Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing...
CVE-2026-102334
Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers t
#cwe-307
共收录 183 条相关情报。
← 返回所有主题Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses against any account. At...
CVE-2026-102334
Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers t
stoatchat before 0.15.5 fails to enforce account-level attempt limits on MFA login challenges, allowing attackers who know a password to guess TOTP codes with only IP-based rate...
CVE-2026-100678
stoatchat before 0.15.5 fails to enforce account-level attempt limits on MFA login challenges, allowing attackers who kn
stoatchat before 0.15.5 MFA Brute Force via Insufficient Rate Limiting
CVE-2026-100678
stoatchat before 0.15.5 fails to enforce account-level attempt limits on MFA login challenges, allowing attackers who kn
lightrag-hku: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks
CVE-2026-85734
### Summary The POST /login endpoint has no rate limiting, account lockout, or delay on failed attempts. An attacker can
Tinyauth: Unauthenticated login attempts can trigger global login lockdown denial of service
CVE-2026-77561
### Summary Tinyauth's login rate-limit bookkeeping can enter a global lockdown mode when its in-memory login-attempt m
Improper Restriction of Excessive Authentication Attempts in the administration login of pH7Software pH7Builder (pH7 Social Dating CMS) through 19.2.0. The CAPTCHA escalation fl...
CVE-2026-37603
Improper Restriction of Excessive Authentication Attempts in the administration login of pH7Software pH7Builder (pH7 Soc
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the POST /login endpoint in lightrag/api/lightrag_server.py does not impose a rate limit, accou...
CVE-2026-85734
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the POST /login endpoint in lightrag/a
9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without the sanitizing custom-server.js wrapper use the client-su...
CVE-2026-56682
9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without
LightRAG: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks
CVE-2026-85734
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the POST /login endpoint in lightrag/a
9Router: Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header
CVE-2026-56682
9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without
A vulnerability was determined in Saleor up to 3.20.118/3.21.54/3.22.47/3.23.14. This...
CVE-2026-93650
A vulnerability was determined in Saleor up to 3.20.118/3.21.54/3.22.47/3.23.14. This vulnerability affects the function
A vulnerability was determined in Saleor up to 3.20.118/3.21.54/3.22.47/3.23.14. This vulnerability affects the function get_client_ip of the file saleor/account/throttling.py. ...
CVE-2026-93650
A vulnerability was determined in Saleor up to 3.20.118/3.21.54/3.22.47/3.23.14. This vulnerability affects the function
Saleor throttling.py get_client_ip excessive authentication
CVE-2026-93650
A vulnerability was determined in Saleor up to 3.20.118/3.21.54/3.22.47/3.23.14. This vulnerability affects the function
HCL BigFix Service Management is affected by an Improper Authentication validation vulnerability related to inadequate account lockouts, which could allow an unauthenticated att...
CVE-2026-56592
HCL BigFix Service Management is affected by an Improper Authentication validation vulnerability related to inadequate a
An improper restriction of excessive authentication attempts vulnerability in Auto block in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-860...
CVE-2026-40538
An improper restriction of excessive authentication attempts vulnerability in Auto block in Synology DiskStation Manager
AVideo through 29.0 contains a race condition in the enforceRateLimit() function that fails to...
CVE-2026-92583
AVideo through 29.0 contains a race condition in the enforceRateLimit() function that fails to atomically increment rate
AVideo through 29.0 contains a race condition in the enforceRateLimit() function that fails to atomically increment rate limit counters, allowing attackers to bypass all rate li...
CVE-2026-92583
AVideo through 29.0 contains a race condition in the enforceRateLimit() function that fails to atomically increment rate
Vikunja before 2.6.0 contains an authentication bypass vulnerability in CalDAV BasicAuth endpoints that lack rate limiting protection. Remote unauthenticated attackers can issue...
CVE-2026-91973
Vikunja before 2.6.0 contains an authentication bypass vulnerability in CalDAV BasicAuth endpoints that lack rate limiti
Vikunja versions before 2.6.0 fail to apply rate limiting to /api/v2 public authentication endpoints including login, register, password-reset, and OAuth token routes. Remote un...
CVE-2026-91972
Vikunja versions before 2.6.0 fail to apply rate limiting to /api/v2 public authentication endpoints including login, re