Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 760

Export CSV
CVE-2026-103977

FileRise: Session-scoped TOTP rate limiting permits repeated verification attempts

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise stores failed TOTP verification attempts in $_SESSION. An attacker who already possesses a target account's valid primary credential can restart the login workflow in a new session and restore the second-factor attempt allowance, permitting continued online TOTP guessing beyond the intended five-attempt limit. The pending-login TOTP handlers did not share a durable account-wide limit. This issue is fixed in version 3.23.0.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Error311
Products
Filerise
CVE-2026-75773

karakeep-app karakeep Login Endpoint auth.ts authorize excessive authentication

A vulnerability was found in karakeep-app karakeep up to 0.32.0. The affected element is the function authorize of the file apps/web/server/auth.ts of the component Login Endpoint. The manipulation results in improper restriction of excessive authentication attempts. The attack may be performed from remote. This attack is characterized by high complexity. The exploitability is described as difficult. The exploit has been made public and could be used. Upgrading to version 0.33.0 is sufficient to fix this issue. The patch is identified as f7d042971d0d2bcc7119654830cf1eb93eabbf24. It is advisable to upgrade the affected component.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Karakeep-app
Products
Karakeep
CVE-2026-111056

FOSSBilling: Unauthenticated client account enumeration via guest signup endpoint

FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.7, the unauthenticated POST /api/guest/client/create endpoint reveals whether a submitted email belongs to a registered client because guest signup returns a distinct unredacted error when the submitted email already exists. The trigger is an unauthenticated request to POST /api/guest/client/create with a target email address. An attacker can compare the guest-signup response for a target email to determine whether the email belongs to an existing FOSSBilling client. Box\Mod\Client\Api\Guest::create returns the error after Client\Service::clientAlreadyExists finds a matching record, and the API response exposes that exception message without redaction. This issue is fixed in version 0.8.7.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Fossbilling
Products
Fossbilling
CVE-2026-113710

ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessing

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the self-service password-change endpoint verifies the current password but does not use the login module’s failed-attempt counter, throttle, delay, or lockout mechanism. An attacker with a valid authenticated session can submit repeated guesses for the current password without receiving a lockout or throttle response. This issue is fixed in version 4.33.0.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Apostrophecms
Products
Apostrophecms
CVE-2026-43847

Brute-Force Administrator Password Vulnerability in Advantech ADAM‑3600 Proprietary Protocol

A vulnerability in the proprietary protocol could allow an attacker to brute force the administrator password without restrictions, even when the SafeEnhancement feature is enabled.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Advantech
Products
Adam-3600
CVE-2025-61560

github.com/argoproj/argo-cd: argo-cd: Rate limit bypass via race condition in SessionManager

A race condition vulnerability in the SessionManager of CNCF: Cloud Native Computing Foundation Argo CD v3.0.6 allows attackers to bypass rate limiting and perform a brute force attack via repeated crafted requests.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Argoproj
Products
Argo-cd
CVE-2026-110861

Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit Bypass via Race Condition

Better Auth @better-auth/drizzle-adapter and better-auth from 1.6.17 before 1.7.7, and @better-auth/kysely-adapter from 1.6.17 before 1.7.0, contain a race condition in database-backed rate limiting on PostgreSQL where the limit check is not atomic with the counter update. Remote attackers can send bursts of concurrent requests that pass the check together, exceeding configured limits on password sign-in, two-factor verification, one-time code, password reset, and other rate-limited endpoints.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Better-auth
Products
Better Auth Drizzle-adapter Kysely-adapter
CVE-2026-111892

phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Rate Limiting on Password-Reset Endpoints

phpMyFAQ 4.2.0-alpha before 4.2.0-beta lacks effective rate limiting on the unauthenticated user/password/update and user/password/reset endpoints. Unauthenticated attackers can send unlimited reset requests to flood a registered user's inbox with reset emails, exhausting mailer and server resources.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Phpmyfaq Thorsten
Products
Phpmyfaq Phpmyfaq
CVE-2026-111874

OpenCATS Career Portal CareersUI.php processLogin excessive authentication

A flaw has been found in OpenCATS 0.10.0. Affected is the function processLogin of the file modules/careers/CareersUI.php of the component Career Portal. This manipulation of the argument applyToJobSubAction causes improper restriction of excessive authentication attempts. Remote exploitation of the attack is possible. A high degree of complexity is needed for the attack. The exploitability is told to be difficult. The exploit has been published and may be used. Patch name: 1cf4fa3ee9054314b023be79d404078645c22ade. It is suggested to install a patch to address this issue. The project maintainer explains: "Candidates will now need to authenticate each time they access the Career Portal and successfully complete the CAPTCHA as part of that authentication flow. The authenticated candidate identity is now maintained server-side rather than relying on the previous persistent client-side cats…cw cookie mechanism. Application-level rate limiting is deliberately not in scope for this change. In my view, request throttling and brute-force protection of that kind are better applied at the network, reverse-proxy or web-server layer, where they can be configured appropriately for each deployment without OpenCATS having to implement and maintain its own rate-limiting framework. I'll update the online documentation to that effect."

