index.html Current CVEs, known exploits, and important cybersecurity updates. en-US Mon, 17 Aug 2026 14:02:20 +0000 https://euvd.enisa.europa.eu/enisa/EUVD-2026-60177 euvd:EUVD-2026-60177 Mon, 17 Aug 2026 13:26:44 +0000 EUVD Dell ObjectScale, versions prior to 4.3.0.1, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges. https://thehackernews.com/2026/08/weekly-recap-vmware-exploits-windows-0.html the hacker news:https://thehackernews.com/2026/08/weekly-recap-vmware-exploits-windows-0.html Mon, 17 Aug 2026 18:53:51 +0530 The Hacker News The expensive attacks are not always the clever ones. This week had plenty of proof. Exposed services got hit, old bugs found fresh use, browser sessions became attack paths, and supply-chain problems kept spreading farther than the original compromise. A lot of it came down to access that was already there and defenses that assumed nobody would look too closely. So, nothing magical. Just a https://nvd.nist.gov/vuln/detail/CVE-2026-75002 nvd:CVE-2026-75002 Mon, 17 Aug 2026 13:16:54 +0000 NVD CVE In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, mail search and LITERAL+ byte-count desynchronization could lead to information disclosure or privilege escalation via IMAP command injection. https://nvd.nist.gov/vuln/detail/CVE-2026-74998 nvd:CVE-2026-74998 Mon, 17 Aug 2026 13:16:54 +0000 NVD CVE In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS (Cascading Style Sheets) proxy were not validated, which may result in information disclosure or XSS (cross-site scripting) via MIME sniffing. https://nvd.nist.gov/vuln/detail/CVE-2026-74997 nvd:CVE-2026-74997 Mon, 17 Aug 2026 13:16:54 +0000 NVD CVE In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the cmd_learn driver of the markasjunk plugin is subject to remote code execution via crafted placeholder replacement values. This issue only affects Roundcube instances using the markasjunk plugin with its cmd_learn driver. https://nvd.nist.gov/vuln/detail/CVE-2026-16467 nvd:CVE-2026-16467 Mon, 17 Aug 2026 13:16:50 +0000 NVD CVE Missing Authorization vulnerability in Dolusoft Software Technologies Fortilogger allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Fortilogger: before 6.1.5.9. https://nvd.nist.gov/vuln/detail/CVE-2026-14564 nvd:CVE-2026-14564 Mon, 17 Aug 2026 13:16:50 +0000 NVD CVE Insufficiently Protected Credentials vulnerability in Innotim Software Telecommunications and Consulting Trade Ltd. Co. Logsign SIEM allows Retrieve Embedded Sensitive Data. This issue affects Logsign SIEM: from 6.4.97 before 6.4.114. https://euvd.enisa.europa.eu/enisa/EUVD-2026-60176 euvd:EUVD-2026-60176 Mon, 17 Aug 2026 13:15:15 +0000 EUVD Missing Authorization vulnerability in Dolusoft Software Technologies Sonlogger allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Sonlogger: from v6.6.6 before 6.7.4.8. https://euvd.enisa.europa.eu/enisa/EUVD-2026-60173 euvd:EUVD-2026-60173 Mon, 17 Aug 2026 12:59:01 +0000 EUVD Missing Authorization vulnerability in Dolusoft Software Technologies Fortilogger allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Fortilogger: before 6.1.5.9. https://euvd.enisa.europa.eu/enisa/EUVD-2026-60168 euvd:EUVD-2026-60168 Mon, 17 Aug 2026 12:48:41 +0000 EUVD In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, mail search and LITERAL+ byte-count desynchronization could lead to information disclosure or privilege escalation via IMAP command injection. https://euvd.enisa.europa.eu/enisa/EUVD-2026-59603 euvd:EUVD-2026-59603 Mon, 17 Aug 2026 12:44:54 +0000 EUVD Uncontrolled resource consumption vulnerability in Apache Struts. An application that exposes an endpoint collecting Content Security Policy violation reports reads the submitted report into memory without bounding how much it will accept, so a single request can exhaust the heap and deny service to other users. Such endpoints are ordinarily reachable without authentication. The core distribution maps no such endpoint by default; applications that do not collect violation reports are not affected. This issue