ADFSpray

ADFSpray ADFSpray is a python3 tool to perform password spray attack against Microsoft ADFS. ALWAYS VERIFY THE LOCKOUT POLICY TO PREVENT LOCKING USERS. How to use it First, install the needed dependencies: pip3 install -r requirements.txt Run the tool with the needed flags: python3 ADFSpray.py -u...

SSHUsernameBruter-SSHUB

SSHUsernameBruter SSHUB Fully functional script for brute forcing a list or supplied usernames againse vulnerable OpenSSH servers with the option to try username/username as login credentials - CVE-2018-15473...

patator

Patator Patator fue escrito por frustración al usar Hydra, Medusa, Ncrack, módulos de Metasploit y scripts NSE de Nmap para ataques de adivinación de contraseñas. Opté por un enfoque diferente para no crear otra herramienta de fuerza bruta y evitar repetir las mismas deficiencias. Patator es una...

Rate-Limiting Bypass

code.vikunja.io/api is vulnerable to a rate-limiting bypass. The vulnerability is due to missing rate limits on login, registration, password-reset, and OAuth token endpoints, which allows remote unauthenticated attackers to perform unlimited credential guessing, enumerate user accounts, and floo...

GHSA-M469-88XX-8RX2 Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords

Summary The /dav, /.well-known, and /feeds groups are registered on the root Echo instance with only BasicAuth and no rate limiter. CalDAV BasicAuth accepts the plain account password, so password guessing over /dav is unbounded and never returns 429, while /api/v1/login is throttled from the ten...

EUVD-2026-78649

Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords...

Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords

Summary The /dav, /.well-known, and /feeds groups are registered on the root Echo instance with only BasicAuth and no rate limiter. CalDAV BasicAuth accepts the plain account password, so password guessing over /dav is unbounded and never returns 429, while /api/v1/login is throttled from the ten...

Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited

Summary registerAPIRoutesV2 never applies the unconditional pre-auth rate-limit floor unauthRateLimit to the v2 public routes — it passes that limiter only to /api/v2/ws — and otherwise relies on setupRateLimit, which registers nothing when ratelimit.enabled is false the default. So on a stock...

EUVD-2026-78648

Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited...

russh: russh: Authentication attempt limit bypass via unenforced maximum authentication attempts

A flaw was found in russh. The server fails to enforce the configured limit on maximum authentication attempts during user authentication. An unauthenticated remote attacker can exploit this flaw by continuously submitting authentication requests over a single connection. This allows an attacker ...

Gemini’s breach of real companies exposes an AI guardrail problem

Google says one of its Gemini models accessed systems belonging to three real companies during a cybersecurity evaluation in May. The model reportedly guessed credentials in one case, while finding exposed credentials in public repositories in two others. Google says Gemini stopped once it...

CVE-2026-89027

miniOrange JWT Authentication for WP REST APIs plugin for WordPress before 4.8.0 contains an authentication method downgrade vulnerability that allows unauthenticated attackers to bypass administrator-configured authentication by supplying a specific GET parameter without any capability check or...

EUVD-2026-79746

miniOrange JWT Authentication for WP REST APIs plugin for WordPress before 4.8.0 contains an authentication method downgrade vulnerability that allows unauthenticated attackers to bypass administrator-configured authentication by supplying a specific GET parameter without any capability check or...

CVE-2026-89027 miniOrange JWT Authentication for WP REST APIs < 4.8.0 Authentication Downgrade

miniOrange JWT Authentication for WP REST APIs plugin for WordPress before 4.8.0 contains an authentication method downgrade vulnerability that allows unauthenticated attackers to bypass administrator-configured authentication by supplying a specific GET parameter without any capability check or...

CVE-2026-89027

miniOrange JWT Authentication for WP REST APIs plugin for WordPress (before 4.8.0 ) contains an authentication method downgrade vulnerability. An unauthenticated attacker can supply a specific GET parameter that bypasses capability checks and nonce verification, forcing the plugin to use Basic HT...

CVE-2026-89027 miniOrange JWT Authentication for WP REST APIs < 4.8.0 Authentication Downgrade

miniOrange JWT Authentication for WP REST APIs plugin for WordPress before 4.8.0 contains an authentication method downgrade vulnerability that allows unauthenticated attackers to bypass administrator-configured authentication by supplying a specific GET parameter without any capability check or...

GHSA-M4VJ-WR5Q-CMVR Duplicate Advisory: Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-6rvj-qwjf-3m4q. This link is maintained to preserve external references. Original Description Vikunja versions before 2.6.0 fail to apply rate limiting to /api/v2 public authentication endpoints including login,...

Duplicate Advisory: Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-6rvj-qwjf-3m4q. This link is maintained to preserve external references. Original Description Vikunja versions before 2.6.0 fail to apply rate limiting to /api/v2 public authentication endpoints including login,...

CVE-2026-91973

Vikunja before 2.6.0 contains an authentication bypass vulnerability in CalDAV BasicAuth endpoints that lack rate limiting protection. Remote unauthenticated attackers can issue unbounded credential-guessing requests against /dav, /.well-known, and /feeds routes to bypass the instance's...

CVE-2026-91972

Vikunja versions before 2.6.0 fail to apply rate limiting to /api/v2 public authentication endpoints including login, register, password-reset, and OAuth token routes. Remote unauthenticated attackers can perform unbounded credential guessing, account enumeration, and password-reset flooding...