Monthly
Unrestricted authentication attempts in Ebyte NE2-D11 firmware expose password-protected deployments to automated brute-force credential attacks. The device, classified as an industrial OT product and covered by ICS-CERT advisory ICSA-26-237-06, lacks both rate limiting and account lockout controls - two standard defenses against credential guessing. A remote unauthenticated attacker who successfully brute-forces the login interface gains high-confidence read access to device configuration and data, reflected in the CVSS 4.0 VC:H rating. No public exploit code or CISA KEV listing has been identified at time of analysis.
Account takeover in self-hosted Typebot up to and including 3.17.1 lets an anonymous attacker who knows a victim's email hijack their session via brute force of the passwordless email magic-link login code. The email provider replaces NextAuth's secure token with a 6-digit Math.random() code (900,000-value keyspace, 10-minute validity) that is placed raw in the link, while the verification callback enforces no attempt cap, lockout, or CSRF protection and does not invalidate the real code on wrong guesses. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the flaw is fixed in 3.18.0.
TOTP second-factor brute-force protection in Punk::Plugin::TOTP before 0.05 for Perl is defeated by replaying a saved session cookie, allowing an attacker with valid first-factor credentials to reset the TOTP failure counter indefinitely. Because Punk::Session stores the entire session state - including the TOTP attempt counter - in a client-side signed cookie when no server-side store is configured, an attacker can save the cookie before failures accumulate and replay it to restore a fresh counter, cycling this indefinitely within the pending_ttl window. No public exploit has been identified at time of analysis, but the technique is trivially reproducible from the advisory description alone.
Rocket.Chat's unauthenticated DDP method sendForgotPasswordEmail lacks a rate-limiting rule, enabling any network caller to flood a target email address with password reset messages from the deployment's own mail sender and to enumerate account types at scale. The method is reachable both via the Meteor DDP protocol and the unauthenticated HTTP route POST /api/v1/method.callAnon/sendForgotPasswordEmail, requiring no credentials. A side-channel in the method's response - returning false only when the target belongs to an OAuth-authenticated account with Accounts_AllowPasswordChangeForOAuthUsers disabled - allows an attacker to distinguish account authentication types, confirming information disclosure beyond simple email abuse. No public exploit or KEV listing is identified at time of analysis.
Three compounding authentication weaknesses in RansomLook's /login endpoint allow an unauthenticated remote attacker to enumerate valid usernames via response-time differences, conduct unlimited brute-force or credential-stuffing attacks against discovered accounts, and exhaust the application's synchronous Gunicorn worker pool through a sustained login flood causing application-wide denial of service. All versions matching cpe:2.3:a:ransomlook:ransomlook:*:*:*:*:*:*:*:* are affected prior to the upstream fix commit. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 4.0 score of 8.8 is driven by the combination of confidentiality leakage (username enumeration) and high availability impact (worker exhaustion).
HCL Hive 1.0 exposes its authentication endpoint without rate limiting, enabling unauthenticated remote attackers to conduct brute-force or credential stuffing attacks that can lead to unauthorized account access, or to flood the endpoint causing a denial of service. Classified under CWE-307 (Improper Restriction of Excessive Authentication Attempts), the flaw requires no privileges or user interaction and is network-accessible against default deployments. No public exploit code or active exploitation has been identified at time of analysis, but the attack class is trivially automated with widely available tooling.
Two-factor authentication bypass in phpMyFAQ before 4.1.7 lets an attacker who already knows a valid password defeat the TOTP second factor through unbounded brute force. Because the five-attempt failure counter is stored per session and reset on every successful password re-authentication (CWE-307), an attacker can loop - grab a fresh session cookie, re-enter the known password, and get five more guesses - until the 6-digit TOTP is guessed, yielding full account takeover. Reported by VulnCheck with no public exploit identified at time of analysis and not listed in CISA KEV.
Missing rate limiting on the POST /v1/sessions login endpoint in Plainpad through 1.1.1 allows unauthenticated remote attackers to submit unlimited credential attempts with no lockout, enabling both credential stuffing and a CPU exhaustion denial-of-service via repeated bcrypt comparisons. The flaw originates from a Laravel framework version mismatch: the throttle middleware was defined in App\Http\Kernel.php, which is dead code never instantiated by the Laravel 11+ bootstrap model, leaving the API route group entirely unthrottled. No public exploit has been identified at time of analysis, though SSVC classifies this as automatable with partial technical impact.
Unlimited authentication attempts against the karakeep login endpoint (apps/web/server/auth.ts) in versions up to 0.32.0 enable remote credential brute-forcing due to a missing rate-limiting guard on the NextAuth authorize function (CWE-307). The CVSS 4.0 score of 2.9 with AC:H reflects that successful exploitation depends on the target account holding a guessable password - a condition outside the attacker's direct control. A proof-of-concept has been publicly disclosed via GitHub issue #2919, though no active exploitation is confirmed by CISA KEV.
Unthrottled brute-force against SiYuan's Publish Service Basic Auth allows remote unauthenticated attackers to enumerate passwords against named publish-viewer accounts and gain read access to published notes and notebooks. All SiYuan releases before 3.7.4 are affected wherever the Publish Service is enabled and network-accessible on its default TCP port 6808. No public exploit code has been identified at time of analysis, but the attack is trivially automatable using any standard HTTP client given the complete absence of rate limiting, per-account lockout, or exponential backoff in the vulnerable code path.
