CVE-2026-44236

A flaw was found in rabbitmq-c. A malicious AMQP Advanced Message Queuing Protocol server or an on-path attacker can send an undersized frame size during the login handshake. This can lead to a heap buffer overflow, causing memory corruption and potentially a denial of service. Code execution is...

9Router has a Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header

Summary 9router enforces a progressive login lockout 5 failed attempts → temporary 30s+ lock keyed on the client IP. The client IP used for this limiter is taken from the X-9r-Real-Ip request header, which is intended to be set only by the bundled custom-server.js layer from the unspoofable TCP...

GHSA-32GC-64M7-HJ7V 9Router has a Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header

Summary 9router enforces a progressive login lockout 5 failed attempts → temporary 30s+ lock keyed on the client IP. The client IP used for this limiter is taken from the X-9r-Real-Ip request header, which is intended to be set only by the bundled custom-server.js layer from the unspoofable TCP...

NPM: 9Router has a Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header

NPM: 9Router has a Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header vulnerability discovered by ? in WordPress Npm 9router versions = 0.5.4...

CVE-2026-85734 LightRAG: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the POST /login endpoint in lightrag/api/lightragserver.py does not impose a rate limit, account lockout, delay, or counter for failed authentication attempts. A network attacker can submit password guesses at full...

CVE-2026-85734 LightRAG: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the POST /login endpoint in lightrag/api/lightragserver.py does not impose a rate limit, account lockout, delay, or counter for failed authentication attempts. A network attacker can submit password guesses at full...

EUVD-2026-84548

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the POST /login endpoint in lightrag/api/lightragserver.py does not impose a rate limit, account lockout, delay, or counter for failed authentication attempts. A network attacker can submit password guesses at full...

CVE-2026-85734

The LightRAG retrieval-augmented generation tool is vulnerable to brute-force attacks due to a lack of rate limiting on the POST /login endpoint in lightrag/api/lightrag_server.py. Specifically, the application does not implement account lockouts, delays, or attempt counters for failed authentica...

CVE-2026-85725 LightRAG: Plaintext Passwords Compared Without Constant-Time Function

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, verifypassword in lightrag/api/passwords.py compares plaintext AUTHACCOUNTS password values with Python's == operator. The comparison can return after the first mismatching byte, creating response-time differences...

CVE-2026-85725

Prior to version 1.5.5 , LightRAG is vulnerable to a timing attack in the verify_password function within lightrag/api/passwords.py. The application uses Python's == operator to compare plaintext password values in AUTH_ACCOUNTS, which short-circuits on the first mismatching byte. A network attac...

EUVD-2026-84542

9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without the sanitizing custom-server.js wrapper use the client-supplied X-9r-Real-Ip value as the bucket key in getClientIp, checkLock, and recordFail in src/lib/auth/loginLimiter.js fo...

CVE-2026-56682 9Router: Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header

9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without the sanitizing custom-server.js wrapper use the client-supplied X-9r-Real-Ip value as the bucket key in getClientIp, checkLock, and recordFail in src/lib/auth/loginLimiter.js fo...

CVE-2026-95754

In MISP's UsersController login method, the pre-authentication database query used for the TOTP two-factor authentication verification branch did not include the User.disabled column in its SELECT fields list. The query selected only User.password, User.totp, and User.hotpcounter. When the TOTP...

CVE-2026-95754 MISP: Disabled-user check ineffective in pre-authentication TOTP login branch

In MISP's UsersController login method, the pre-authentication database query used for the TOTP two-factor authentication verification branch did not include the User.disabled column in its SELECT fields list. The query selected only User.password, User.totp, and User.hotpcounter. When the TOTP...

EUVD-2026-84199

Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login incomplete fix of the prior timing-attack advisory...

Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack advisory)

Summary validateUser in backend/src/authentication/providers/mysql/auth-provider-mysql.service.ts returns immediately when the supplied login/email does not match any account, without ever calling comparePassword: async validateUserloginOrEmail: string, password: string, ip?: string, scope?:...

GHSA-29HQ-23M2-2J47 Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack advisory)

Summary validateUser in backend/src/authentication/providers/mysql/auth-provider-mysql.service.ts returns immediately when the supplied login/email does not match any account, without ever calling comparePassword: async validateUserloginOrEmail: string, password: string, ip?: string, scope?:...

Exploit for Argument Injection in Mikrotik Routeros

MikroTrick PoC — CVE-2026-86060 RouterOS unauthenticated full...

kernel: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf

A flaw was found in the Linux kernel's iSCSI Internet Small Computer System Interface target functionality. This vulnerability, a heap overrun, occurs because the iscsiencodetextoutput function does not properly check buffer capacity when processing login requests. A remote attacker could exploit...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: dovecot (UTSA-2026-090119)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090119 advisory. In Dovecot before 2.3.10.1, a crafted SMTP/LMTP message triggers an unauthenticated use-after-free bug in submission-login, submission, or lmtp, and can lead to a...