CVE-2026-18259 Token Content Access - Moderately critical - Access bypass - SA-CONTRIB-2026-090

Observable Timing Discrepancy vulnerability in Drupal Token Content Access allows Brute Force. This issue affects Token Content Access versions: from 0.0.0 to 3.1.2...

CVE-2026-18259

Drupal Token Content Access (versions 0.0.0 through 3.1.2 ) contains an observable timing discrepancy in its access token comparison logic. Because the module does not sufficiently protect the token comparison in some cases, a persistent attacker who knows or discovers a URL for protected content...

CVE-2026-18259 Token Content Access - Moderately critical - Access bypass - SA-CONTRIB-2026-090

Observable Timing Discrepancy vulnerability in Drupal Token Content Access allows Brute Force. This issue affects Token Content Access versions: from 0.0.0 to 3.1.2...

CVE-2026-62862

Typebot is an open-source chatbot builder. In self-hosted versions up to and including 3.17.1, the default passwordless email magic-link authentication is vulnerable to login-code brute forcing that leads to account takeover. The email provider overrides NextAuth's default cryptographically secur...

CVE-2026-62862

Typebot (open-source chatbot builder), self-hosted versions ≤ 3.17.1 , is vulnerable to account takeover via brute-forcing of the passwordless email magic-link login code. The root cause is a 6-digit code generated with Math.random() (only 900,000 combinations) with a 10-minute expiry, no attempt...

CVE-2026-62862 TypeBot: Account takeover via brute-forceable 6-digit magic-link code

Typebot is an open-source chatbot builder. In self-hosted versions up to and including 3.17.1, the default passwordless email magic-link authentication is vulnerable to login-code brute forcing that leads to account takeover. The email provider overrides NextAuth's default cryptographically secur...

CVE-2026-62862 TypeBot: Account takeover via brute-forceable 6-digit magic-link code

Typebot is an open-source chatbot builder. In self-hosted versions up to and including 3.17.1, the default passwordless email magic-link authentication is vulnerable to login-code brute forcing that leads to account takeover. The email provider overrides NextAuth's default cryptographically secur...

CVE-2026-78655

Punk::Plugin::TOTP (Perl) versions before 0.05 allow an attacker to bypass the TOTP second-factor attempt limit by replaying a previously saved session cookie. Because Punk::Session stores the failure counter inside a signed client-side cookie, a saved cookie from before the failed attempts resto...

CVE-2026-78655 Punk::Plugin::TOTP versions before 0.05 for Perl allow the second-factor attempt limit to be reset by replaying an earlier session cookie because the challenge route counts failures in the session

Punk::Plugin::TOTP versions before 0.05 for Perl allow the second-factor attempt limit to be reset by replaying an earlier session cookie because the challenge route counts failures in the session. The POST handler on challengepath keeps the failure count as tries inside the totppending record in...

BIT-KEYCLOAK-2024-4629 Keycloak: potential bypass of brute force protection

A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating multiple login requests simultaneously, attackers can exceed the configured limits for failed attempts before the system locks them out. Thi...

CVE-2026-56710

Grav Login plugin versions before 1.0.16 fail to validate the target account's privilege level in the onApiUserListRowAction unlock handler. An attacker with api.users.write permission can clear login lockout counters on admin.super accounts, removing brute-force protection from the...

CVE-2026-56710

Grav Login plugin versions prior to 1.0.16 contain a privilege validation flaw in the onApiUserListRowAction unlock handler . An attacker possessing the api.users.write permission can clear login lockout counters on admin.super accounts without holding equivalent privileges, effectively removing ...

CVE-2026-56710 Grav Login Plugin before 1.0.16 Privilege Escalation via Unlock

Grav Login plugin versions before 1.0.16 fail to validate the target account's privilege level in the onApiUserListRowAction unlock handler. An attacker with api.users.write permission can clear login lockout counters on admin.super accounts, removing brute-force protection from the...

PT-2026-81990

A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating multiple login requests simultaneously, attackers can exceed the configured limits for failed attempts before the system locks them out. Thi...

CVE-2026-78551

RansomLook contains multiple weaknesses in its authentication endpoint that allow an unauthenticated remote attacker to enumerate valid usernames, perform unrestricted password-guessing attacks, and potentially exhaust application worker resources. For local authentication, the login implementati...

EUVD-2026-65085

RansomLook contains multiple weaknesses in its authentication endpoint that allow an unauthenticated remote attacker to enumerate valid usernames, perform unrestricted password-guessing attacks, and potentially exhaust application worker resources. For local authentication, the login implementati...

CVE-2026-78551 RansomLook Login Endpoint Allows Timing-Based Username Enumeration and Unthrottled Authentication Attempts

RansomLook contains multiple weaknesses in its authentication endpoint that allow an unauthenticated remote attacker to enumerate valid usernames, perform unrestricted password-guessing attacks, and potentially exhaust application worker resources. For local authentication, the login implementati...

CVE-2026-78551

RansomLook 's /login endpoint contained two distinct authentication weaknesses exploitable by an unauthenticated remote attacker. First, a timing-based username enumeration was possible because the password hash verification function was only invoked for existing accounts, producing measurably di...

CVE-2026-21755

HCL Hive is affected by a missing rate limit which could allow an attacker unauthorized access via brute-force or credential stuffing attacks, or cause a denial of service...

CVE-2026-21755 HCL Hive is affected by a missing rate limit

HCL Hive is affected by a missing rate limit which could allow an attacker unauthorized access via brute-force or credential stuffing attacks, or cause a denial of service...