https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-30T03:37:43.676280+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-102334 CVE-2026-102334 — Nginx Proxy Manager through 2.16.0 Missing Brute-Force Protection 2026-09-30T03:37:43.692933+00:00

Affected: NginxProxyManager nginx-proxy-manager

Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses against any account. Attackers can brute-force login credentials via POST /api/tokens and subsequently guess TOTP codes via POST /api/tokens/2fa to gain full session access and administrative control.