https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-28T13:10:12.101015+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2023-25156 CVE-2023-25156 — Kiwi TCMS has no protection against brute-force attacks on login page 2026-09-28T13:10:13.117447+00:00

Affected: kiwitcms kiwi

Kiwi TCMS, an open source test management system, does not impose rate limits in versions prior to 12.0. This makes it easier to attempt brute-force attacks against the login page. Users should upgrade to v12.0 or later to receive a patch. As a workaround, users may install and configure a rate-limiting proxy in front of Kiwi TCMS.

 https://vulnerability.circl.lu/vuln/ghsa-7968-h4m4-ghm9 GHSA-7968-h4m4-ghm9 — No protection against brute-force attacks on login page 2026-09-28T13:10:13.117569+00:00

Affected: PyPI: kiwitcms

### Impact Previous versions of Kiwi TCMS do not impose rate limits which makes it easier to attempt brute-force attacks against the login page.

### Patches Users should upgrade to v12.0 or later.

### Workarounds Users may install and configure a rate-limiting proxy in front of Kiwi TCMS. For example nginx.

### References [Disclosed by spyata](https://huntr.dev/bounties/2b1a9be9-45e9-490b-8de0-26a492e79795/)