WidzialniCMS is vulnerable to Bruteforce Protection Bypass in the login functionality. The cookie-based lockout can be bypassed by omitting the login_count and login_timeout cookies, allowing an unauthenticated attacker to perform an unlimited number of login attempts.
This issue has been fixed in version 2.5.
CVE-2026-17280 is a vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows remote attackers to perform unauthenticated brute-force attacks due to improper restriction of excessive authentication attempts. This flaw could enable attackers to obtain valid credentials, potentially leading to full system compromise.
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, public dashboard passwords were stored in plaintext, accepted through a URL query parameter, and checked without effective attempt throttling. The vulnerable surface is public password-protected dashboard storage and validation routes. An unauthenticated attacker targets a public password-protected dashboard and repeatedly submits candidate passwords or obtains password-bearing server or proxy logs. Unlimited online guesses enable brute force, while cleartext storage and URL transport expose the secret in application storage and server or proxy access logs. The target must be a public dashboard with password protection enabled. Even failed attempts reveal chart count and configuration without the password; a recovered password grants access to the protected dashboard and its chart data. This vulnerability is fixed in 5.2.3.
CVE-2026-84473 is an authentication bypass vulnerability in Kiteworks ownCloud server versions 10.16.3 up to but not including 11.1.0. It allows unauthenticated remote attackers to perform unlimited online password guessing attacks against WebDAV accounts by repeatedly sending HTTP Basic Authentication requests to the WebDAV endpoint. This vulnerability is due to improper restriction of excessive authentication attempts, lacking brute-force protection.
FreeScout versions prior to 1.8.225 have an improper authentication vulnerability in the administrative tools.php maintenance endpoint. This endpoint is accessible without proper authentication or access control, allowing attackers to probe for arbitrary directories and files on the server. Additionally, the endpoint permits unrestricted guessing of application keys and database passwords without rate limiting or CAPTCHA protections. This vulnerability is fixed in version 1.8.225.
HCL AION contains a vulnerability in its account lockout mechanism that insufficiently restricts repeated failed login attempts. This flaw allows attackers to perform a large number of password guesses against user accounts, increasing the risk of brute-force attacks. The vulnerability may lead to unintended behavior or security impact under certain conditions. The CVSS score is 5.3, indicating a medium severity level. No affected versions or patches are specified in the available data.
INFINITT ULite versions up to 5.0.2.1_BN48_20260528 contain a vulnerability where image-share links are protected by low-entropy passwords without restrictions on repeated authentication attempts. This allows unauthenticated remote attackers to brute-force passwords within the link's validity period and gain unauthorized access to shared medical images. The issue is fixed in version 5.0.2.1_BN50.
CVE-2026-118505 is a vulnerability in team-alembic's ash_authentication component affecting versions from 5.0.0-rc.4 up to but not including 5.0.0-rc.16. It involves improper restriction of excessive authentication attempts, allowing unauthenticated attackers to perform unlimited password and one-time password guessing attempts. The issue arises because the brute force protection strategy is not consistently applied to all authentication actions, particularly OTP sign-in when registration is enabled. This flaw was fixed starting in version 5.0.0-rc.16.
CVE-2026-116238 is a vulnerability in pgAdmin 4 server mode before version 9.19 that allows bypassing the limit on failed login attempts for internal accounts. This flaw enables unauthenticated attackers to perform unlimited password guesses against internal accounts, including administrators, due to improper handling of authentication attempts and password resets. The issue arises from Flask-Security views bypassing pgAdmin's login attempt counting and lock mechanisms, case-insensitive username matching inconsistencies, and mismanagement of authentication sources. The vulnerability does not affect desktop mode and has been fixed in version 9.19.
Dell OpenManage Enterprise versions prior to 4.8.0 contain a vulnerability due to improper restriction of excessive authentication attempts. This flaw allows an unauthenticated attacker with adjacent network access to potentially exploit the system. The vulnerability has a medium severity with a CVSS score of 5.4. A fix is available in version 4.8.0 and later.
CVE-2026-22114 is a medium-severity vulnerability in Delta Electronics Delta UFC500 devices prior to version 4.4.2. The issue arises because HTTP basic authentication does not enforce any retry limits or backoff mechanisms. This lack of restriction, combined with the use of a default service password, allows an attacker to exhaust the authentication keyspace through repeated attempts.
CVE-2026-107256 is a vulnerability in the Drupal Shield module that allows excessive authentication attempts without proper restriction, enabling brute force attacks. This affects Shield versions from 0.0.0 up to but not including 1.9.0. The vulnerability has a medium severity with a CVSS score of 5.3. A fix is available in version 1.9.0.
Improper restriction of excessive authentication attempts vulnerability in İdvlabs Software and Consulting Services Inc. Ontime allows Brute Force.
This issue affects Ontime: through 2026-10-27.
NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
The twofactor_gauthenticator plugin for Roundcube contains a vulnerability that allows brute-force attacks on the second-factor authentication code due to lack of rate limiting. An attacker who has obtained a user's password can repeatedly submit arbitrary 6-digit codes to bypass the second-factor authentication and gain unauthorized access. This issue has been fixed in a specific commit.
boneIO Black does not limit authentication attempts on its web interface (POST /api/login) or SSH service, and does not enforce password complexity. An unauthenticated remote attacker can make unlimited brute-force login attempts, potentially compromising user accounts and gaining unauthorized access to the device.
This issue was fixed in version 1.6.0: web login attempts are rate-limited per source address and per account, panel passwords must be at least 8 characters long, and SSH allows three authentication attempts per connection with a shortened login grace time.
OpenReception appointment booking software versions 2.1.0 and earlier have an authentication vulnerability allowing brute-force attacks on a six-digit booking PIN. Successful brute-force yields the client's booking access token, enabling unauthorized access to their encrypted appointment data and the ability to modify appointments. The vulnerability involves a cross-tenant bypass where one tenant's state removes authentication protections of another tenant, expanding the attack scope. No patches are publicly available at the time of disclosure.
ApostropheCMS versions prior to 4.33.0 have a vulnerability in the self-service password-change endpoint where repeated guesses of the current password are not throttled or locked out. This allows an authenticated attacker to attempt multiple password guesses without restriction. The issue is fixed in version 4.33.0.
CVE-2024-2323 is a vulnerability in WSO2 Enterprise Integrator where the RemoteUserStoreManagerService does not properly restrict excessive password change attempts when password history validation is enabled. This flaw allows attackers to perform repeated password guesses without adequate limitation, potentially enabling brute force discovery of user passwords and account impersonation. The risk is higher for accounts with simpler passwords.
CVE-2026-111056 is an information exposure vulnerability in FOSSBilling versions from 0.1.0 up to but not including 0.8.7. The unauthenticated POST /api/guest/client/create endpoint reveals whether a submitted email address belongs to an existing registered client by returning a distinct unredacted error message. This allows an attacker to enumerate registered client emails. The issue is fixed in version 0.8.7.
Lychee versions prior to 7.6.1 have a vulnerability in the album unlock API that allows unlimited password guessing attempts without throttling or lockout. This flaw enables remote unauthenticated attackers to perform brute-force attacks on password-protected albums, potentially gaining unauthorized access to private photo collections. The vulnerability is fixed in version 7.6.1.