CVE-2026-73576

CVE-2026-73576 affects Zimbra Collaboration (ZCS) before 10.1.17 via the OnlyOffice integration. The zimbraDocumentEditingJwtSecret is generated with an insecure RNG, yielding insufficient entropy. This may allow offline brute-forcing to recover the JWT signing secret, enabling JWT forgery and po...

CVE-2026-73576

In Zimbra Collaboration ZCS before 10.1.17, weak cryptographic key generation vulnerability exists in the OnlyOffice integration. The zimbraDocumentEditingJwtSecret is generated using an insecure random number generator, resulting in insufficient entropy. An attacker who obtains a JWT signed with...

CVE-2026-73576

In Zimbra Collaboration ZCS before 10.1.17, weak cryptographic key generation vulnerability exists in the OnlyOffice integration. The zimbraDocumentEditingJwtSecret is generated using an insecure random number generator, resulting in insufficient entropy. An attacker who obtains a JWT signed with...

CVE-2026-19292

Re-pairing with a legitimate device can use a lower security level than previous making brute-forcing the LTK easier. See V4 in the BLERP paper linked below...

CVE-2026-19293

SMP security request from peripheral does not include the maximum encryption key size supported. Using a key with less than the maximum keysize makes brute-forcing the key easier. See V6 in BLERP paper linked below...

[R1] Security Center Version 6.9.0 Fixes Multiple Vulnerabilities

R1 Security Center Version 6.9.0 Fixes Multiple Vulnerabilities Arnie Cabral Thu, 08/13/2026 - 10:35 Security Center leverages third-party software to help provide underlying functionality. Several of the third-party components curl, underscoreJS were found to contain vulnerabilities, and updated...

EUVD-2026-58076

SMP security request from peripheral does not include the maximum encryption key size supported. Using a key with less than the maximum keysize makes brute-forcing the key easier. See V6 in BLERP paper linked below...

CVE-2026-19293

The vulnerability CVE-2026-19293 concerns the BLE SMP (Security Manager Protocol) security request where the peripheral omits the maximum supported encryption key size. This omission can allow brute-forcing of the key more easily for an adjacent attacker. The entry cites the BLERP paper and provi...

CVE-2026-19293 SMP security request

SMP security request from peripheral does not include the maximum encryption key size supported. Using a key with less than the maximum keysize makes brute-forcing the key easier. See V6 in BLERP paper linked below...

CVE-2026-19292

The CVE-2026-19292 entry describes a Bluetooth re-pairing flow where pairing with a legitimate device can switch to a lower security level than before, making brute-force attempts on the Long-Term Key (LTK) easier. The issue is documented with CVSS 3.1 base metrics (8.8, HIGH) and an adjacent att...

CVE-2026-19292 Bluetooth re-pairing with legitimate device can use lower security level

Re-pairing with a legitimate device can use a lower security level than previous making brute-forcing the LTK easier. See V4 in the BLERP paper linked below...

EUVD-2026-57927

Re-pairing with a legitimate device can use a lower security level than previous making brute-forcing the LTK easier. See V4 in the BLERP paper linked below...

PT-2026-71682

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration ZCS versions prior to 10.1.17 Description A weak cryptographic key generation issue exists in the OnlyOffice integration. The zimbraDocumentEditingJwtSecret is generated using an insecure random number generator, which lea...

Schneider Electric PowerChute Serial Shutdown < 1.6 Improper Restriction of Excessive Authentication Attempts (SEVD-2026-223-01)

The version of Schneider Electric PowerChute Serial Shutdown installed on the remote host is prior to 1.6. It is, therefore, affected by a vulnerability. - CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow an attacker to gain unauthorized...

Security Bulletin: Insufficient Authentication Brute Force Protection on Login Endpoint

Summary A rate limiting capability exists within the product to restrict the number of authentication attempts permitted per IP address per minute against the login endpoint POST /api/v1/login. This control is configurable via the LANGFLOWRATELIMITENABLED environment variable, which defaults to...

CVE-2026-73306

Budibase is an open-source low-code platform. Prior to 3.39.25, POST /api/global/auth/:tenantId/login incremented the failure counter in packages/worker/src/api/controllers/global/auth.ts only for existing users, while packages/worker/src/middleware/emailLockout.ts returned X-Account-Locked and...

EUVD-2026-56981

The Mira cloud authentication endpoints do not enforce per-account rate limiting, per-IP throttling, or account lockout after repeated failed login attempts. An attacker can use brute-force methods to obtain gain access to user accounts...

CVE-2026-66340

The Mira cloud authentication endpoints do not enforce per-account rate limiting, per-IP throttling, or account lockout after repeated failed login attempts. An attacker can use brute-force methods to obtain gain access to user accounts...

CVE-2026-66340

The Mira cloud authentication endpoints do not enforce per-account rate limiting, per-IP throttling, or account lockout after repeated failed login attempts. An attacker can use brute-force methods to obtain gain access to user accounts...

CVE-2026-66340 Mira Hormone Monitor, Mira Android App Improper restriction of excessive authentication attempts

The Mira cloud authentication endpoints do not enforce per-account rate limiting, per-IP throttling, or account lockout after repeated failed login attempts. An attacker can use brute-force methods to obtain gain access to user accounts...