CVE-2025-26862

CVE-2025-26862 affects Ping Identity PingFederate’s HTML Form Adapter when operating in non-default redirectless mode, where it can render authentication forms unexpectedly. This behavior may enable brute-force login attempts. The issue is described consistently across multiple sources (NVD, Red ...

CVE-2025-26862 PingFederate unexpected browser flow initiation in redirectless mode

Unexpected authentication form rendering in HTML Form Adapter using only non-default redirectless mode in PingFederate allows authentication attempts which may enable brute force login attacks...

CVE-2025-26862 PingFederate unexpected browser flow initiation in redirectless mode

Unexpected authentication form rendering in HTML Form Adapter using only non-default redirectless mode in PingFederate allows authentication attempts which may enable brute force login attacks...

CVE-2025-48088

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in BrainstormForce Ultimate Addons for WPBakery Page Builder ultimatevcaddons allows Stored XSS.This issue affects Ultimate Addons for WPBakery Page Builder: from n/a through 3.21.1...

PT-2025-43964

Name of the Vulnerable Software and Affected Versions PingFederate affected versions not specified Description A configuration issue in PingFederate’s HTML Form Adapter, specifically when operating in non-default redirectless mode, can lead to unexpected authentication form rendering. This allows...

CVE-2025-60424

A lack of rate limiting in the OTP verification component of Nagios Fusion v2024R1.2 and v2024R2 allows attackers to bypass authentication via a bruteforce attack...

CVE-2025-60424

A lack of rate limiting in the OTP verification component of Nagios Fusion v2024R1.2 and v2024R2 allows attackers to bypass authentication via a bruteforce attack...

CVE-2025-60424

Nagios Fusion versions v2024R1.2 and v2024R2 are vulnerable to an authentication bypass due to a lack of rate limiting in the OTP verification component. Attackers can exploit this by using automated scripts to perform brute-force attacks against endpoints such as /verify-otp , repeatedly guessin...

CVE-2025-26862: Improper Restriction of Excessive Authentication Attempts

Unexpected authentication form rendering in HTML Form Adapter using only non-default redirectless mode in PingFederate allows authentication attempts which may enable brute force login attacks...

PT-2025-43977

Name of the Vulnerable Software and Affected Versions Nagios Fusion versions 2024R1.2 through 2024R2 Description A missing rate limit in the OTP verification component allows attackers to bypass authentication through brute-force attacks. Recommendations Apply a rate limit to the OTP verification...

Nagios Fusion security vulnerabilities

Nagios Fusion is a centralized monitoring and visualization platform from Nagios Corporation, USA. A security vulnerability exists in Nagios Fusion version v2024R1.2 and v2024R2, which stems from a lack of rate limiting in the OTP authentication component, which could lead to a brute force attack...

Ping Identity PingFederate security vulnerabilities

Ping Identity PingFederate is a flagship software-based federation server from US-based Ping Identity, Inc. for identity management. A security vulnerability exists in Ping Identity PingFederate that stems from the HTML Form Adapter accidentally rendering authentication forms in a non-default no...

VirtFusion security vulnerabilities

VirtFusion is a virtualization management panel from VirtFusion, UK. A security vulnerability exists in VirtFusion 6.0.2 and earlier versions, which stems from an improper restriction of authentication attempts for the Email Change Handler component in the file /account/settings, which could lead...

Weak Password Requirements

Overview microweber/microweber is a new generation CMS with drag and drop. Affected versions of this package are vulnerable to Weak Password Requirements in the password reset process. An attacker can gain unauthorized access to user or administrative accounts using weak passwords that are easily...

Mattermost Sensitive Data Protection Brute Force

The vulnerability of the Mattermost instant messaging application is related to insufficient protection of sensitive data. Exploiting this vulnerability could allow a malicious actor to carry out a brute-force attack remotely...

CVE-2025-34155

Tibbo AggreGate Network Manager 6.40.05 contains an observable response discrepancy in its login functionality. Authentication failure messages differ based on whether a supplied username exists or not, allowing an unauthenticated remote attacker to infer valid account identifiers. This can...

Moodle vulnerable to brute-force password guesses

Moodle's mobile and web service authentication endpoints did not sufficiently restrict repeated password attempts, making them susceptible to brute-force attacks...

GHSA-M58F-9PVV-8MP2 Moodle vulnerable to brute-force password guesses

Moodle's mobile and web service authentication endpoints did not sufficiently restrict repeated password attempts, making them susceptible to brute-force attacks...

CVE-2025-62399

Moodle’s mobile and web service authentication endpoints did not sufficiently restrict repeated password attempts, making them susceptible to brute-force attacks...

UBUNTU-CVE-2025-62399

Moodle’s mobile and web service authentication endpoints did not sufficiently restrict repeated password attempts, making them susceptible to brute-force attacks...