CVE-2026-84473None▾ TwilightPoC availableAuthentication Bypass / Missing Brute-Force Protection in remote.php/webdav/ in ownCloud ownCloud server 10.16.3 allows an unauthenticated remote attacker to perform unlimited online password guessing against WebDAV accounts via repeated…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 2.8 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Nov 7.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
1 GitHub repo (last check)
Authentication Bypass / Missing Brute-Force Protection in remote.php/webdav/ in ownCloud ownCloud server 10.16.3 allows an unauthenticated remote attacker to perform unlimited online password guessing against WebDAV accounts via repeated HTTP Basic Authentication requests to the WebDAV endpoint.
ownCloud >= 10.16.3 < 11.1.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-66204High· 8.1WBCE CMS is a content management system
CVE-2026-58172Critical· 9.1Ocelot - IP Allow/Block List Bypass for WebSocket Upgrade Requests
CVE-2026-73577NoneApache OFBiz: Unauthenticated path-suffix view authorization bypass
CVE-2026-116606Critical· 9.3Authentication Bypass Allows Global Configuration Restore in Barracuda Email Security Gateway
CVE-2026-119420High· 8.8Lago through 1.55.0 Authentication Bypass via acceptInvite GraphQL Mutation
CVE-2026-63190Critical· 9.4FearlessCMS: Unauthenticated debug scripts expose filesystem operations and XSS