CVE-2026-105237

A vulnerability was detected in linlinjava litemall up to 1.8.0. This affects an unknown part of the file litemall-admin-api/src/main/java/org/linlinjava/litemall/admin/web/AdminAuthController.java of the component Login Endpoint. The manipulation results in improper restriction of excessive...

EUVD-2026-92259

A vulnerability was detected in linlinjava litemall up to 1.8.0. This affects an unknown part of the file litemall-admin-api/src/main/java/org/linlinjava/litemall/admin/web/AdminAuthController.java of the component Login Endpoint. The manipulation results in improper restriction of excessive...

CVE-2026-105237: Improper Restriction of Excessive Authentication Attempts

A vulnerability was detected in linlinjava litemall up to 1.8.0. This affects an unknown part of the file litemall-admin-api/src/main/java/org/linlinjava/litemall/admin/web/AdminAuthController.java of the component Login Endpoint. The manipulation results in improper restriction of excessive...

PT-2026-104726

A vulnerability was detected in linlinjava litemall up to 1.8.0. This affects an unknown part of the file litemall-admin-api/src/main/java/org/linlinjava/litemall/admin/web/AdminAuthController.java of the component Login Endpoint. The manipulation results in improper restriction of excessive...

CVE-2026-103977

Resumen Las versiones de FileRise anteriores a la 3.23.0 almacenaban los intentos fallidos de verificación TOTP en el estado de sesión de PHP. El contador limitaba los intentos dentro de una sesión, pero no persistía entre sesiones recién creadas. Un atacante que ya posee la credencial primaria...

CVE-2026-100501

Versions of Flame through 2.4.0 are vulnerable to an improper restriction of excessive authentication attempts in the POST /api/auth login endpoint. Due to a lack of rate limiting, attempt counters, lockouts, or delays, unauthenticated attackers can brute-force the administrator password. Success...

CVE-2026-37603

The pH7Builder (pH7 Social Dating CMS) software, versions through 19.2.0 , is vulnerable to an improper restriction of excessive authentication attempts in the administration login. The root cause is that the CAPTCHA escalation flag is stored in the PHP session as captcha_admin_enabled, and the C...

CVE-2026-37603: Improper Restriction of Excessive Authentication Attempts

Improper Restriction of Excessive Authentication Attempts in the administration login of pH7Software pH7Builder pH7 Social Dating CMS through 19.2.0. The CAPTCHA escalation flag is stored in the PHP session as captchaadminenabled and the CAPTCHA form element is only built when that flag is presen...

CVE-2026-37603

Improper Restriction of Excessive Authentication Attempts in the administration login of pH7Software pH7Builder pH7 Social Dating CMS through 19.2.0. The CAPTCHA escalation flag is stored in the PHP session as captchaadminenabled and the CAPTCHA form element is only built when that flag is presen...

CVE-2026-37603

Improper Restriction of Excessive Authentication Attempts in the administration login of pH7Software pH7Builder pH7 Social Dating CMS through 19.2.0. The CAPTCHA escalation flag is stored in the PHP session as captchaadminenabled and the CAPTCHA form element is only built when that flag is presen...

CVE-2026-77561: Improper Restriction of Excessive Authentication Attempts

Tinyauth is an authentication and authorization server. Prior to 5.1.0, an unauthenticated remote attacker can send POST /api/user/login requests with 257 distinct nonexistent usernames to fill MaxLoginAttemptRecords and activate a global login lockdown. internal/controller/usercontroller.go...

CVE-2026-46649: Improper Restriction of Excessive Authentication Attempts

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's GET /api/loginwithcode/:id endpoint accepts a nine-digit SSO authentication code with a ten-minute lifetime without applying limiterLoginBruteForce. An...

CVE-2026-93650: Improper Restriction of Excessive Authentication Attempts

A vulnerability was determined in Saleor up to 3.20.118/3.21.54/3.22.47/3.23.14. This vulnerability affects the function getclientip of the file saleor/account/throttling.py. Executing a manipulation can lead to improper restriction of excessive authentication attempts. The attack can be executed...

CVE-2026-78490: Improper Restriction of Excessive Authentication Attempts

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Restriction of Excessive Authentication Attempts vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading ...

PT-2026-86755

Name of the Vulnerable Software and Affected Versions BiHayat App versions 2.1.7 through 2.2.x Description Improper restriction of excessive authentication attempts allows for an authentication bypass. Recommendations Update BiHayat App to version 2.3...

CVE-2026-6223: Improper Restriction of Excessive Authentication Attempts

Improper restriction of excessive authentication attempts vulnerability in Bahçelievler Muncipality BiHayat App allows Authentication Bypass. This issue affects BiHayat App: from 2.1.7 before 2.3...

CVE-2026-78655: Improper Restriction of Excessive Authentication Attempts

Punk::Plugin::TOTP versions before 0.05 for Perl allow the second-factor attempt limit to be reset by replaying an earlier session cookie because the challenge route counts failures in the session. The POST handler on challengepath keeps the failure count as tries inside the totppending record in...

CVE-2026-18260: Improper Restriction of Excessive Authentication Attempts

Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Disable Login Page allows Brute Force. This issue affects Disable Login Page versions: from 0.0.0 to 1.1.4...

CVE-2026-75773: Improper Restriction of Excessive Authentication Attempts

A vulnerability was found in karakeep-app karakeep up to 0.32.0. The affected element is the function authorize of the file apps/web/server/auth.ts of the component Login Endpoint. The manipulation results in improper restriction of excessive authentication attempts. The attack may be performed...

CVE-2026-73056: Improper Restriction of Excessive Authentication Attempts

SiYuan kernel versions before 3.7.4 contain an improper restriction of excessive authentication attempts vulnerability in the CheckAuth middleware. The middleware accepts the API token Conf.Api.Token via an Authorization header Token/Bearer or a ?token= query parameter, and neither path is...