CVE-2026-97764Low· 3.7▾ Sunlitdjango-allauth before 65.19.4 does not have the expected limits on failed login attempts because, in some common configurations, an attacker can leverage the handling of diacritics (e.g., accents) for a higher effective limit.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 20.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
django-allauth before 65.19.4 does not have the expected limits on failed login attempts because, in some common configurations, an attacker can leverage the handling of diacritics (e.g., accents) for a higher effective limit.
django-allauth >= 0.25.0 < 65.19.4Upgrade django-allauth to version 65.19.4 (latest).
The vulnerability is NOT exposed if any of the following settings is enabled.
65.4 and later: ACCOUNT_LOGIN_METHODS = {"email"}
65.3 and earlier: ACCOUNT_AUTHENTICATION_METHOD = "email"
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-95811NoneLemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow an equivalent spelling of a path to bypass the locationRules that restrict it. The handler matches each vhost…
CVE-2026-90813Medium· 4.3A vulnerability was detected in cosmicstack-labs mercury-agent up to 1.1.13
CVE-2026-79300Low· 3.5SEP sesam before 5.2.0.24 mishandles User Authorization with MFA
CVE-2026-62999High· 7.5Copier is a library and CLI app for rendering project templates
CVE-2026-73420NoneNextAuth.js provides authentication for Next.js
CVE-2026-72917Medium· 5.9AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting