60 matches found
CVE-2026-111679
Ekko Studio through 0.7.36 contains a missing authorization vulnerability that allows any authenticated non-superadmin user to list and clear server-wide login lockouts via /api/auth/locked-ips. Attackers can send DELETE requests without an ip parameter to invoke unlockAll, disabling the login ra...
CVE-2026-111679 Ekko Studio through 0.7.36 Missing Authorization via /api/auth/locked-ips
Ekko Studio through 0.7.36 contains a missing authorization vulnerability that allows any authenticated non-superadmin user to list and clear server-wide login lockouts via /api/auth/locked-ips. Attackers can send DELETE requests without an ip parameter to invoke unlockAll, disabling the login ra...
EUVD-2026-102970
Ekko Studio through 0.7.36 contains a missing authorization vulnerability that allows any authenticated non-superadmin user to list and clear server-wide login lockouts via /api/auth/locked-ips. Attackers can send DELETE requests without an ip parameter to invoke unlockAll, disabling the login ra...
CVE-2026-111679
Ekko Studio versions through 0.7.36 are vulnerable to a missing authorization flaw in the /api/auth/locked-ips endpoint. This allows any authenticated non-super_admin user to list and clear server-wide login lockouts. Specifically, an attacker can send a DELETE request without an IP parameter to ...
CVE-2026-111679 Ekko Studio through 0.7.36 Missing Authorization via /api/auth/locked-ips
Ekko Studio through 0.7.36 contains a missing authorization vulnerability that allows any authenticated non-superadmin user to list and clear server-wide login lockouts via /api/auth/locked-ips. Attackers can send DELETE requests without an ip parameter to invoke unlockAll, disabling the login ra...
PT-2026-116078
Ekko Studio through 0.7.36 contains a missing authorization vulnerability that allows any authenticated non-super admin user to list and clear server-wide login lockouts via /api/auth/locked-ips. Attackers can send DELETE requests without an ip parameter to invoke unlockAll, disabling the login...
CVE-2026-56592
HCL BigFix Service Management is affected by an Improper Authentication validation vulnerability caused by inadequate account lockouts . This flaw allows an unauthenticated attacker to perform sustained brute-force attacks against the login interface, potentially leading to unauthorized system ac...
CVE-2026-56592 HCL BigFix Service Management is affected by multiple security vulnerabilities.
HCL BigFix Service Management is affected by an Improper Authentication validation vulnerability related to inadequate account lockouts, which could allow an unauthenticated attacker to execute sustained brute-force attacks against the login interface, resulting in unauthorized system access...
EUVD-2026-82782
HCL BigFix Service Management is affected by an Improper Authentication validation vulnerability related to inadequate account lockouts, which could allow an unauthenticated attacker to execute sustained brute-force attacks against the login interface, resulting in unauthorized system access...
CVE-2026-56592 HCL BigFix Service Management is affected by multiple security vulnerabilities.
HCL BigFix Service Management is affected by an Improper Authentication validation vulnerability related to inadequate account lockouts, which could allow an unauthenticated attacker to execute sustained brute-force attacks against the login interface, resulting in unauthorized system access...
CVE-2026-56592: Improper Restriction of Excessive Authentication Attempts
HCL BigFix Service Management is affected by an Improper Authentication validation vulnerability related to inadequate account lockouts, which could allow an unauthenticated attacker to execute sustained brute-force attacks against the login interface, resulting in unauthorized system access...
EUVD-2026-43560
PasswordPusher before 2.9.2 contains a brute-force vulnerability in the POST /p/:token/access endpoint that lacks route-specific rate limiting and per-push lockout mechanisms. Attackers who know a push token can systematically guess passphrases at 120 attempts per minute without triggering any...
CVE-2026-56450
AIL did not restrict repeated failed attempts to verify a two-factor authentication OTP code. An attacker who had reached the 2FA verification step, such as after successfully completing the password-authentication stage, could submit an unlimited number of OTP guesses. This could enable...
CVE-2026-56450 AIL Framework - Missing Rate Limiting Enables Brute-Force Attacks Against Two-Factor Authentication Codes
AIL did not restrict repeated failed attempts to verify a two-factor authentication OTP code. An attacker who had reached the 2FA verification step, such as after successfully completing the password-authentication stage, could submit an unlimited number of OTP guesses. This could enable...
EUVD-2026-38239
AIL did not restrict repeated failed attempts to verify a two-factor authentication OTP code. An attacker who had reached the 2FA verification step, such as after successfully completing the password-authentication stage, could submit an unlimited number of OTP guesses. This could enable...
PT-2026-51313
AIL did not restrict repeated failed attempts to verify a two-factor authentication OTP code. An attacker who had reached the 2FA verification step, such as after successfully completing the password-authentication stage, could submit an unlimited number of OTP guesses. This could enable...
EUVD-2021-1501
Malware in sbrugna...
EUVD-2024-46775
Malicious code in bioql PyPI...
CVE-2020-8827
As of v1.5.0, the Argo API does not implement anti-automation measures such as rate limiting, account lockouts, or other anti-bruteforce measures. Attackers can submit an unlimited number of authentication attempts without consequence...
Authentication Bypass
Mattermost is vulnerable to Authentication Bypass. The vulnerability is due to insufficient enforcement of login failure limits due to the failure to lock out LDAP users after repeated unsuccessful login attempts, allowing attackers to trigger external LDAP account lockouts via brute-force attemp...