87087 matches found
PT-2026-105818
Summary The POST /login endpoint has no rate limiting, account lockout, or delay on failed attempts. An attacker can submit unlimited password guesses at full network speed. Details python lightrag/api/lightrag server.py:2161 @app.post"/login" async def loginform data: OAuth2PasswordRequestForm =...
Rocky Linux 9.6 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1776601980)
The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1776601980 advisory. - A denial of service vulnerability exists in curl v8.1.0 in the way libcurl provides several different backends for resolving hos...
PT-2026-104009
Name of the Vulnerable Software and Affected Versions Filament versions 4.0.0 through 4.13.2 Filament versions 5.0.0 through 5.8.2 Description App-based multi-factor authentication MFA management actions do not consistently require confirmation of the current password. An attacker with access to ...
...[ More ]
This Metasploit module exploits CVE-2000-0979, an information disclosure vulnerability in the share-level password authentication of Microsoft Windows 9x/Me SMB servers. The server validates passwords one character at a time, allowing an attacker to enumerate the correct password byte-by-byte bas...
CVE-2026-102115
Kiteworks Core did not correctly validate a parameter submitted to the password reset workflow. An unauthenticated attacker who knew the email address of a user with a locally stored password could potentially reset that account's password without access to the emailed reset link and then...
CVE-2026-102106
Improper authentication in a Kiteworks Email Protection Gateway administrative service. An administrative service in Kiteworks Email Protection Gateway did not consistently enforce administrator authentication, so the required password check could be bypassed. An attacker who referenced a valid...
EUVD-2026-90313
Improper authentication in a Kiteworks Email Protection Gateway administrative service. An administrative service in Kiteworks Email Protection Gateway did not consistently enforce administrator authentication, so the required password check could be bypassed. An attacker who referenced a valid...
CVE-2026-102106 Kiteworks Email Protection Gateway improper authentication
Improper authentication in a Kiteworks Email Protection Gateway administrative service. An administrative service in Kiteworks Email Protection Gateway did not consistently enforce administrator authentication, so the required password check could be bypassed. An attacker who referenced a valid...
CVE-2026-102115 Kiteworks Core Authentication Bypass in the Password Reset Workflow
Kiteworks Core did not correctly validate a parameter submitted to the password reset workflow. An unauthenticated attacker who knew the email address of a user with a locally stored password could potentially reset that account's password without access to the emailed reset link and then...
CVE-2026-102115
Kiteworks Core is vulnerable to an authentication bypass in its password reset workflow due to insufficient validation of a submitted parameter. An unauthenticated attacker who possesses a user's email address can reset the account's password without needing access to the emailed reset link. This...
EUVD-2026-90304
Kiteworks Core did not correctly validate a parameter submitted to the password reset workflow. An unauthenticated attacker who knew the email address of a user with a locally stored password could potentially reset that account's password without access to the emailed reset link and then...
CVE-2026-102115 Kiteworks Core Authentication Bypass in the Password Reset Workflow
Kiteworks Core did not correctly validate a parameter submitted to the password reset workflow. An unauthenticated attacker who knew the email address of a user with a locally stored password could potentially reset that account's password without access to the emailed reset link and then...
CVE-2026-103548
Improperly stored passwords in the config file in Itron MV-90 xi 3.0 allows attackers to decode the passwords and password histories to gain access to the MV-90 application as any user...
CVE-2026-103548
The Itron MV-90 xi 3.0 contains improperly stored passwords within its configuration file. This vulnerability allows an attacker to decode both current passwords and password histories, potentially granting unauthorized access to the MV-90 application as any user. No specific remediation steps or...
CLEANSTART-2024-OZ46983 When instructing cloud-init to set a random password for a new user account, versions before 21
Security vulnerability affects the cloud-init package. When instructing cloud-init to set a random password for a new user account, versions before 21...
CVE-2026-100255
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via password reset...
EUVD-2026-90004
In JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authentication after a password reset...
EUVD-2026-89999
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via password reset...
CVE-2026-100255
JetBrains TeamCity versions prior to 2026.2 , 2026.1.4 , and 2025.11.8 are vulnerable to an administrator account takeover . The root cause is identified as Improper Validation of Unsafe Equivalence in Input (CWE-1289), which specifically allowed for account takeover via the password reset functi...