CWE-307: Excessive authentication attempts

CVEs per yearBy the year they were published

1. 20032
2. 20161
3. 201712
4. 201810
5. 201929
6. 202057
7. 202152
8. 202257
9. 202390
10. 202479
11. 2025101
12. 2026227

Newest CVEs

• CVE-2026-124445

  OpenEMR 7.0.1 before 8.4.0 OneTimeAuth Token Replay and PIN Brute Force

  openemr · openemr

  Critical9.3
• CVE-2026-123521

  Vikunja before 2.7.1 Password Brute-Force via TOTP Disable Endpoint

  go-vikunja · vikunja

  Medium6.0
• CVE-2026-17280

  Multiple Vulnerabilities in IBM API Connect

  IBM · API Connect

  High8.9
• CVE-2026-68933

  Chartbrew: Unauthenticated Brute Force of Password-Protected Dashboards Due to Missing Rate Limit and Plaintext Password Storage

  chartbrew · chartbrew

  High7.5
• CVE-2026-123998

  Hisense VIDAA Smart TV MQTT Broker Authentication Bypass

  Hisense · VIDAA

  High7.2
• CVE-2026-62850

  FreeScout: Administrative tools.php endpoint is accessible to low-privileged users, enabling filesystem enumeration and unthrottled brute-force of application secrets

  freescout-help-desk · freescout

  Medium5.3
• CVE-2026-66987

  HCL AION is affected by multiple security vulnerabilities.

  HCL Software · HCL AION

  Medium5.3
• CVE-2026-19877

  Brute-forceable image-share link password in INFINITT ULite

  INFINITT Healthcare · INFINITT ULite

  High7.5
• CVE-2026-122049

  Campcodes Bitcoin Wallet System ForgotPasswordController.php random_int excessive authentication

  Campcodes · Bitcoin Wallet System

  Medium6.3
• CVE-2026-122138

  BlueprintUE Self-Hosted Edition 4.2.0 before 4.3.4 Login Rate Limit Bypass

  blueprintue · blueprintue-self-hosted-edition

  Medium6.3

Vendors it comes up for most

1. IBM36
2. Dell19
3. nextcloud17
4. Fortinet11
5. Drupal9
6. Akinsoft8
7. Siemens8
8. OpenClaw7
9. Schneider Electric7
10. WWBN7