CVE-2026-103977 FileRise: Session-scoped TOTP rate limiting permits repeated verification attempts

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise stores failed TOTP verification attempts in $SESSION. An attacker who already possesses a target account's valid primary credential can restart the login workflow in a...

CVE-2026-103977

Prior to version 3.23.0 , FileRise (a self-hosted web-based file manager) is vulnerable to CWE-307 and CWE-841 because TOTP verification failure counters were stored in the 👒_SESSION rather than being tied to a durable account-wide limit. An attacker with valid primary credentials could repeatedl...

CVE-2026-102825 Russh: Configured server auth-attempt cap is not enforced in the USERAUTH_REQUEST runtime path

Russh is a Rust SSH client and server library. Prior to 0.62.6, the USERAUTHREQUEST path reached from server::runstream in russh/src/server/encrypted.rs increments self.common.authattempts but never compares it with server::Config.maxauthattempts. An unauthenticated remote client can continue...

CVE-2026-102825 Russh: Configured server auth-attempt cap is not enforced in the USERAUTH_REQUEST runtime path

Russh is a Rust SSH client and server library. Prior to 0.62.6, the USERAUTHREQUEST path reached from server::runstream in russh/src/server/encrypted.rs increments self.common.authattempts but never compares it with server::Config.maxauthattempts. An unauthenticated remote client can continue...

PT-2026-102809

Name of the Vulnerable Software and Affected Versions Russh versions prior to 0.62.6 Description In the USERAUTH REQUEST path reached from the server::run stream function in russh/src/server/encrypted.rs, the system increments self.common.auth attempts but fails to compare it against...