CVE-2026-62862 TypeBot: Account takeover via brute-forceable 6-digit magic-link code

Typebot is an open-source chatbot builder. In self-hosted versions up to and including 3.17.1, the default passwordless email magic-link authentication is vulnerable to login-code brute forcing that leads to account takeover. The email provider overrides NextAuth's default cryptographically secur...

CVE-2026-79661

Ech0 through 4.5.6 registers the PUT /api/echo/like/:id endpoint on the public router group without authentication or rate limiting. Unauthenticated attackers can increment the favcount counter of any echo including private echoes by supplying its UUID, which can be harvested from the public GET...

EUVD-2026-65453

Ech0 through 4.5.6 registers the PUT /api/echo/like/:id endpoint on the public router group without authentication or rate limiting. Unauthenticated attackers can increment the favcount counter of any echo including private echoes by supplying its UUID, which can be harvested from the public GET...

CVE-2026-79661

Ech0 (through 4.5.6) exposes the PUT /api/echo/like/:id endpoint on its public router group with no authentication and no rate limiting . An unauthenticated attacker can increment the fav_count counter of any echo—including private ones—by supplying its UUID, which is harvestable from the public ...

CVE-2026-79661 Ech0 before 4.7.3 Unauthenticated fav_count Modification

Ech0 through 4.5.6 registers the PUT /api/echo/like/:id endpoint on the public router group without authentication or rate limiting. Unauthenticated attackers can increment the favcount counter of any echo including private echoes by supplying its UUID, which can be harvested from the public GET...

CVE-2019-19633

CVE-2019-19633 lib/G/functions.php no Chevereto 1.0.0 até 1.1.4 Free, e até 3.13.5 Core, permite que um atacante realize ataques de força bruta sem acionar o mecanismo de proteção implementado, manipulando o cabeçalho X-Forwarded-For na requisição. O IP no cabeçalho deve ser alterado a cada 25ª...

CVE-2026-44596

CVE-2026-44596 — YAMCS Assenza di limitazione della frequenza sull'endpoint di autenticazione Riepilogo L'endpoint di autenticazione POST /auth/token in yamcs-core è privo di qualsiasi forma di limitazione della frequenza, blocco dell'account o limitazione dei tentativi falliti. Un attaccante...

CVE-2026-71205-PoC

CVE-2026-71205 — changedetection.io: Ausência de Rate Limiting em /login Permite Força Bruta Ilimitada de Senhas Produto: dgtlmoon/changedetection.io — v0.55.7 Arquivo: changedetectionio/flaskapp.py CWE: CWE-307 — Improper Restriction of Excessive Authentication Attempts CVSS 3.1:...

CVE-2026-72699

The Grav Login plugin getgrav/grav-plugin-login before 3.9.1 is vulnerable to email address enumeration. The register method in classes/Login.php throws a distinct exception EMAILNOTAVAILABLE when a submitted email address already belongs to an existing account, while allowing registration to...

CVE-2026-72700

The getgrav/grav-plugin-login Composer plugin before 3.9.1 used by Grav compares password reset and account activation tokens using a non-constant-time === string comparison instead of hashequals in classes/Controller.php taskReset and login.php activation handler. Because the token-submission...

EUVD-2026-65218

Rocket.Chat exposes the sendForgotPasswordEmail Meteor method without a DDP rate limit, so an unauthenticated caller may invoke it as often as it likes. The method is reachable over DDP and over the HTTP route POST /api/v1/method.callAnon/sendForgotPasswordEmail, and it triggers a password reset...

EUVD-2026-65214

The getgrav/grav-plugin-login Composer plugin before 3.9.1 used by Grav compares password reset and account activation tokens using a non-constant-time === string comparison instead of hashequals in classes/Controller.php taskReset and login.php activation handler. Because the token-submission...

CVE-2026-72699

The Grav Login plugin (getgrav/grav-plugin-login) before 3.9.1 is vulnerable to email address enumeration . The register() method in classes/Login.php throws a distinct exception (EMAIL_NOT_AVAILABLE) when a submitted email already belongs to an existing account, while allowing registration to pr...

EUVD-2026-65213

The Grav Login plugin getgrav/grav-plugin-login before 3.9.1 is vulnerable to email address enumeration. The register method in classes/Login.php throws a distinct exception EMAILNOTAVAILABLE when a submitted email address already belongs to an existing account, while allowing registration to...

CVE-2026-72699 Grav Login Plugin before 3.9.1 Email Enumeration via Registration

The Grav Login plugin getgrav/grav-plugin-login before 3.9.1 is vulnerable to email address enumeration. The register method in classes/Login.php throws a distinct exception EMAILNOTAVAILABLE when a submitted email address already belongs to an existing account, while allowing registration to...

CVE-2026-78551 RansomLook Login Endpoint Allows Timing-Based Username Enumeration and Unthrottled Authentication Attempts

RansomLook contains multiple weaknesses in its authentication endpoint that allow an unauthenticated remote attacker to enumerate valid usernames, perform unrestricted password-guessing attacks, and potentially exhaust application worker resources. For local authentication, the login implementati...

CVE-2026-78551

RansomLook 's /login endpoint contained two distinct authentication weaknesses exploitable by an unauthenticated remote attacker. First, a timing-based username enumeration was possible because the password hash verification function was only invoked for existing accounts, producing measurably di...

certdepot

Certificate Depot Uno strumento online gratuito per generare certificati SSL/TLS autofirmati in pochi secondi. Nessuna registrazione richiesta. Sito web: cert-depot.com Caratteristiche Genera certificati autofirmati con chiavi RSA 2048/4096 o ECDSA P-256/P-384 Scarica come ZIP chiave PEM +...

EUVD-2026-64756

The HTTP media server on DJI drones does not enforce sufficient limits on incoming connections or request rates. An attacker with access to the drone's internal network can exhaust the server's connection pool by repeatedly requesting a stored media file, preventing the server from handling...

lua-resty-limit-traffic

Nome lua-resty-limit-traffic - Libreria Lua per limitare e controllare il traffico in OpenResty/ngxlua Indice Nome Stato Sinossi Descrizione Installazione Comunità Mailing list in inglese Mailing list in cinese Bug e patch Autore Copyright e licenza Vedi anche Stato Questa libreria è già...