grafana-bruteforce

grafana-bruteforce A tool that takes a combo username and password list and will attempt to bruteforce grafana login page. Grafana will lock you out after 5 attempts so you need to ensure your proxy has multiple external ip's. How to Run Use supplied combo list python3 grafana-brute.py -u...

Pyrit

Please Read Pyrit is old, is outdated and it's still Python2 I am currently attempting to rewrite it from scratch, so thanks for all the stars but remember to keep an eye for Python3 version. Pyrit Pyrit allows you to create massive databases of pre-computed WPA/WPA2-PSK authentication phase in a...

CVE-2021-29156

CVE-2021-29156 Proof-of-Concept c 2021 GuidePoint Security Charlton Trezevant [email protected] Background Today GuidePoint is pleased to release a functional Proof-of-Concept tool for CVE-2021-29156, an LDAP injection vulnerability in ForgeRock OpenAM v13.0.0. This vulnerability allows an...

CVE-2026-36959

CVE-2026-36959: Missing Rate Limiting on Login Endpoint CVE ID: CVE-2026-36959 Date: 2026-04-29 Discoverer: Kirubel Solomne Vendor: U-SPEED Product: U-SPEED Router Firmware Version: V1.0.0 CWE: CWE-307 - Improper Restriction of Excessive Authentication Attempts Description The U-SPEED Router...

CVE-2024-11318

CVE-2024-11318 IDOR - AbsysNet 2.3.1 User Hijacking DISCLAIMER This tool is designed to help identify and exploit whether an application is vulnerable to this specific CVE-2024-11318. It is intended for use by cybersecurity professionals, researchers, and penetration testers to assess security in...

CVE-2026-66987

The software HCL AION is affected by a vulnerability where the account lockout mechanism fails to sufficiently restrict repeated failed login attempts. This flaw allows an attacker to perform a large number of password guesses against a user account, increasing the risk of account compromise via ...

PT-2026-136393

An improper restriction of excessive authentication attempts vulnerability in the API of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to conduct brute-force attacks against user accounts if certain preconditions outside of the attacker's control are met. Successfu...

PT-2026-125114

Name of the Vulnerable Software and Affected Versions jose versions 1.10.0 through 1.11.12 Description The library uses a password hash with insufficient computational effort when exporting password-encrypted private keys. Specifically, the jose jwk:to der/2 JOSE.JWK.to der/2 function utilizes th...

RuoYi authorization issue vulnerability

Versions RuoYi 2026.09 and earlier contain a security vulnerability. This vulnerability stems from improper limits on excessive authentication attempts in the function SmsCodeServiceImpl.validateSmsCode0 within the file /file/service/sms/SmsCodeServiceImpl.java in the SMS Code Verification...

CVE-2025-61560

A race condition vulnerability in the SessionManager of CNCF: Cloud Native Computing Foundation Argo CD v3.0.6 allows attackers to bypass rate limiting and perform a brute force attack via repeated crafted requests...

CVE-2025-61560

A race condition vulnerability in the SessionManager of CNCF: Cloud Native Computing Foundation Argo CD v3.0.6 allows attackers to bypass rate limiting and perform a brute force attack via repeated crafted requests...

Rocky Linux 9 [CIQ] Security Update: openssh / openssh-askpass / openssh-askpass-debuginfo / etc (crlsa-2026_73955)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202673955 advisory. openssh: OpenSSH: Brute-force attacks facilitated due to insufficient authentication delay CVE-2026-60001 Tenable has extracted the preceding description block...

Rocky Linux 8 [CIQ] Security Update: mailman / mailman-debuginfo / mailman-debugsource Multiple Vulnerabilities (crlsa-2021_4826)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20214826 advisory. mailman: CSRF token bypass allows to perform CSRF attacks and account takeover CVE-2021-42097 mailman: CSRF token derived from admin password allows offlin...

CVE-2026-100501 Flame through 2.4.0 Brute-Force Attack via Login Endpoint

Flame through 2.4.0 contains an improper restriction of excessive authentication attempts vulnerability in the POST /api/auth login endpoint that allows unauthenticated attackers to brute-force the admin password. Attackers can submit unlimited password guesses without rate limiting, attempt...

CVE-2026-97469

PostgreSQL Anonymizer contains a vulnerability allowing authenticated, unprivileged masked users to bypass access restrictions by embedding function calls within a subquery . This allows the execution of RESTRICTED functions, such as anon.hash() . An attacker can repeatedly invoke these functions...

CVE-2026-97469 PostgreSQL Anonymizer: RESTRICTED functions are reachable through a subLink

PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to repeatedly call the anon.hash function and collects seed, hashoutput pairs to perform an offline brute-force attack and deduce the salt. A masked role can run a RESTRICTED function when the call is placed insi...

PT-2026-99068

Name of the Vulnerable Software and Affected Versions GLPI versions 11.0.0 through 11.0.7 Description The time-based one-time password TOTP verification endpoint does not limit failed submissions per user. An attacker with a user's primary authentication credentials can repeatedly submit TOTP...

CVE-2026-85734 LightRAG: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the POST /login endpoint in lightrag/api/lightragserver.py does not impose a rate limit, account lockout, delay, or counter for failed authentication attempts. A network attacker can submit password guesses at full...

PT-2026-96825

Name of the Vulnerable Software and Affected Versions LightRAG versions prior to 1.5.5 Description The 'POST /login' endpoint in lightrag/api/lightrag server.py does not implement rate limiting, account lockout, delays, or counters for failed authentication attempts. This allows a network attacke...

CVE-2026-40538: Improper Restriction of Excessive Authentication Attempts

An improper restriction of excessive authentication attempts vulnerability in Auto block in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to read limited files via brute-force attacks...