CVE-2026-71205-PoC

CVE-2026-71205 — changedetection.io: No Rate Limiting on /login Enables Unlimited Password Brute-Force Product: dgtlmoon/changedetection.io — v0.55.7 File: changedetectionio/flaskapp.py CWE: CWE-307 — Improper Restriction of Excessive Authentication Attempts CVSS 3.1:...

OWASP-Subtractive-Hardening-Top-10

OWASP Subtractive Security Top 10 Project Overview The OWASP Subtractive Security Top 10 Project is an initiative to identify, document, and promote the highest-impact opportunities for reducing cyber risk through the elimination of attack paths. Unlike traditional security guidance that focuses...

CVE-2026-68138

CVE-2026-68138 — Linux kernel net/sched qdisc rate-table UAF tracking site Source for the CVE-2026-68138 patch-status tracker: a single-page site recording which distributions have shipped a fix for the net/sched qdisc rate-table use-after-free / double-free in the Linux kernel. Where the facts...

CVE-2026-8793

CVE-2026-8793 — Missing Brute-Force Protection on PaperCut NG Login Form Field| Details ---|--- CVE ID| CVE-2026-8793 Product| PaperCut NG Affected Version| 25.0.11 Build 75758 and earlier CWE| CWE-307 — Improper Restriction of Excessive Authentication Attempts CVSS Score| 5.3 Medium — standalone...

zappzarapp-php-security

⚡ zappzarapp/security Comprehensive PHP security library providing CSP, Security Headers, CSRF protection, Secure Cookies, Password Validation, Input Sanitization, Rate Limiting, SRI, Secrets Loading, Encryption, Session Security, TOTP two-factor authentication, Signed URLs, and Security Event...

T-Backdoor

Sample Codes for the paper: 'T-Backdoor: Exploiting Temporal Redundancy in Neuromorphic Data for Spike-preserving Backdoor Attacks on SNNs' Abstract Backdoor attacks are a serious security threat to deep neural networks DNNs and remain largely underexplored for spiking neural networks SNNs...

Astra

Astra REST API penetration testing is complex due to continuous changes in existing APIs and newly added APIs. Astra can be used by security engineers or developers as an integral part of their process, so they can detect and patch vulnerabilities early during development cycle. Astra can...

@better-auth/drizzle-adapter: Concurrent requests can exceed rate limits on PostgreSQL

Am I affected? You are affected if you use @better-auth/drizzle-adapter from 1.6.17 through versions before 1.7.7 including the 1.7.0 prereleases from beta.6 through rc.6 or @better-auth/kysely-adapter 1.6.17 through 1.6.31, and keep rate-limit records in a PostgreSQL database. All of these must ...

GHSA-44JH-23M7-HPCF @better-auth/drizzle-adapter: Concurrent requests can exceed rate limits on PostgreSQL

Am I affected? You are affected if you use @better-auth/drizzle-adapter from 1.6.17 through versions before 1.7.7 including the 1.7.0 prereleases from beta.6 through rc.6 or @better-auth/kysely-adapter 1.6.17 through 1.6.31, and keep rate-limit records in a PostgreSQL database. All of these must ...

npm: @better-auth/drizzle-adapter: Concurrent requests can exceed rate limits on PostgreSQL

npm: @better-auth/drizzle-adapter: Concurrent requests can exceed rate limits on PostgreSQL vulnerability discovered by ? in WordPress npm better-auth versions = 1.6.17, 1.7.7...

net-Shield

net-Shield An Easy and Simple Anti-DDoS solution for VPS,Dedicated Servers and IoT devices based on iptables/ipsets Requirements Linux System with golang, iptables/ipsets Nginx Quickstart Run the bash script install.sh to install all the required dependencies. bash install.sh You will be prompted...

lua-resty-limit-traffic

Name lua-resty-limit-traffic - Lua library for limiting and controlling traffic in OpenResty/ngxlua Table of Contents Name Status Synopsis Description Installation Community English Mailing List Chinese Mailing List Bugs and Patches Author Copyright and License See Also Status This library is...

CVE-2026-23005-Matter-Commissioning-Code-Brute-Force-Without-Rate-Limit

CVE-2026-23005 – Matter Commissioning Code Brute‑Force Without Rate Limit Program Code Python Matter simulation mattercommissioningsim.py import random realcode = random.randint10000000, 99999999 def attemptjoincodeattempt: Simulate joining: no delay, no lockout if codeattempt == realcode:...

cve-2019-17240

Bludit = 3.9.22 - Bruteforce Mitigation Bypass This is small project where I rewrite this python script into golang. Purpose of this project was to learn Golang and understand how this exploit work. Usage $ ./brutepass -sdasds flag provided but not defined: -sdasds Usage of ./brutepass: -c int...

github-dorks

Github Dorks Github Search is a quite powerful and useful feature that can be used to search for sensitive data on repositories. Collection of Github dorks can reveal sensitive personal and/or organizational information such as private keys, credentials, authentication tokens, etc. This list is...

limitrr-php

Light rate limting within PHP using Redis. Limitrr PHP is very heavily inspired by my other library, Limitrr which was created for NodeJS. Check it out here Limitrr PHP allows users to easily integrate rate limiting within their application. Unlike other similar packages, this utility allows the...

CVE-2026-11103-GraphQL-Batching-Alias-Rate-Limit-Bypass

3. CVE-2026-11103 – GraphQL Batching Alias Rate Limit Bypass Program Code Node.js + Python Exploit // graphqlratelimitserver.js - GraphQL with naive rate limiter const express = require'express'; const graphqlHTTP = require'express-graphql'; const buildSchema = require'graphql'; const schema =...

CVE-2024-57610

Lack of Rate Limiting in Sylius v2.0.2 Vendor Homepage: https://sylius.com/ Steps to Reproduce 1.Navigate to https://store.sylius.com/login 2.Attempt multiple login requests using automated tools or scripts e.g., Burp Suite, cURL. 3.Observe that no rate limiting is applied, and requests are...

2FA-Bypass-using-a-Brute-Force-Attack-CVE-2025-60424

2FA Bypass Using a Brute Force Attack Overview The Nagios Fusion application version 2024R1.2 and 2024R2 is vulnerable to a Brute-Force attack on its Two-Factor Authentication 2FA mechanism. Specifically, the 2FA implementation does not adequately enforce rate-limiting or account lockout...

EUVD-2026-110753

@fastify/express is a Fastify plugin that runs Express middleware inside Fastify. In versions 4.0.5 through 4.0.8, when Fastify runs with the non-default ignoreDuplicateSlashes option enabled, the plugin matches path-scoped Express middleware against a URL whose duplicate-slash normalization has...