Limit Login Attempts WordPress - Stored Cross-site Scripting

Limit Login Attempts WordPress plugin 4.0.50 contains a stored cross-site scripting caused by not escaping IP addresses controlled via headers like X-Forwarded-For before outputting them in reports, letting unauthenticated attackers execute scripts in admin context. id: CVE-2021-24657 info: name:...

Limit Login Attempts - Stored Cross-Site Scripting

Limit Login Attempts WordPress plugin 4.0.72 contains a stored cross-site scripting caused by unsanitized and unescaped settings, letting malicious administrators inject Javascript code, exploit requires administrator privileges. id: CVE-2022-1029 info: name: Limit Login Attempts - Stored...

CVE-2026-19297

IBM Langflow OSS 1.0.0–1.9.6 is affected by CVE-2026-19297 due to CWE-307: insufficient restriction of excessive authentication attempts, enabling a remote attacker to obtain unauthorized access to user accounts. The IBM Security Bulletin notes a rate-limiting mechanism for POST /api/v1/login, co...

EUVD-2026-58475

IBM Langflow OSS 1.0.0 through 1.9.6 could allow a remote attacker to obtain unauthorized access to user accounts due to improper restriction of excessive authentication attempts...

EUVD-2026-54204

The miniOrange 2FA WordPress plugin before 6.2.8 does not correctly limit the number of second-factor verification attempts, tracking them against a client-supplied identifier that is reissued on every login, allowing an attacker who already knows a user's password to guess the one-time code...

CVE-2026-16619

The miniOrange 2FA WordPress plugin before 6.2.8 does not correctly limit the number of second-factor verification attempts, tracking them against a client-supplied identifier that is reissued on every login, allowing an attacker who already knows a user's password to guess the one-time code...

CVE-2026-16619

The CVE-2026-16619 entry affects the miniOrange 2FA WordPress plugin, specifically versions before 6.2.8. The vulnerability arises because the plugin does not properly limit second-factor verification attempts; it tracks attempts using a client-supplied identifier that is reissued on every login,...

CVE-2026-71213 typemill - No Rate Limiting on Login Endpoint Enables Unlimited Password Brute-Force

Typemill's login endpoint POST /tm/login, ControllerWebAuth::login performs no rate-limiting, failed-attempt counting, or account lockout when captcha is disabled, which is the default configuration. An unauthenticated attacker can send unlimited password-guessing requests against any account,...

CVE-2026-71213 typemill - No Rate Limiting on Login Endpoint Enables Unlimited Password Brute-Force

Typemill's login endpoint POST /tm/login, ControllerWebAuth::login performs no rate-limiting, failed-attempt counting, or account lockout when captcha is disabled, which is the default configuration. An unauthenticated attacker can send unlimited password-guessing requests against any account,...

CVE-2026-71213 typemill - No Rate Limiting on Login Endpoint Enables Unlimited Password Brute-Force

Typemill's login endpoint POST /tm/login, ControllerWebAuth::login performs no rate-limiting, failed-attempt counting, or account lockout when captcha is disabled, which is the default configuration. An unauthenticated attacker can send unlimited password-guessing requests against any account,...

CVE-2026-8793

PaperCut NG/MF does not properly restrict excessive authentication attempts within its login component. An unauthenticated remote attacker can exploit this vulnerability to perform unrestricted brute-force or credential-stuffing attacks without triggering account lockout or rate-limiting mechanis...

CVE-2026-8793

CVE-2026-8793 affects PaperCut NG/MF: the login component does not properly restrict excessive authentication attempts, enabling an unauthenticated remote attacker to perform unrestricted brute-force or credential-stuffing attacks in some configurations. The vulnerability is due to missing accoun...

CVE-2026-8793

PaperCut NG/MF does not properly restrict excessive authentication attempts within its login component. An unauthenticated remote attacker can exploit this vulnerability to perform unrestricted brute-force or credential-stuffing attacks without triggering account lockout or rate-limiting mechanis...

Anthropic’s Opus 5 Is Better at Resisting Prompt Injection

The chart is interesting. On the IPI benchmark, Opus 5 improved over Opus 4.8, reducing the probability of an attacker succeeding within 15 attempts from 5.5% to 2.0%, and from 0.5% to 0.2% on 1 attempt. It also improved on Sonnet 5 5.9% at k=15 and Mythos 5 2.6%, making it the most robust model...

CVE-2026-12376

The Academy LMS WordPress plugin through 3.8.2 does not restrict access to quiz attempt records to their owner, allowing any authenticated user with subscriber-level access and above enrolled in any single course to read every user's quiz attempts across the whole site, including personal data su...

CVE-2026-12376

The Academy LMS WordPress plugin through 3.8.2 does not restrict access to quiz attempt records to their owner, allowing any authenticated user with subscriber-level access and above enrolled in any single course to read every user's quiz attempts across the whole site, including personal data su...

EUVD-2026-51435

The Academy LMS WordPress plugin through 3.8.2 does not restrict access to quiz attempt records to their owner, allowing any authenticated user with subscriber-level access and above enrolled in any single course to read every user's quiz attempts across the whole site, including personal data su...

CVE-2026-12376

CVE-2026-12376 affects the Academy LMS WordPress plugin up to version 3.8.2. The REST endpoint quiz_attempts does not restrict access to owner-only data, allowing any authenticated user with subscriber-level access (or higher) to read every user’s quiz attempts across the site. This exposes perso...

CVE-2026-12376 Academy LMS <= 3.8.2 - Subscriber+ Sensitive Information Disclosure via quiz_attempts REST Endpoint

The Academy LMS WordPress plugin through 3.8.2 does not restrict access to quiz attempt records to their owner, allowing any authenticated user with subscriber-level access and above enrolled in any single course to read every user's quiz attempts across the whole site, including personal data su...

CVE-2026-16347

MikroTik RouterOS contains an API authentication weakness where rate-limiting, account lockout, and source-based restrictions are not effectively enforced. The system can permit repeated failed logins; some versions include a fixed per-connection delay that can be bypassed via concurrent sessions...