CVE-2026-70617

Spacebar Server before commit dcfd910 contains a missing authorization vulnerability that allows any authenticated attacker to add themselves to arbitrary group DM channels by sending a PUT request to the channels recipient endpoint without membership verification. Attackers can exploit the...

keycloak-admin-ui: keycloak-admin-ui:Admin UI extension brute-force-user endpoint bypasses FGAPv2 user view restrictions

A vulnerability was discovered in Keycloak's Admin UI extension that allows certain administrative users to bypass security restrictions. When Fine-Grained Admin Permissions FGAPv2 are enabled, an administrator who should only be able to search for users but not view their full details can use a...

keycloak: Keycloak: Brute-force protection bypass in CIBA flow

A flaw was found in Keycloak, an open-source identity and access management solution. When a user account is temporarily locked due to repeated failed login attempts, an attacker with valid client credentials can exploit the Client-Initiated Backchannel Authentication CIBA flow to bypass this...

keycloak: Keycloak: Brute-force protection bypass in CIBA flow

A flaw was found in Keycloak, an open-source identity and access management solution. When a user account is temporarily locked due to repeated failed login attempts, an attacker with valid client credentials can exploit the Client-Initiated Backchannel Authentication CIBA flow to bypass this...

keycloak-admin-ui: keycloak-admin-ui:Admin UI extension brute-force-user endpoint bypasses FGAPv2 user view restrictions

A vulnerability was discovered in Keycloak's Admin UI extension that allows certain administrative users to bypass security restrictions. When Fine-Grained Admin Permissions FGAPv2 are enabled, an administrator who should only be able to search for users but not view their full details can use a...

EUVD-2026-39020

Ghost Content API filter bypass reveals private fields...

CVE-2026-71205

changedetection.io's /login route checks the submitted password against a single PBKDF2-HMAC-SHA256 hash with no per-IP or per-session rate limiting, failed-attempt counter, or lockout no rate-limiting library is present in requirements.txt. Because the entire application is protected by one shar...

CVE-2026-15210

The OTP Login With Phone Number, OTP Verification WordPress plugin before 1.8.71 does not limit the number of OTP verification attempts or invalidate a one-time login code after a wrong guess, and an unauthenticated user can request a login code for any account. Because the code is a short numeri...

CVE-2026-71213 typemill: No Rate Limiting on Login Endpoint Enables Unlimited Password Brute-Force

Typemill's login endpoint POST /tm/login, ControllerWebAuth::login performs no rate-limiting, failed-attempt counting, or account lockout when captcha is disabled, which is the default configuration. An unauthenticated attacker can send unlimited password-guessing requests against any account,...

CVE-2026-71213

CVE-2026-71213 (typemill) : The login endpoint POST /tm/login (ControllerWebAuth::login()) has no rate-limiting, failed-attempt counting, or account lockout when captcha is disabled (default). An unauthenticated attacker can perform unlimited password-guessing against any account, including admin...

EUVD-2026-53202

changedetection.io's /login route checks the submitted password against a single PBKDF2-HMAC-SHA256 hash with no per-IP or per-session rate limiting, failed-attempt counter, or lockout no rate-limiting library is present in requirements.txt. Because the entire application is protected by one shar...

CVE-2026-71205 changedetection.io: No Rate Limiting on /login Enables Unlimited Password Brute-Force

changedetection.io's /login route checks the submitted password against a single PBKDF2-HMAC-SHA256 hash with no per-IP or per-session rate limiting, failed-attempt counter, or lockout no rate-limiting library is present in requirements.txt. Because the entire application is protected by one shar...

CVE-2026-71205

The CVE-2026-71205 issue affects changedetection.io: the /login endpoint authenticates against a single shared password using PBKDF2-HMAC-SHA256 with no per-IP or per-session rate limiting, no failed-attempt counter, and no lockout. This effectively provides unlimited brute-force opportunities, a...

CVE-2026-15210 Login/Signup with Phone Number, OTP Verification < 1.8.71 - Unauthenticated Account Takeover via OTP Brute Force

The OTP Login With Phone Number, OTP Verification WordPress plugin before 1.8.71 does not limit the number of OTP verification attempts or invalidate a one-time login code after a wrong guess, and an unauthenticated user can request a login code for any account. Because the code is a short numeri...

EUVD-2026-53117

The OTP Login With Phone Number, OTP Verification WordPress plugin before 1.8.71 does not limit the number of OTP verification attempts or invalidate a one-time login code after a wrong guess, and an unauthenticated user can request a login code for any account. Because the code is a short numeri...

CVE-2026-15210

The CVE-2026-15210 entry concerns the WordPress plugin “OTP Login With Phone Number, OTP Verification” (before version 1.8.71). The vulnerability is that the plugin does not limit OTP verification attempts or invalidate a one-time code after a wrong guess, allowing an unauthenticated user to requ...

CVE-2026-16055

The CVE concerns the Contest Gallery WordPress plugin prior to 30.0.7. The root cause is that the front-end login bypasses the standard WordPress authentication flow, issuing an authentication cookie immediately after the password check. This bypasses brute-force protection and two-factor authent...

Joomla! Component Love Factory 1.3.4 - Local File Inclusion

A directory traversal vulnerability in the Love Factory comlovefactory component 1.3.4 for Joomla! allows remote attackers to read arbitrary files via a .. dot dot in the controller parameter to index.php. id: CVE-2010-1957 info: name: Joomla! Component Love Factory 1.3.4 - Local File Inclusion...

WordPress Anti-Malware Security and Brute-Force Firewall <4.21.83 - Cross-Site Scripting

WordPress Anti-Malware Security and Brute-Force Firewall plugin before 4.21.83 contains a cross-site scripting vulnerability. The plugin does not sanitize and escape some parameters before outputting them back in an admin dashboard. id: CVE-2022-2599 info: name: WordPress Anti-Malware Security an...

CVE-2026-38447

osTicket 1.18.3 generates API keys using a predictable construction based on MD5 hashing. The use of MD5, combined with predictable inputs such as the current timestamp and client IP address, significantly reduces entropy. An attacker can approximate the key generation time and brute-force the ke...