PassGAN

PassGAN This repository contains code for the PassGAN: A Deep Learning Approach for Password Guessing paper. The model from PassGAN is taken from Improved Training of Wasserstein GANs and it is assumed that the authors of PassGAN used the improvedwgantraining tensorflow implementation in their...

CVE-2026-44596

CVE-2026-44596 — YAMCS No Rate Limiting on Authentication Endpoint Summary The authentication endpoint POST /auth/token in yamcs-core lacks any form of rate limiting, account lockout, or failed attempt throttling. An unauthenticated remote attacker can perform unlimited password guessing attempts...

win-brute-logon

Notice 1: We are excited to announce that our current tool has been ported to a PowerShell version. This means that users can now access and use the tool directly from the PowerShell command line, making it even more convenient and efficient to use. We believe that this new version will greatly...

Go365

Go365 v2.0 Fixed AWS gateway issues thanks h0useh3ad! No longer dies when proxy server connections fail Added the graph endpoint Please read all of this README before using Go365! Go365 is a tool designed to perform user enumeration and password guessing attacks on organizations that use Office36...

Shreder

Shreder Shreder is a powerful multi-threaded SSH protocol password brute-force tool. Features Very fast password guessing, just one password in 0.1 second. Optimized for big password lists, Shreder tries 1000 passwords in 1 minute and 40 seconds. Simple CLI and API usage. Installation pip3 instal...

brutto

brutto Fuerza bruta fácil para lo que quieras, Su magia: valores crecientes y directos. Implementación Clona git clone https://github.com/jofpin/brutto.git Descarga la última versión Instala con Python: python setup.py install So you import the library from bruttoeasy import Brutto Cómo usar...

CVE-2026-71205-PoC

CVE-2026-71205 — changedetection.io: No Rate Limiting on /login Enables Unlimited Password Brute-Force Product: dgtlmoon/changedetection.io — v0.55.7 File: changedetectionio/flaskapp.py CWE: CWE-307 — Improper Restriction of Excessive Authentication Attempts CVSS 3.1:...

Talon

THIS REPOSITORY HAS BEEN ARCHIVED To view the latest version of Talon or to submit an issue, reference https://github.com/Tylous/Talon. Talon Talon is a tool designed to perform automated password guessing attacks while remaining undetected. Talon can enumerate a list of users to identify which...

CVE-2026-56682

9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without the sanitizing custom-server.js wrapper use the client-supplied X-9r-Real-Ip value as the bucket key in getClientIp, checkLock, and recordFail in src/lib/auth/loginLimiter.js fo...

CVE-2026-56682

9Router versions prior to 0.5.6 are vulnerable to a login brute-force lockout bypass. The application's rate-limiting mechanism, specifically in src/lib/auth/loginLimiter.js, uses the client-supplied X-9r-Real-Ip header as the bucket key for tracking failed login attempts. When deployed without t...

CVE-2026-56682: Improper Restriction of Excessive Authentication Attempts

9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without the sanitizing custom-server.js wrapper use the client-supplied X-9r-Real-Ip value as the bucket key in getClientIp, checkLock, and recordFail in src/lib/auth/loginLimiter.js fo...

EUVD-2026-72007

AVideo API fails to enforce rate limits when clients send a bot User-Agent header, allowing attackers to bypass all eight protected operations including login brute-force protection. Attackers can send requests with a bot User-Agent to disable rate limiting and perform unlimited password guessing...

CVE-2026-86186: Improper Restriction of Excessive Authentication Attempts

AVideo API fails to enforce rate limits when clients send a bot User-Agent header, allowing attackers to bypass all eight protected operations including login brute-force protection. Attackers can send requests with a bot User-Agent to disable rate limiting and perform unlimited password guessing...

CVE-2026-82643

WWBN AVideo contains an unauthenticated credential submission vulnerability in plugin/Live/api/preauthorize.json.php that accepts credentials over GET without rate limiting. Attackers can submit correct credentials repeatedly to trigger uncapped two-factor confirmation emails and perform sustaine...

EUVD-2026-68230

WWBN AVideo current e01e41ecc and earlier contains a brute-force rate limiting bypass in enforceRateLimit, which protects login.json.php and 13 other endpoints. The function stores its attempt counter via a cache layer ObjectYPT::setCacheGlobal that silently discards writes for any client...

EUVD-2026-68229

WWBN AVideo contains an unauthenticated credential submission vulnerability in plugin/Live/api/preauthorize.json.php that accepts credentials over GET without rate limiting. Attackers can submit correct credentials repeatedly to trigger uncapped two-factor confirmation emails and perform sustaine...

CVE-2026-82643

WWBN AVideo contains an unauthenticated credential submission vulnerability in plugin/Live/api/preauthorize.json.php , which accepts credentials via HTTP GET without rate limiting . An unauthenticated attacker can repeatedly submit correct credentials to trigger uncapped two-factor confirmation e...

CVE-2026-82643 WWBN AVideo Unauthenticated Rate Limit Bypass via preauthorize.json.php

WWBN AVideo contains an unauthenticated credential submission vulnerability in plugin/Live/api/preauthorize.json.php that accepts credentials over GET without rate limiting. Attackers can submit correct credentials repeatedly to trigger uncapped two-factor confirmation emails and perform sustaine...

CVE-2026-82643 WWBN AVideo Unauthenticated Rate Limit Bypass via preauthorize.json.php

WWBN AVideo contains an unauthenticated credential submission vulnerability in plugin/Live/api/preauthorize.json.php that accepts credentials over GET without rate limiting. Attackers can submit correct credentials repeatedly to trigger uncapped two-factor confirmation emails and perform sustaine...

CVE-2026-82644: Improper Restriction of Excessive Authentication Attempts

WWBN AVideo current e01e41ecc and earlier contains a brute-force rate limiting bypass in enforceRateLimit, which protects login.json.php and 13 other endpoints. The function stores its attempt counter via a cache layer ObjectYPT::setCacheGlobal that silently discards writes for any client...