EUVD-2026-49083

The Quiz and Survey Master QSM WordPress plugin before 11.1.3 does not implement rate limiting or standard failed-login auditing on its front-end credential-check functionality and returns distinct responses for valid and invalid accounts, allowing unauthenticated attackers to enumerate valid...

BIT-OPENBAO-2025-54999 OpenBao: Timing Side-Channel in Userpass Auth Method

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 0.1.0 through 2.3.1, when using OpenBao's userpass auth method, user enumeration was possible due to timing difference between non-existent users an...

CVE-2021-32088

An issue was discovered in Quest KACE Systems Deployment Appliance SMA 11.0.273. Certain API endpoints contain a rate-limiting feature to minimize a brute-force attack. This protection can be bypassed by removing the kboxid cookie...

CVE-2021-32088

CVE-2021-32088 affects Quest KACE Systems Deployment Appliance (SMA) 11.0.273. The vulnerability lies in API endpoints’ rate-limiting protection, which can be bypassed by removing the kboxid cookie, potentially enabling brute-force attempts against authenticated users. No explicit remediation det...

CVE-2021-32088

An issue was discovered in Quest KACE Systems Deployment Appliance SMA 11.0.273. Certain API endpoints contain a rate-limiting feature to minimize a brute-force attack. This protection can be bypassed by removing the kboxid cookie...

PT-2026-65310

An issue was discovered in Quest KACE Systems Deployment Appliance SMA 11.0.273. Certain API endpoints contain a rate-limiting feature to minimize a brute-force attack. This protection can be bypassed by removing the kboxid cookie...

CVE-2026-21723

A flaw was found in Grafana. A remote attacker with very low privileges, or even anonymous access if enabled, can exploit the alertmanager templates test endpoint by mass-executing templates. This can lead to an Out-Of-Memory OOM error, causing the Grafana service to crash and resulting in a Deni...

CVE-2026-11922

The CVE-2026-11922 entry describes a rate-limit bypass in zenml-io/zenml (versions 0.57.0–0.94.2). The issue arises because the rate limiter uses request.client.host (derived from the X-Forwarded-For header when Uvicorn is run with --proxy-headers --forwarded-allow-ips *), allowing an attacker to...

EUVD-2026-48467

A vulnerability in zenml-io/zenml versions 0.57.0 through 0.94.2 allows an attacker to bypass rate-limiting on the POST /api/v1/login and self password-change endpoints by rotating the X-Forwarded-For header. The rate limiter keys requests by request.client.host, which is derived from the...

EUVD-2026-48245

Grav API Plugin versions before 1.0.10 fail to restrict write access to security-critical plugin configuration scopes, allowing authenticated users with api.config.write privilege to modify rate limiting and CORS settings. Attackers can disable rate limiting site-wide to enable credential...

CVE-2026-65895 Grav API Plugin before 1.0.10 Broken Access Control

Grav API Plugin versions before 1.0.10 fail to restrict write access to security-critical plugin configuration scopes, allowing authenticated users with api.config.write privilege to modify rate limiting and CORS settings. Attackers can disable rate limiting site-wide to enable credential...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the processing of xDS RBAC policies and HTTP/2 transport handling. An attacker can gain unauthorized access to protected services or cause denial of service by exploiting improper handling of unsupported field...

EUVD-2026-42325

Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication...

CVE-2026-53596

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the FreeScout helpdesk application does not enforce rate limiting on the file upload endpoint. Any user can flood the server with upload requests, leading to database overload and potentia...

CVE-2026-53596 FreeScout has unrestricted file upload without rate limiting that leads to resource exhaustion (DoS)

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the FreeScout helpdesk application does not enforce rate limiting on the file upload endpoint. Any user can flood the server with upload requests, leading to database overload and potentia...

CVE-2026-53596 FreeScout has unrestricted file upload without rate limiting that leads to resource exhaustion (DoS)

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the FreeScout helpdesk application does not enforce rate limiting on the file upload endpoint. Any user can flood the server with upload requests, leading to database overload and potentia...

CVE-2026-53596

CVE-2026-53596 affects FreeScout (Laravel-based help desk). Before version 1.8.224, the file upload endpoint lacks rate limiting, allowing unauthenticated users to flood uploads, risking database overload and DoS for all users. The cited fix is in FreeScout v1.8.224. No exploitation details are p...

CVE-2026-32825

dataCycle-CORE (dataCycle data management system) before version 26.06.08 contains a password-guessing vulnerability: it enables Devise’s lockable module but disables lock/unlock strategies and lacks rate limiting, allowing unlimited login attempts on both the browser (/users/sign_in) and API (/a...

CVE-2026-32825 dataCycle No Brute-Force Protection On Web And API Login Endpoints

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the application accepts unlimited password guesses against both the...

CVE-2026-13142

The Social Login, Passkeys, Magic Link & Email OTP WordPress plugin before 1.4.1 does not enforce rate limiting or a working attempt lockout on its passwordless email one-time-password verification, and stores the short numeric codes in plaintext, allowing an unauthenticated attacker who knows a...