CVE-2026-36959

CVE-2026-36959: Missing Rate Limiting on Login Endpoint CVE ID: CVE-2026-36959 Date: 2026-04-29 Discoverer: Kirubel Solomne Vendor: U-SPEED Product: U-SPEED Router Firmware Version: V1.0.0 CWE: CWE-307 - Improper Restriction of Excessive Authentication Attempts Description The U-SPEED Router...

CVE-2026-103977

Summary FileRise versions before 3.23.0 stored failed TOTP verification attempts in PHP session state. The counter limited attempts within one session but did not persist across newly created sessions. An attacker who already possesses a target account's valid primary credential could restart the...

EUVD-2026-124780

A vulnerability was found in Linksys EA8100 1.0.3.216940. This vulnerability affects unknown code of the file /jnap/core/CheckAdminPassword. The manipulation results in improper restriction of excessive authentication attempts. The attack may be performed from remote. The attack requires a high...

CVE-2026-127274

A vulnerability was found in Linksys EA8100 1.0.3.216940. This vulnerability affects unknown code of the file /jnap/core/CheckAdminPassword. The manipulation results in improper restriction of excessive authentication attempts. The attack may be performed from remote. The attack requires a high...

CVE-2026-127274

The Linksys EA8100 (firmware version 1.0.3.216940 ) contains a vulnerability in the /jnap/core/CheckAdminPassword file. This issue results in improper restriction of excessive authentication attempts , potentially allowing for brute-force attacks. While the attack is remote , it is characterized ...

CVE-2026-127274 Linksys EA8100 CheckAdminPassword excessive authentication

A vulnerability was found in Linksys EA8100 1.0.3.216940. This vulnerability affects unknown code of the file /jnap/core/CheckAdminPassword. The manipulation results in improper restriction of excessive authentication attempts. The attack may be performed from remote. The attack requires a high...

PT-2026-146101

A vulnerability was found in Linksys EA8100 1.0.3.216940. This vulnerability affects unknown code of the file /jnap/core/CheckAdminPassword. The manipulation results in improper restriction of excessive authentication attempts. The attack may be performed from remote. The attack requires a high...

CVE-2026-126616

Progressive Robot hMailServer versions 6.2.0 through 6.3.3 using a MySQL or MariaDB database are vulnerable to an improper restriction of excessive authentication attempts. The root cause involves a character encoding mismatch where the server decodes SASL PLAIN usernames as UTF-8 but the databas...

CVE-2026-126614 Improper Restriction of Excessive Authentication Attempts in hMailServer

The web services listener of Progressive Robot hMailServer 6.3.3 through 6.3.7 does not apply the server's IP ranges to the connections it accepts, which allows a remote unauthenticated attacker to go on guessing account passwords at the listener's sign-ins after the auto-ban has banned the...

CVE-2026-126614

Progressive Robot hMailServer versions 6.3.3 through 6.3.7 are vulnerable to an improper restriction of excessive authentication attempts. The web services listener (CardDAV, CalDAV, and Outlook Autodiscover) fails to apply the server's IP ranges to accepted connections, allowing a remote unauthe...

CVE-2026-126616: Improper Restriction of Excessive Authentication Attempts

The auto-ban of Progressive Robot hMailServer 6.2.0 through 6.3.3, with a MySQL or MariaDB database, can be kept from banning an address after repeated failed logons, which allows a remote unauthenticated attacker to go on guessing account passwords from a single address without being banned. The...

CVE-2026-126614: Improper Restriction of Excessive Authentication Attempts

The web services listener of Progressive Robot hMailServer 6.3.3 through 6.3.7 does not apply the server's IP ranges to the connections it accepts, which allows a remote unauthenticated attacker to go on guessing account passwords at the listener's sign-ins after the auto-ban has banned the...

CVE-2026-124575

A vulnerability was identified in SiteServer SSCMS up to 7.1.3/7.2.1/7.4.0. This issue affects the function LoginController.Submit of the file src/SSCMS.Web/Controllers/Admin/LoginController.Submit.cs of the component Admin-Login CAPTCHA. Such manipulation of the argument isForceLogoutAndLogin...

CVE-2026-124575

A vulnerability exists in SiteServer SSCMS versions up to 7.1.3, 7.2.1, and 7.4.0. The flaw resides in the Admin-Login CAPTCHA component, specifically within the LoginController.Submit function located in src/SSCMS.Web/Controllers/Admin/LoginController.Submit.cs. Manipulation of the isForceLogout...

EUVD-2026-119863

A vulnerability was identified in SiteServer SSCMS up to 7.1.3/7.2.1/7.4.0. This issue affects the function LoginController.Submit of the file src/SSCMS.Web/Controllers/Admin/LoginController.Submit.cs of the component Admin-Login CAPTCHA. Such manipulation of the argument isForceLogoutAndLogin...

CVE-2026-124575 SiteServer SSCMS Admin-Login CAPTCHA LoginController.Submit.cs LoginController.Submit excessive authentication

A vulnerability was identified in SiteServer SSCMS up to 7.1.3/7.2.1/7.4.0. This issue affects the function LoginController.Submit of the file src/SSCMS.Web/Controllers/Admin/LoginController.Submit.cs of the component Admin-Login CAPTCHA. Such manipulation of the argument isForceLogoutAndLogin...

CVE-2026-124575 SiteServer SSCMS Admin-Login CAPTCHA LoginController.Submit.cs LoginController.Submit excessive authentication

A vulnerability was identified in SiteServer SSCMS up to 7.1.3/7.2.1/7.4.0. This issue affects the function LoginController.Submit of the file src/SSCMS.Web/Controllers/Admin/LoginController.Submit.cs of the component Admin-Login CAPTCHA. Such manipulation of the argument isForceLogoutAndLogin...

EUVD-2026-117196

A flaw has been found in Campcodes Bitcoin Wallet System 1.0. This affects the function randomint of the file core/app/Http/Controllers/Auth/ForgotPasswordController.php. This manipulation causes improper restriction of excessive authentication attempts. Remote exploitation of the attack is...

CVE-2026-122049

A flaw has been found in Campcodes Bitcoin Wallet System 1.0. This affects the function randomint of the file core/app/Http/Controllers/Auth/ForgotPasswordController.php. This manipulation causes improper restriction of excessive authentication attempts. Remote exploitation of the attack is...

CVE-2026-122049

The Campcodes Bitcoin Wallet System 1.0 is vulnerable to an improper restriction of excessive authentication attempts due to a flaw in the random_int function within the core/app/Http/Controllers/Auth/ForgotPasswordController.php file. This vulnerability allows for remote exploitation, though the...