CVE-2026-26744

CVE-2026-26744 FormaLMS（4.1.18及以下版本）的密码恢复功能中存在用户枚举漏洞，该功能可通过 /lostpwd 端点访问。应用程序对有效和无效用户名返回不同的错误消息（例如，对不存在的用户返回“您输入的用户名不存在。请检查后重试。”），这使得未经身份验证的攻击者能够通过可观察的响应差异（CWE-204）判断系统中哪些用户名已注册。 此信息可被利用来实施有针对性的暴力破解或撞库攻击。 由 Lorenzo Bruno 于2026年1月发现。...

CVE-2025-25749-Weak-Password-Policy-in-HotelDruid-3.0.7

CVE-2025-25749-HotelDruid-3.0.7中弱密码策略漏洞 描述 HotelDruid 3.0.7及更早版本存在一个漏洞，该漏洞因未强制执行密码强度策略，允许用户设置弱密码。 影响 接受弱密码： 攻击者可以通过猜测简单密码或使用凭据填充攻击获得高成功率。 凭据重用风险： 如果用户在多个系统中重复使用密码，攻击者可利用已泄露的凭据。 无密码时效： 频繁更改密码以规避检测成为可能。 攻击面扩大： 结合反射型XSS（CVE-2025-25747）等漏洞，攻击者更容易获得初始立足点。 风险摘要...

Pritunl VPN Server 1.29.2145.25 - Username Enumeration

Pritunl 1.29.2145.25 contains a username enumeration issue caused by different error responses in /auth/session login attempts, letting attackers verify valid usernames, exploit requires network access to the login endpoint. id: CVE-2020-25200 info: name: Pritunl VPN Server 1.29.2145.25 - Usernam...

o365spray

o365spray o365spray は、Microsoft Office 365 O365 を対象としたユーザー名の列挙とパスワードスプレーを行うツールです。このツールは、謝辞に記載されている研究者によって調査・特定された、一連の列挙およびスプレー手法を再実装したものです。 教育、許可された、または研究目的のみに使用してください。 警告: Autologon、oAuth2、RST のユーザー列挙モジュールは、ユーザーごとに1回の認証試行を送信することで動作します。これらのモジュールをパスワードスプレーと一緒に1回の実行で使用する場合、o365spray...

CVE-2025-65427

CVE-2025-65427: Dbit N300 T1 Pro 中的认证速率限制问题 CVE ID: CVE-2025-65427 日期: 2025-12-16 发现者: Kirubel 产品: Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router 固件版本: V1.0.0 描述 在固件版本 V1.0.0 的 Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router 中发现了一个问题。该设备未在 /api/login 端点上实现速率限制（CWE-307）。 这允许远程攻击者通过自动化的 HTTP...

SecureOps-Lab

SecureOps Lab - 实时网络安全评估 概述 对一台大学 Linux 服务器执行了实时网络安全评估。分析过程中发现了活跃的攻击活动，包括暴力破解认证尝试和针对 Log4Shell CVE-2021-44228 的利用尝试。 “协调 IP”指多个源自同一子网的恶意 IP 地址，表明攻击者使用了共享的攻击基础设施或自动化攻击工具同时对系统进行攻击。 威胁分析与发现 暴力破解攻击 检测到来自单个外部 IP 的 144 次失败的 SSH 登录尝试 模式分析显示认证尝试速度极快，与自动化凭据填充行为一致 Log4Shell 利用尝试 在日志中识别出与 CVE-2021-44228...

CVE-2026-21755

HCL Hive is affected by a missing rate limit which could allow an attacker unauthorized access via brute-force or credential stuffing attacks, or cause a denial of service...

CVE-2026-21755 HCL Hive is affected by a missing rate limit

HCL Hive is affected by a missing rate limit which could allow an attacker unauthorized access via brute-force or credential stuffing attacks, or cause a denial of service...

CVE-2026-21755

HCL Hive is affected by a missing rate limit that could allow an attacker to achieve unauthorized access via brute-force or credential stuffing attacks, or cause a denion of service . The CVSS 3.1 base score is 5.3 (MEDIUM) with a network attack vector, low complexity, and no privileges required....

EUVD-2026-64893

HCL Hive is affected by a missing rate limit which could allow an attacker unauthorized access via brute-force or credential stuffing attacks, or cause a denial of service...

Security Bulletin: Insufficient Authentication Brute Force Protection on Login Endpoint

Summary A rate limiting capability exists within the product to restrict the number of authentication attempts permitted per IP address per minute against the login endpoint POST /api/v1/login. This control is configurable via the LANGFLOWRATELIMITENABLED environment variable, which defaults to...

CVE-2026-68067

The login endpoint on the Mira cloud API accepts any format-valid string in the password field and returns a live active session token for the account matching the supplied email address. An attacker could use an email address to control cloud accounts and access hormone record information and...

CVE-2026-66340

The Mira cloud authentication endpoints do not enforce per-account rate limiting, per-IP throttling, or account lockout after repeated failed login attempts. An attacker can use brute-force methods to obtain gain access to user accounts...

CVE-2026-48084

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Versions prior to 1.0.2 don't throttle failed passphrase login attempts. An attacker can submit unlimited wrong passphrase guesses against any known email address, capped only by the Argon2...

CVE-2026-48084 OpenReception doesn't rate limit passphrase login attempts

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Versions prior to 1.0.2 don't throttle failed passphrase login attempts. An attacker can submit unlimited wrong passphrase guesses against any known email address, capped only by the Argon2...

CVE-2026-48084 OpenReception doesn't rate limit passphrase login attempts

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Versions prior to 1.0.2 don't throttle failed passphrase login attempts. An attacker can submit unlimited wrong passphrase guesses against any known email address, capped only by the Argon2...

CVE-2026-48084

OpenReception’s OpenReception appointment-booking software (versions prior to 1.0.2) does not rate-limit failed passphrase login attempts in /api/auth/login, unlike the WebAuthn path which triggers a per-account 429 throttle after ~19 attempts. The absence of throttling on the passphrase branch a...

CVE-2026-8793

PaperCut NG/MF does not properly restrict excessive authentication attempts within its login component. An unauthenticated remote attacker can exploit this vulnerability to perform unrestricted brute-force or credential-stuffing attacks without triggering account lockout or rate-limiting mechanis...

CVE-2026-8793

CVE-2026-8793 affects PaperCut NG/MF: the login component does not properly restrict excessive authentication attempts, enabling an unauthenticated remote attacker to perform unrestricted brute-force or credential-stuffing attacks in some configurations. The vulnerability is due to missing accoun...

EUVD-2026-52224

PaperCut NG/MF does not properly restrict excessive authentication attempts within its login component. An unauthenticated remote attacker can exploit this vulnerability to perform unrestricted brute-force or credential-stuffing attacks without triggering account lockout or rate-limiting mechanis...