CVE-2026-48084

OpenReception’s OpenReception appointment-booking software (versions prior to 1.0.2) does not rate-limit failed passphrase login attempts in /api/auth/login, unlike the WebAuthn path which triggers a per-account 429 throttle after ~19 attempts. The absence of throttling on the passphrase branch a...

CVE-2023-39439

SAP Commerce Cloud may accept an empty passphrase for user ID and passphrase authentication, allowing users to log into the system without a passphrase...