Alertas de Seguridad de la Información

M Crítico vulnerabilidad

15/08/2026

[CVE-2026-73046] SiYuan before v3.7.4 improperly restricts excessive authentication attempts in the CheckAuth() middl…

SiYuan before v3.7.4 improperly restricts excessive authentication attempts in the CheckAuth() middleware. The HTTP Basic Authentication branch, which guards nearly the entire /api/* surface, accepts the workspace access code (Conf.AccessAuthCode) as the Basic Auth password but never consults the CAPTCHA/lockout gate or increments the failure counter used by the cookie/session login path. This all…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

13/08/2026

[CVE-2026-19297] IBM Langflow OSS 1.0.0 through 1.9.6 could allow a remote attacker to obtain unauthorized access to …

IBM Langflow OSS 1.0.0 through 1.9.6 could allow a remote attacker to obtain unauthorized access to user accounts due to improper restriction of excessive authentication attempts.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

10/08/2026

[CVE-2026-65948] UnixAuth lacks brute-force protection in Apache Ranger versions <= 2.8.0.  Note:  UnixAuth is NOT a …

UnixAuth lacks brute-force protection in Apache Ranger versions

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-48084] OpenReception's appointment booking software provides an end-to-end encrypted appointment booking pl…

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Versions prior to 1.0.2 don't throttle failed passphrase login attempts. An attacker can submit unlimited wrong passphrase guesses against any known email address, capped only by the Argon2 verification cost (about 100 milliseconds per attempt on the tested host, giving 10 attempts per secon…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Crítico vulnerabilidad

05/08/2026

[CVE-2026-71213] Typemill's login endpoint (POST /tm/login, ControllerWebAuth::login()) performs no rate-limiting, fa…

Typemill's login endpoint (POST /tm/login, ControllerWebAuth::login()) performs no rate-limiting, failed-attempt counting, or account lockout when captcha is disabled, which is the default configuration. An unauthenticated attacker can send unlimited password-guessing requests against any account, including administrators, with no throttling. The only attempt-counting/lockout logic present in the …

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-15144] @fastify/rate-limit before 11.2.0 keys rate-limit buckets by the verbatim client IP string returned …

@fastify/rate-limit before 11.2.0 keys rate-limit buckets by the verbatim client IP string returned from request.ip. Because a single IPv6 client can control a large address range (a /64 holds 2^64 distinct addresses) and the same address has multiple valid textual representations, an IPv6 capable client can defeat the rate-limit boundary by rotating addresses or by rewriting the same address in d…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-16347] MikroTik RouterOS contains a weakness in its API authentication handling that lacks effective safegu…

MikroTik RouterOS contains a weakness in its API authentication handling that lacks effective safeguards against excessive login attempts. The system does not enforce meaningful rate-limiting, account lockout, or source-based restrictions, allowing repeated authentication failures to proceed without defensive response. In some versions, a fixed per-connection delay is present, but it can be bypass…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2026-32825] dataCycle is a data management system for centrally storing, managing, searching, finding, and distr…

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the application accepts unlimited password guesses against both the browser login flow and the JSON login endpoint. The source code enables Devise's `:lockable` module on t…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-61458] PasswordPusher before 2.9.2 contains a brute-force vulnerability in the POST /p/:token/access endpoi…

PasswordPusher before 2.9.2 contains a brute-force vulnerability in the POST /p/:token/access endpoint that lacks route-specific rate limiting and per-push lockout mechanisms. Attackers who know a push token can systematically guess passphrases at 120 attempts per minute without triggering any push-level defense, making short or dictionary-derived passphrases practically recoverable within hours o…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-42952] Previously, there was no throttling on repeated authentication attempts to the charging station bac…

Previously, there was no throttling on repeated authentication attempts to the charging station backend, which could allow an attacker to execute a denial-of-service attack.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-55501] 9Router is an AI router & token saver. Prior to 0.4.80, the dashboard login rate limiter in src/lib/…

9Router is an AI router & token saver. Prior to 0.4.80, the dashboard login rate limiter in src/lib/auth/loginLimiter.js derives the client identity from the attacker-controlled X-Forwarded-For HTTP header, and src/app/api/auth/login/route.js uses that spoofable value for checkLock and recordFail. A remote attacker can rotate the X-Forwarded-For value on each login attempt to receive a fresh rate-…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

01/07/2026

[CVE-2026-53904] MCO is vulnerable to Account Denial of Service due to improper implementation of password reset func…

MCO is vulnerable to Account Denial of Service due to improper implementation of password reset functionality. Each password reset request invalidates previously set password as well as previously issued temporary passwords, furthermore, password resets are not limited in any way. An attacker who provides victim's email and answer to their security question, can successfully initiate the reset pro…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

25/06/2026

[CVE-2026-50176] The WebSocket Application Programming Interface lacks restrictions on the number of authentication r…

The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks or brute-force attacks to gain unauthorized access.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

12/06/2026

[CVE-2026-6853] Improper restriction of excessive authentication attempts vulnerability in Başbelen Group Food Cafe …

Improper restriction of excessive authentication attempts vulnerability in Başbelen Group Food Cafe Businesses Industry and Trade Ltd. Co. Pause+ Mobile App allows Authentication Bypass. This issue affects Pause+ Mobile App: from v1.0.6 before v1.5.

nvdcriticovulnerabilidad CVSS 9.8 NVD

S Alto vulnerabilidad

11/06/2026

[CVE-2026-3329] A remote unauthenticated attacker may be able to conduct credential-guessing attacks against user ac…

A remote unauthenticated attacker may be able to conduct credential-guessing attacks against user accounts in Sonatype Nexus Repository via authentication endpoints.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-36607] Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 allows unauthenticated brute-force a…

Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 allows unauthenticated brute-force attacks via the TDDP password change endpoint (code=10), which lacks the rate limiting applied to the login endpoint (code=7). An attacker on the adjacent network can attempt unlimited passwords without triggering account lockout.

nvdaltovulnerabilidad CVSS 8.8 NVD