Unrestricted authentication attempts in Ebyte NE2-D11 firmware expose password-protected deployments to automated brute-force credential attacks. The device, classified as an industrial OT product and covered by ICS-CERT advisory ICSA-26-237-06, lacks both rate limiting and account lockout controls - two standard defenses against credential guessing. A remote unauthenticated attacker who successfully brute-forces the login interface gains high-confidence read access to device configuration and data, reflected in the CVSS 4.0 VC:H rating. No public exploit code or CISA KEV listing has been identified at time of analysis.
Account takeover in self-hosted Typebot up to and including 3.17.1 lets an anonymous attacker who knows a victim's email hijack their session via brute force of the passwordless email magic-link login code. The email provider replaces NextAuth's secure token with a 6-digit Math.random() code (900,000-value keyspace, 10-minute validity) that is placed raw in the link, while the verification callback enforces no attempt cap, lockout, or CSRF protection and does not invalidate the real code on wrong guesses. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the flaw is fixed in 3.18.0.
TOTP second-factor brute-force protection in Punk::Plugin::TOTP before 0.05 for Perl is defeated by replaying a saved session cookie, allowing an attacker with valid first-factor credentials to reset the TOTP failure counter indefinitely. Because Punk::Session stores the entire session state - including the TOTP attempt counter - in a client-side signed cookie when no server-side store is configured, an attacker can save the cookie before failures accumulate and replay it to restore a fresh counter, cycling this indefinitely within the pending_ttl window. No public exploit has been identified at time of analysis, but the technique is trivially reproducible from the advisory description alone.
Rocket.Chat's unauthenticated DDP method sendForgotPasswordEmail lacks a rate-limiting rule, enabling any network caller to flood a target email address with password reset messages from the deployment's own mail sender and to enumerate account types at scale. The method is reachable both via the Meteor DDP protocol and the unauthenticated HTTP route POST /api/v1/method.callAnon/sendForgotPasswordEmail, requiring no credentials. A side-channel in the method's response - returning false only when the target belongs to an OAuth-authenticated account with Accounts_AllowPasswordChangeForOAuthUsers disabled - allows an attacker to distinguish account authentication types, confirming information disclosure beyond simple email abuse. No public exploit or KEV listing is identified at time of analysis.
Three compounding authentication weaknesses in RansomLook's /login endpoint allow an unauthenticated remote attacker to enumerate valid usernames via response-time differences, conduct unlimited brute-force or credential-stuffing attacks against discovered accounts, and exhaust the application's synchronous Gunicorn worker pool through a sustained login flood causing application-wide denial of service. All versions matching cpe:2.3:a:ransomlook:ransomlook:*:*:*:*:*:*:*:* are affected prior to the upstream fix commit. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 4.0 score of 8.8 is driven by the combination of confidentiality leakage (username enumeration) and high availability impact (worker exhaustion).
HCL Hive 1.0 exposes its authentication endpoint without rate limiting, enabling unauthenticated remote attackers to conduct brute-force or credential stuffing attacks that can lead to unauthorized account access, or to flood the endpoint causing a denial of service. Classified under CWE-307 (Improper Restriction of Excessive Authentication Attempts), the flaw requires no privileges or user interaction and is network-accessible against default deployments. No public exploit code or active exploitation has been identified at time of analysis, but the attack class is trivially automated with widely available tooling.
Two-factor authentication bypass in phpMyFAQ before 4.1.7 lets an attacker who already knows a valid password defeat the TOTP second factor through unbounded brute force. Because the five-attempt failure counter is stored per session and reset on every successful password re-authentication (CWE-307), an attacker can loop - grab a fresh session cookie, re-enter the known password, and get five more guesses - until the 6-digit TOTP is guessed, yielding full account takeover. Reported by VulnCheck with no public exploit identified at time of analysis and not listed in CISA KEV.
Missing rate limiting on the POST /v1/sessions login endpoint in Plainpad through 1.1.1 allows unauthenticated remote attackers to submit unlimited credential attempts with no lockout, enabling both credential stuffing and a CPU exhaustion denial-of-service via repeated bcrypt comparisons. The flaw originates from a Laravel framework version mismatch: the throttle middleware was defined in App\Http\Kernel.php, which is dead code never instantiated by the Laravel 11+ bootstrap model, leaving the API route group entirely unthrottled. No public exploit has been identified at time of analysis, though SSVC classifies this as automatable with partial technical impact.
Unlimited authentication attempts against the karakeep login endpoint (apps/web/server/auth.ts) in versions up to 0.32.0 enable remote credential brute-forcing due to a missing rate-limiting guard on the NextAuth authorize function (CWE-307). The CVSS 4.0 score of 2.9 with AC:H reflects that successful exploitation depends on the target account holding a guessable password - a condition outside the attacker's direct control. A proof-of-concept has been publicly disclosed via GitHub issue #2919, though no active exploitation is confirmed by CISA KEV.
Unthrottled brute-force against SiYuan's Publish Service Basic Auth allows remote unauthenticated attackers to enumerate passwords against named publish-viewer accounts and gain read access to published notes and notebooks. All SiYuan releases before 3.7.4 are affected wherever the Publish Service is enabled and network-accessible on its default TCP port 6808. No public exploit code has been identified at time of analysis, but the attack is trivially automatable using any standard HTTP client given the complete absence of rate limiting, per-account lockout, or exponential backoff in the vulnerable code path.