HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling through the processing of chunked encoded requests in parseheader function. An attacker can manipulate request boundaries by injecting conflicting Content-Length or Transfer-Encoding headers via trailers which can...

PT-2025-28026

Name of the Vulnerable Software and Affected Versions: MCP Python SDK versions prior to 1.10.0 Description: The issue arises when a client deliberately triggers an exception after establishing a streamable HTTP session, leading to an uncaught ClosedResourceError on the server side. This can cause...

CVE-2025-1710

The maxView Storage Manager does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it susceptible to brute-force attacks...

CVE-2025-52576

Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.46, Kanboard is vulnerable to username enumeration and IP spoofing-based brute-force protection bypass. By analyzing login behavior and abusing trusted HTTP headers, an attacker can determine vali...

CVE-2025-2171

Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 do not enforce rate limiting on password reset attempts, allowing adversaries to brute force guess the 6-digit password reset PIN...

CLSA-2025-1750785864 redis: Fix of CVE-2025-21605

CVE-2025-21605: add output buffer limiting for unauthenticated clients...

CVE-2025-2171

Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 do not enforce rate limiting on password reset attempts, allowing adversaries to brute force guess the 6-digit password reset PIN...

CVE-2025-2171

CVE-2025-2171 affects Aviatrix Controller. The issue is a failure to enforce rate limiting on password reset attempts, allowing brute‑force guessing of the 6‑digit reset PIN. Affected versions are Aviatrix Controller before 7.1.4208, 7.2.5090, and 8.0.0. Public sources in the connected documents ...

CVE-2025-52917

The Yealink RPS API before 2025-05-26 lacks rate limiting, potentially enabling information disclosure via excessive requests...

Aviatrix Controller 安全漏洞

Aviatrix Controller is a software application from the American company Aviatrix. Extend and control the native structure with the cloud provider's APIs to extend its functionality and integrate it into the software. A security vulnerability exists in Aviatrix Controller versions prior to 7.1.420...

CVE-2025-52917

The Yealink RPS API before 2025-05-26 lacks rate limiting, potentially enabling information disclosure via excessive requests...

CVE-2025-52917

The Yealink RPS API before 2025-05-26 lacks rate limiting, potentially enabling information disclosure via excessive requests...

CVE-2025-52917

The CVE applies to Yealink YMCS RPS API prior to 2025-05-26, where a lack of rate limiting enables information disclosure through excessive requests. Affected component: Yealink RPS API; root cause: missing rate-limiting controls on API endpoints, leading to potential exposure of sensitive data u...

PT-2025-26528 · Yealink · Yealink Ymcs Rps Api

Name of the Vulnerable Software and Affected Versions: Yealink YMCS RPS API versions prior to 2025-05-26 Description: The issue is related to the lack of rate limiting in the Yealink YMCS RPS API, which could potentially enable information disclosure via excessive requests. Recommendations: For...

Yealink YMCS RPS API 安全漏洞

Yealink YMCS RPS API is a device interface from China Yealink Yealink. A security vulnerability exists in the Yealink YMCS RPS API version prior to 2025-05-26, which stems from a lack of rate limiting and could lead to information disclosure...

CVE-2025-52917

The Yealink RPS API before 2025-05-26 lacks rate limiting, potentially enabling information disclosure via excessive requests...

Authentication Bypass

Weblate is vulnerable to Authentication Bypass via Brute-Force. The vulnerability is due to missing rate limiting due to the absence of throttling on the second-factor OTP verification endpoint, which allows attackers to automate OTP guessing...

CVE-2025-47951

Weblate is a web based localization tool. Prior to version 5.12, the verification of the second factor was not subject to rate limiting. The absence of rate limiting on the second factor endpoint allows an attacker with valid credentials to automate OTP guessing. This issue has been patched in...

SUSE CVE-2025-47951

Weblate is a web based localization tool. Prior to version 5.12, the verification of the second factor was not subject to rate limiting. The absence of rate limiting on the second factor endpoint allows an attacker with valid credentials to automate OTP guessing. This issue has been patched in...

Brute Force Attack

vantage6 is vulnerable to Brute Force Attack. The vulnerability is due to insufficient rate limiting due to the ability to make unlimited password change attempts using an authenticated session, allowing attackers to guess passwords...