The WebSocket Application Programming Interface lacks restrictions on the number of...
CVE-2026-50176
The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absenc
#cwe-307
共收录 183 条相关情报。
← 返回所有主题The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denia...
CVE-2026-50176
The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absenc
NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, sign-in response timing differed between known and unknown email addresses because the unknown-use...
CVE-2026-47380
NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, sign-in response timing differed between
AIL did not restrict repeated failed attempts to verify a two-factor authentication (OTP) code. An attacker who had reached the 2FA verification step, such as after successfully...
CVE-2026-56450
AIL did not restrict repeated failed attempts to verify a two-factor authentication (OTP) code. An attacker who had reac
Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-on (SSO) for applications via a web portal. In versions 4....
CVE-2026-47203
Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-o
Craft Commerce: Coupon Code Brute-Force via Rate Limit Bypass
CVE-2026-55795
### Summary The CartController defines a RateLimiter behavior that is only activated when the 'number' POST/GET paramet
Improper restriction of excessive authentication attempts vulnerability in Başbelen Group Food Cafe Businesses Industry and Trade Ltd. Co. Pause+ Mobile App allows Authenticatio...
CVE-2026-6853
Improper restriction of excessive authentication attempts vulnerability in Başbelen Group Food Cafe Businesses Industry
A remote unauthenticated attacker may be able to conduct credential-guessing attacks against user...
CVE-2026-3329
A remote unauthenticated attacker may be able to conduct credential-guessing attacks against user accounts in Sonatype N
A remote unauthenticated attacker may be able to conduct credential-guessing attacks against user accounts in Sonatype Nexus Repository via authentication endpoints.
CVE-2026-3329
A remote unauthenticated attacker may be able to conduct credential-guessing attacks against user accounts in Sonatype N
Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft MyRezzta...
CVE-2025-1740
Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft MyRezzta allows Authentication Bypas
Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft QR Menu...
CVE-2025-2412
Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft QR Menu allows Authentication Bypass
Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft OctoCloud...
CVE-2025-2414
Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft OctoCloud allows Authentication Bypa
Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft MyRezzta...
CVE-2025-2415
Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft MyRezzta allows Authentication Bypas
Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 allows unauthenticated brute...
CVE-2026-36607
Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 allows unauthenticated brute-force attacks via the TDDP
Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 allows unauthenticated brute-force attacks via the TDDP password change endpoint (code=10), which lacks the rate ...
CVE-2026-36607
Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 allows unauthenticated brute-force attacks via the TDDP
A vulnerability was detected in unitedbyai droidclaw up to 0.5.3. The affected element is an unknown function of the file server/src/routes/pairing.ts of the component claim End...
CVE-2026-10216
A vulnerability was detected in unitedbyai droidclaw up to 0.5.3. The affected element is an unknown function of the fil
Authelia Missing Username Canonicalization in Basic Auth (LDAP)
CVE-2026-47203
### Impact **CVSSv4 Baseline Score:** Moderate 6.3 **CVSSv4 Weighted Score:** Low 2.9 The full CVSSv4 Vector for this
Uncontrolled resource consumption in the Wireless Control Module (WCM) of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an adjacent-network attacker with writ...
CVE-2026-49324
Uncontrolled resource consumption in the Wireless Control Module (WCM) of the Indian Motorcycle Scout Bobber + Tech 2025
The Login with OTP plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.6. This is due to an incomplete fix for CVE-2024-11178: th...
CVE-2026-8760
The Login with OTP plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.6
Yamcs has No Rate Limiting on Authentication Endpoint
CVE-2026-44596
### Summary The authentication endpoint `POST /auth/token` in `yamcs-core` lacks any form of rate limiting, account loc