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Opencats
Products
Opencats
CVE-2026-111886

phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta 2FA Brute-Force via remove-twofactor Endpoint

phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta lacks brute-force lockout in the removeTwofactorConfig() 2FA removal endpoint, allowing authenticated attackers to guess TOTP codes without limit. Attackers holding a hijacked session and CSRF token can repeatedly POST guesses to /api/user/remove-twofactor to permanently disable the victim's 2FA.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Phpmyfaq Thorsten
Products
Phpmyfaq Phpmyfaq
CVE-2026-69183

Monkeytype: Rate-limit and anti-brute-force controls bypassable via spoofed HTTP headers (forgotPasswordEmail/verificationEmail mail bombing and badAuth bypass)

Monkeytype is a minimalistic and customizable typing test. In 26.26.0 and earlier, the backend rate-limit key generator in backend/src/middlewares/rate-limit.ts uses client-controlled cf-connecting-ip and x-forwarded-for headers before the trust-proxy-derived req.ip value. An unauthenticated attacker can rotate either header to create a new bucket for each request, bypassing rootRateLimiter, badAuthRateLimiter, getKey(), and the getKeyWithUid() fallback used by public endpoints. This permits repeated POST /users/forgotPasswordEmail and verificationEmail requests, mail bombing registered users, consuming Firebase or SMTP quota, evading brute-force protection, and enabling resource exhaustion. Exploitability of cf-connecting-ip depends on deployment topology, but x-forwarded-for and direct-to-origin paths remain affected when those values are not overwritten by a trusted proxy. No fixed version is available as of this review.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Monkeytype
Products
Monkeytype
CVE-2026-93637

Zimbra Collaboration Suite GraphQL Batched Authentication Bypasses Pre-Auth Rate Limiting

An authentication rate-limit bypass in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to make repeated password guesses through GraphQL without incrementing Zimbra’s source-IP failure counter. GraphQL aliases allow multiple authentication attempts in one HTTP request.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Zimbra
Products
Zimbra Collaboration Suite
CVE-2026-69193

FileRise: Rate Limiting Bypass via Username Rotation Enables Unlimited Password Spraying

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.21.0, FileRise tracks failed logins only by the combination of source IP address and username. A remote unauthenticated attacker can rotate usernames to obtain a fresh per-account attempt budget for each name, enabling password spraying from one source beyond the intended limit. Per-user limits still apply and can also produce distinguishable throttling behavior for targeted accounts. The affected surface is AuthModel::getFailedLoginKey(). This issue is fixed in version 3.21.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Error311
Products
Filerise
CVE-2026-93346

Wazuh 4.0.0 before 4.14.8 API Brute-Force Protection Bypass via Race Condition

Wazuh from 4.0.0 before 4.14.8 contains a race condition in API login throttling that allows unauthenticated attackers to bypass max_login_attempts by sending concurrent requests. Attackers can fire concurrent login bursts to the authenticate and run_as endpoints, each passing the block check before failures are counted, enabling unlimited password guessing.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Wazuh
Products
Wazuh Wazuh-manager
CVE-2026-53997

Netherman Portal del Hermano Account Takeover via Password Reset Oracle

Netherman Portal del Hermano (portaldelhermano.es) before 2026-10-06 contains a broken authentication vulnerability in its password-recovery flow at the POST /password/create-access and POST /password/email endpoints, allowing unauthenticated attackers to take over any member account across all tenants by exploiting the lack of rate limiting and distinct error messages that act as oracles for each of the four identity-verification factors (DNI, date of birth, phone number, last four IBAN digits). Attackers can confirm the DNI via the oracle, brute-force the date of birth and IBAN digits, obtain the phone number through open-source intelligence, then submit an attacker-controlled email field so the password reset link is delivered to them, enabling full account takeover including profile data, full IBAN, and fiscal documents.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Netherman
Products
Portal Del Hermano (portaldelhermano.es)
CVE-2026-105866

Payload: Unauthenticated account-lockout denial of service

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an unauthenticated attacker who knows an account email address or username can abuse the account lockout mechanism of a local-authentication collection to prevent that account from signing in. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Payloadcms
Products
Payload
CVE-2026-18318

IBM i Information Disclosure

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform brute-force attacks to obtain credentials due to improper authentication.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
I
CVE-2026-56592

HCL BigFix Service Management is affected by multiple security vulnerabilities.

HCL BigFix Service Management is affected by an Improper Authentication validation vulnerability related to inadequate account lockouts, which could allow an unauthenticated attacker to execute sustained brute-force attacks against the login interface, resulting in unauthorized system access.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Bigfix Service Management
CVE-2026-108163

Pingvin Share X before 1.22.0 Ineffective Authentication Rate Limiting via Throttler TTL

Pingvin Share X before 1.22.0 contains an ineffective rate limiting vulnerability because throttler TTL values specified in seconds are interpreted as milliseconds. Unauthenticated attackers can send effectively unthrottled requests to /api/auth/signIn, /api/auth/signIn/totp and /api/auth/resetPassword to brute-force passwords and TOTP codes.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Smp46
Products
Pingvin-share-x
CVE-2026-108580

AniWorld Downloader before 5.3.0 WebUI Login Brute Force via /login

AniWorld Downloader before 5.3.0 contains an improper restriction of authentication attempts vulnerability in the WebUI /login POST handler that allows unauthenticated attackers to guess passwords without throttling. Attackers can enumerate usernames through verify_user response timing and brute-force passwords on exposed WebUI instances to take over accounts.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Phoenixthrush
Products
Aniworld Downloader