CVE-2026-22114
HTTP basic auth enforces no retry limit or backoff. Combined with the default service password, the keyspace is exhaustible.
CVSS
—
Sin CVSS
EPSS
—
KEV
—
Exploit Today
0
0-100
Publicado: 30 oct 2026 · Última mod.: 30 oct 2026 · CWE-307
Sin historial EPSS suficiente todavía.
HTTP basic auth enforces no retry limit or backoff. Combined with the default service password, the keyspace is exhaustible.
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-1115015.4 MED—
———Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Restriction of Excessive Authentication Attempts vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Launch of phishing attacks.6hCVE-2026-107256——
——0Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Shield allows Brute Force. This issue affects Shield versions: from 0.0.0 to 1.9.0.19hCVE-2026-155865.3 MED11.7%
——4Improper restriction of excessive authentication attempts vulnerability in İdvlabs Software and Consulting Services Inc. Ontime allows Brute Force.
This issue affects Ontime: through 2026-10-27.
NOTE: The vendor was contacted early about this disclosure but did not respond in any way.3dCVE-2026-107145—22.8%
——7The twofactor_gauthenticator plugin for Roundcube is vulnerable to brute-forcing of the second-factor code. Due to the lack of rate limiting, an attacker who obtains user's password can submit arbitrary 6-digit codes, resulting in second-factor bypass and unauthorized access to the system.
This issue was fixed in commit 4640889.3dCVE-2026-77057—20.1%
——6boneIO Black does not limit authentication attempts on its web interface (POST /api/login) or SSH service, and does not enforce password complexity. An unauthenticated remote attacker can make unlimited brute-force login attempts, potentially compromising user accounts and gaining unauthorized access to the device.
This issue was fixed in version 1.6.0: web login attempts are rate-limited per source address and per account, panel passwords must be at least 8 characters long, and SSH allows three authentication attempts per connection with a shortened login grace time.4dCVE-2026-1161233.7 BAJ43.5%
——13A weakness has been identified in NocoDB up to 2026.07.0. The affected element is the function validatePassword of the file /auth/user/signup. Executing a manipulation can lead to improper restriction of excessive authentication attempts. It is possible to launch the attack remotely. This attack is characterized by high complexity. The exploitability is described as difficult. The vendor documents this as intentional. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.4d