CVE-2026-92082

Payara Server is vulnerable to brute-force login attacks because, by default, it does not limit the number of failed login attempts. The attack vector is adjacent network (AV:A) with low complexity and no privileges required, rated CVSS 4.0 6.3 (MEDIUM) with low confidential impact on the vulnera...

CVE-2026-55795

Craft Commerce (an ecommerce plugin for Craft CMS) is affected by a rate-limit bypass in CartController (src/controllers/CartController.php). The RateLimiter behavior activates only when the number POST/GET parameter is present. An unauthenticated attacker can omit number while submitting couponC...

CVE-2026-55795 Craft Commerce: Coupon Code Brute-Force via Rate Limit Bypass

Craft Commerce is an ecommerce platform for Craft CMS. From 4.0.0 until 4.11.2 and 5.6.5, CartController in src/controllers/CartController.php activates its RateLimiter only when the number POST or GET parameter is supplied. An unauthenticated attacker can submit couponCode values to...

CVE-2026-55795 Craft Commerce: Coupon Code Brute-Force via Rate Limit Bypass

Craft Commerce is an ecommerce platform for Craft CMS. From 4.0.0 until 4.11.2 and 5.6.5, CartController in src/controllers/CartController.php activates its RateLimiter only when the number POST or GET parameter is supplied. An unauthenticated attacker can submit couponCode values to...

Astra Linux – Vulnerability in LibreOffice

LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted using a single master key provided by the user. There was a flaw in LibreOffice where the master key was poorly encoded, resulting in a reduction in its entro...

tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm

In Apache Tomcat, LockOutRealm mishandled case sensitivity in usernames, resulting in less effective blocking of brute force attacks...

tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm

In Apache Tomcat, LockOutRealm mishandled case sensitivity in usernames, resulting in less effective blocking of brute force attacks...

CVE-2023-24035

An issue was discovered in Nagios XI before 5.9.3. The isinsecureloginauthenticated function uses a insecure timing comparison that leads to an attacker being able to bruteforce the admin password, by measuring timing differences in the comparison...

CVE-2023-24035

An issue was discovered in Nagios XI before 5.9.3. The isinsecureloginauthenticated function uses a insecure timing comparison that leads to an attacker being able to bruteforce the admin password, by measuring timing differences in the comparison...

CVE-2023-24035

CVE-2023-24035 affects Nagios XI before 5.9.3 . The vulnerable component is the "Insecure Backend Ticket" Authentication mechanism, specifically the is_insecure_login_authenticated function, which uses a timing-unsafe comparison of the admin password. An attacker can exploit this by measuring tim...

EUVD-2023-60635

An issue was discovered in Nagios XI before 5.9.3. The isinsecureloginauthenticated function uses a insecure timing comparison that leads to an attacker being able to bruteforce the admin password, by measuring timing differences in the comparison...

CVE-2026-89174

Smart Video Intercom System developed by Kingdom Communication Associated has a Missing Brute-force Protection vulnerability. Unauthenticated remote attackers can gain access to valid accounts through a large number of login attempts...

CVE-2026-89174

The Smart Video Intercom System developed by Kingdom Communication Associated suffers from a Missing Brute-force Protection vulnerability. Unauthenticated remote attackers can gain access to valid accounts by performing a large number of login attempts, resulting in a high confidentiality impact ...

CVE-2026-89174 Kingdom Communication Associated｜Smart Video Intercom System - Missing Burte-force Protection

Smart Video Intercom System developed by Kingdom Communication Associated has a Missing Brute-force Protection vulnerability. Unauthenticated remote attackers can gain access to valid accounts through a large number of login attempts...

EUVD-2026-76001

Smart Video Intercom System developed by Kingdom Communication Associated has a Missing Brute-force Protection vulnerability. Unauthenticated remote attackers can gain access to valid accounts through a large number of login attempts...

WordPress OTP Login & Register Woocommerce plugin <= 2.7.2 - Unauthenticated Authentication Bypass via Brute Force vulnerability

Unauthenticated Authentication Bypass via Brute Force vulnerability discovered by d4ngvn in WordPress Plugin OTP Login Woocommerce & Gravity Forms versions = 2.7.2...

CVE-2026-12215

The OTP Login & Register Woocommerce plugin for WordPress is vulnerable to Authentication Bypass via OTP Brute Force in all versions up to, and including, 2.7.2. The vulnerability exists because the OTP rate-limit attempt counter in processotpform is keyed exclusively on the attacker-controlled...

EUVD-2026-75928

The OTP Login & Register Woocommerce plugin for WordPress is vulnerable to Authentication Bypass via OTP Brute Force in all versions up to, and including, 2.7.2. The vulnerability exists because the OTP rate-limit attempt counter in processotpform is keyed exclusively on the attacker-controlled...

CVE-2026-12215

OTP Login & Register Woocommerce (WordPress plugin) is vulnerable to unauthenticated authentication bypass via OTP brute force in all versions up to and including 2.7.2 . The root cause is threefold: the OTP rate-limit counter is keyed exclusively on the attacker-controlled xoo_ml_user_ip_data co...

CVE-2026-12215 OTP Login & Register Woocommerce <= 2.7.2 - Unauthenticated Authentication Bypass via Brute Force

The OTP Login & Register Woocommerce plugin for WordPress is vulnerable to Authentication Bypass via OTP Brute Force in all versions up to, and including, 2.7.2. The vulnerability exists because the OTP rate-limit attempt counter in processotpform is keyed exclusively on the attacker-controlled...