EUVD-2026-88567

Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses against any account. Attackers can brute-force login credentials via POST /api/tokens and subsequently guess TOTP codes via POST /api/tokens/2f...

Linux Distros Unpatched Vulnerability : CVE-2026-49470

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, the time-based one-time password verification endpoint does not limit failed...

CVE-2026-102334

Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses against any account. Attackers can brute-force login credentials via POST /api/tokens and subsequently guess TOTP codes via POST /api/tokens/2f...

CVE-2026-102334 Nginx Proxy Manager through 2.16.0 Missing Brute-Force Protection

Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses against any account. Attackers can brute-force login credentials via POST /api/tokens and subsequently guess TOTP codes via POST /api/tokens/2f...

CVE-2026-102334 Nginx Proxy Manager through 2.16.0 Missing Brute-Force Protection

Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses against any account. Attackers can brute-force login credentials via POST /api/tokens and subsequently guess TOTP codes via POST /api/tokens/2f...

CVE-2026-102334

Nginx Proxy Manager versions through 2.16.0 are vulnerable to brute-force attacks due to a lack of rate-limiting on authentication endpoints. Unauthenticated attackers can make unlimited password guesses via POST /api/tokens and subsequently guess TOTP codes via POST /api/tokens/2fa . Successful ...

CVE-2026-102334 Nginx Proxy Manager through 2.16.0 Missing Brute-Force Protection

Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses against any account. Attackers can brute-force login credentials via POST /api/tokens and subsequently guess TOTP codes via POST /api/tokens/2f...

SafeGuard

./safeguard --version 1.0 Safeguard is a fast, lightweight, cross-platform command-line file encryption tool written in Go. Security Notice This project is a learning-oriented file encryption tool. While it uses standard cryptographic primitives from Go’s standard library e.g. AES-GCM for...

CVE-2026-97469

A flaw was found in PostgreSQL Anonymizer. An authenticated, unprivileged masked user can bypass access restrictions to execute restricted functions by embedding function calls within a subquery. By repeatedly invoking functions such as anon.hash, an attacker can collect output to deduce the...

CVE-2026-102334: Improper Restriction of Excessive Authentication Attempts

Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses against any account. Attackers can brute-force login credentials via POST /api/tokens and subsequently guess TOTP codes via POST /api/tokens/2f...

CVE-2026-100678 stoatchat before 0.15.5 MFA Brute Force via Insufficient Rate Limiting

stoatchat before 0.15.5 fails to enforce account-level attempt limits on MFA login challenges, allowing attackers who know a password to guess TOTP codes with only IP-based rate limiting. Attackers can reuse MFA challenge tickets across multiple failed attempts and distribute guesses across IP...

CVE-2026-100678 stoatchat before 0.15.5 MFA Brute Force via Insufficient Rate Limiting

stoatchat before 0.15.5 fails to enforce account-level attempt limits on MFA login challenges, allowing attackers who know a password to guess TOTP codes with only IP-based rate limiting. Attackers can reuse MFA challenge tickets across multiple failed attempts and distribute guesses across IP...

CVE-2026-100678 stoatchat before 0.15.5 MFA Brute Force via Insufficient Rate Limiting

stoatchat before 0.15.5 fails to enforce account-level attempt limits on MFA login challenges, allowing attackers who know a password to guess TOTP codes with only IP-based rate limiting. Attackers can reuse MFA challenge tickets across multiple failed attempts and distribute guesses across IP...

CLEANSTART-2026-CG56781 When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as fo...

Security vulnerability affects the loki package. When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded...

EUVD-2026-87367

Flame through 2.4.0 contains an improper restriction of excessive authentication attempts vulnerability in the POST /api/auth login endpoint that allows unauthenticated attackers to brute-force the admin password. Attackers can submit unlimited password guesses without rate limiting, attempt...

CVE-2026-100501

Flame through 2.4.0 contains an improper restriction of excessive authentication attempts vulnerability in the POST /api/auth login endpoint that allows unauthenticated attackers to brute-force the admin password. Attackers can submit unlimited password guesses without rate limiting, attempt...

CVE-2026-100501

Versions of Flame through 2.4.0 are vulnerable to an improper restriction of excessive authentication attempts in the POST /api/auth login endpoint. Due to a lack of rate limiting, attempt counters, lockouts, or delays, unauthenticated attackers can brute-force the administrator password. Success...

CVE-2026-100501 Flame through 2.4.0 Brute-Force Attack via Login Endpoint

Flame through 2.4.0 contains an improper restriction of excessive authentication attempts vulnerability in the POST /api/auth login endpoint that allows unauthenticated attackers to brute-force the admin password. Attackers can submit unlimited password guesses without rate limiting, attempt...

CVE-2026-100501 Flame through 2.4.0 Brute-Force Attack via Login Endpoint

Flame through 2.4.0 contains an improper restriction of excessive authentication attempts vulnerability in the POST /api/auth login endpoint that allows unauthenticated attackers to brute-force the admin password. Attackers can submit unlimited password guesses without rate limiting, attempt...

CVE-2026-100501 Flame through 2.4.0 Brute-Force Attack via Login Endpoint

Flame through 2.4.0 contains an improper restriction of excessive authentication attempts vulnerability in the POST /api/auth login endpoint that allows unauthenticated attackers to brute-force the admin password. Attackers can submit unlimited password guesses without rate limiting, attempt...