EUVD-2026-66983

If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 issues handles per connection and relies on a cryptographically weak SID as sole authenticator. An attacker can brute-force the SID, recover another session's handle number, and read license information belonging to anoth...

CVE-2026-81576 Improper Authentication of Session Handles

If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 issues handles per connection and relies on a cryptographically weak SID as sole authenticator. An attacker can brute-force the SID, recover another session's handle number, and read license information belonging to anoth...

CVE-2026-81576

CodeMeter Runtime (WIBU), when configured as a server in versions before 8.41a and 9.10 , issues a per-connection session handle and relies on a cryptographically weak SID as the sole authenticator. An attacker with network access can brute-force the SID , recover another session's handle number,...

PT-2026-82792

The affected Ebyte device does not restrict repeated authentication attempts through rate limiting or account lockout mechanisms. This could allow an attacker to perform automated authentication attacks against deployments that rely on password based authentication...

fscan v2.2.1

Fscan 中文 Comprehensive intranet scanning tool for automated vulnerability assessment. Version : 2.2.0 Features Scanning Host Discovery - ICMP/Ping alive detection, B/C segment statistics for large networks Port Scanning - TCP connect scan, 133 built-in ports, port groups web/db/service/all...

DRUPAL-CONTRIB-2026-110

This module enables you to disable access to the /user/login form unless a secret key is provided. The module does not sufficiently restrict repeated attempts to guess that key, allowing brute-force attacks against the access-control mechanism...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mailman (UTSA-2026-093198)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093198 advisory. In GNU Mailman before 2.1.36, the CSRF token for the Cgi/admindb.py admindb page contains an encrypted version of the list admin password. This could potentially be...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mailman (UTSA-2026-093169)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093169 advisory. GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A certain csrftoken value is derived from the admin password, and may be useful in conducting a...

CVE-2026-18259

Observable Timing Discrepancy vulnerability in Drupal Token Content Access allows Brute Force. This issue affects Token Content Access versions: from 0.0.0 to 3.1.2...

CVE-2026-18259 Token Content Access - Moderately critical - Access bypass - SA-CONTRIB-2026-090

Observable Timing Discrepancy vulnerability in Drupal Token Content Access allows Brute Force. This issue affects Token Content Access versions: from 0.0.0 to 3.1.2...

CVE-2026-18259

Drupal Token Content Access (versions 0.0.0 through 3.1.2 ) contains an observable timing discrepancy in its access token comparison logic. Because the module does not sufficiently protect the token comparison in some cases, a persistent attacker who knows or discovers a URL for protected content...

CVE-2026-18259 Token Content Access - Moderately critical - Access bypass - SA-CONTRIB-2026-090

Observable Timing Discrepancy vulnerability in Drupal Token Content Access allows Brute Force. This issue affects Token Content Access versions: from 0.0.0 to 3.1.2...

CVE-2026-62862

Typebot is an open-source chatbot builder. In self-hosted versions up to and including 3.17.1, the default passwordless email magic-link authentication is vulnerable to login-code brute forcing that leads to account takeover. The email provider overrides NextAuth's default cryptographically secur...

CVE-2026-62862 TypeBot: Account takeover via brute-forceable 6-digit magic-link code

Typebot is an open-source chatbot builder. In self-hosted versions up to and including 3.17.1, the default passwordless email magic-link authentication is vulnerable to login-code brute forcing that leads to account takeover. The email provider overrides NextAuth's default cryptographically secur...

CVE-2026-62862

Typebot (open-source chatbot builder), self-hosted versions ≤ 3.17.1 , is vulnerable to account takeover via brute-forcing of the passwordless email magic-link login code. The root cause is a 6-digit code generated with Math.random() (only 900,000 combinations) with a 10-minute expiry, no attempt...

CVE-2026-62862 TypeBot: Account takeover via brute-forceable 6-digit magic-link code

Typebot is an open-source chatbot builder. In self-hosted versions up to and including 3.17.1, the default passwordless email magic-link authentication is vulnerable to login-code brute forcing that leads to account takeover. The email provider overrides NextAuth's default cryptographically secur...

CVE-2026-78655

Punk::Plugin::TOTP (Perl) versions before 0.05 allow an attacker to bypass the TOTP second-factor attempt limit by replaying a previously saved session cookie. Because Punk::Session stores the failure counter inside a signed client-side cookie, a saved cookie from before the failed attempts resto...

CVE-2026-78655 Punk::Plugin::TOTP versions before 0.05 for Perl allow the second-factor attempt limit to be reset by replaying an earlier session cookie because the challenge route counts failures in the session

Punk::Plugin::TOTP versions before 0.05 for Perl allow the second-factor attempt limit to be reset by replaying an earlier session cookie because the challenge route counts failures in the session. The POST handler on challengepath keeps the failure count as tries inside the totppending record in...

BIT-KEYCLOAK-2024-4629 Keycloak: potential bypass of brute force protection

A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating multiple login requests simultaneously, attackers can exceed the configured limits for failed attempts before the system locks them out. Thi...

CVE-2026-56710

Grav Login plugin versions before 1.0.16 fail to validate the target account's privilege level in the onApiUserListRowAction unlock handler. An attacker with api.users.write permission can clear login lockout counters on admin.super accounts, removing brute-force protection from the...