technology ICX35 devices X35-HWC-A and ICX35-HWC-E contain a login lockout bypass in the integrated module web page. The account lockout mechanism that restricts repeated failed authentication attempts is enforced in client-side JavaScript, so a remote attacker can reset the lockout and...

EUVD-2026-116968

ProSoft Technology ICX35 devices X35-HWC-A and ICX35-HWC-E contain a login lockout bypass in the integrated module web page. The account lockout mechanism that restricts repeated failed authentication attempts is enforced in client-side JavaScript, so a remote attacker can reset the lockout and...

PT-2026-137001

ProSoft Technology ICX35 devices X35-HWC-A and ICX35-HWC-E contain a login lockout bypass in the integrated module web page. The account lockout mechanism that restricts repeated failed authentication attempts is enforced in client-side JavaScript, so a remote attacker can reset the lockout and...

CVE-2026-119746: ProSoft Technology: ProSoft Technology ICX35 devices (X35-HWC-A and ICX35-HWC-E) contain a login lockout bypass in the integrated module…

ProSoft Technology ICX35 devices X35-HWC-A and ICX35-HWC-E contain a login lockout bypass in the integrated module web page. The account lockout mechanism that restricts repeated failed authentication attempts is enforced in client-side JavaScript, so a remote attacker can reset the lockout and...

CVE-2026-102334 Nginx Proxy Manager through 2.16.0 Missing Brute-Force Protection

Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses against any account. Attackers can brute-force login credentials via POST /api/tokens and subsequently guess TOTP codes via POST /api/tokens/2f...

CVE-2026-94379

The login function in MISP's UsersController.php contained insufficient HTTP method validation for several security-critical code paths. The original code used an allowlist approach, checking only for specific HTTP methods POST and PUT before enforcing bruteforce protection, email one-time-passwo...

CVE-2026-92583

AVideo through 29.0 contains a race condition in the enforceRateLimit function that fails to atomically increment rate limit counters, allowing attackers to bypass all rate limits including login brute-force protection by issuing concurrent requests. Attackers can submit parallel credential...

warpgate v0.29.0-beta.1

Warpgate is a smart & fully transparent SSH, HTTPS, Kubernetes, MySQL, PostgreSQL, RDP and VNC bastion host that doesn't require a client app or an SSH wrapper. Set it up in your DMZ, add user accounts and easily assign them to specific hosts and URLs within the network. Warpgate will record ever...

CVE-2026-89174

Smart Video Intercom System developed by Kingdom Communication Associated has a Missing Brute-force Protection vulnerability. Unauthenticated remote attackers can gain access to valid accounts through a large number of login attempts...

CVE-2026-89174 Kingdom Communication Associated｜Smart Video Intercom System - Missing Burte-force Protection

Smart Video Intercom System developed by Kingdom Communication Associated has a Missing Brute-force Protection vulnerability. Unauthenticated remote attackers can gain access to valid accounts through a large number of login attempts...

CVE-2026-89174 Kingdom Communication Associated｜Smart Video Intercom System - Missing Burte-force Protection

Smart Video Intercom System developed by Kingdom Communication Associated has a Missing Brute-force Protection vulnerability. Unauthenticated remote attackers can gain access to valid accounts through a large number of login attempts...

EUVD-2026-76001

Smart Video Intercom System developed by Kingdom Communication Associated has a Missing Brute-force Protection vulnerability. Unauthenticated remote attackers can gain access to valid accounts through a large number of login attempts...