affects Apache Struts: from 6.0.0 through 6.10.0, from 7.0.0 through 7.2.1. Users are recommended to upgrade to version 6.11.0 or 7.3.0, which fixes the issue. https://euvd.enisa.europa.eu/enisa/EUVD-2026-59604 euvd:EUVD-2026-59604 Mon, 17 Aug 2026 12:43:26 +0000 EUVD Allocation of resources without limits or throttling vulnerability in Apache Struts. When no fixed locale is configured, the locale used for localized-text lookups is taken from the incoming request, allowing an unauthenticated remote client to cause the framework's internal localized-text caches to grow without bound and exhaust the Java heap, denying service to other users. Applications that configure a fixed locale are not affected. This issue affects Apache Struts: from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.10.0, from 7.0.0 through 7.2.1. Users are recommended to upgrade to version 6.11.0 or 7.3.0, which fixes the issue. https://euvd.enisa.europa.eu/enisa/EUVD-2026-60165 euvd:EUVD-2026-60165 Mon, 17 Aug 2026 12:40:29 +0000 EUVD In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS (Cascading Style Sheets) proxy were not validated, which may result in information disclosure or XSS (cross-site scripting) via MIME sniffing. https://euvd.enisa.europa.eu/enisa/EUVD-2026-60164 euvd:EUVD-2026-60164 Mon, 17 Aug 2026 12:37:45 +0000 EUVD In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the cmd_learn driver of the markasjunk plugin is subject to remote code execution via crafted placeholder replacement values. This issue only affects Roundcube instances using the markasjunk plugin with its cmd_learn driver. https://www.bleepingcomputer.com/news/microsoft/windows-server-2022-reaches-end-of-mainstream-support-in-60-days/ bleepingcomputer security:https://www.bleepingcomputer.com/news/microsoft/windows-server-2022-reaches-end-of-mainstream-support-in-60-days/ Mon, 17 Aug 2026 08:33:11 -0400 BleepingComputer Security Microsoft has reminded IT administrators that Windows Server 2022 is rapidly approaching its mainstream end date of October 2026, when it will switch to extended support. [...] https://euvd.enisa.europa.eu/enisa/EUVD-2026-60159 euvd:EUVD-2026-60159 Mon, 17 Aug 2026 12:32:27 +0000 EUVD OutSystems Service Center is vulnerable to a DOM-based Cross-Site Scripting (XSS) attack that can be exploited by a low-privileged attacker via the upload of a file with a malicious filename containing JavaScript code. The vulnerability exists in all locations where a file can be attached and prepared for upload to the server. This issue was fixed in OutSystems Service Center version 11.41.2 https://euvd.enisa.europa.eu/enisa/EUVD-2026-60161 euvd:EUVD-2026-60161 Mon, 17 Aug 2026 12:26:34 +0000 EUVD Insufficiently Protected Credentials vulnerability in Innotim Software Telecommunications and Consulting Trade Ltd. Co. Logsign SIEM allows Retrieve Embedded Sensitive Data. This issue affects Logsign SIEM: from 6.4.97 before 6.4.114. https://nvd.nist.gov/vuln/detail/CVE-2026-74843 nvd:CVE-2026-74843 Mon, 17 Aug 2026 12:18:58 +0000 NVD CVE A vulnerability was determined in Wavlink WN531P3 and WN535M1 V250922. Affected by this vulnerability is the function strcpy of the file /etc/lighttpd/www/cgi-bin/export_pingortrace.cgi of the component Export Pingortrace CGI. Executing a manipulation of the argument HTTP_COOKIE can lead to stack-based buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure. https://euvd.enisa.europa.eu/enisa/EUVD-2026-60160 euvd:EUVD-2026-60160 Mon, 17 Aug 2026 12:08:11 +0000 EUVD On a Kong Mesh global control plane, resources received over the zone-to-global KDS sync are attributed using the in-band, sender-controlled ControlPlane.Identifier rather than the authenticated zone identity derived from the connection. Authenticated zones can have the global control plane store and re-distribute those resources as belonging to another zone. The result is a cross-zone isolation bypass: the holder of a single enrolled zone's credential can inject, attribute, and overwrite resources in another zone's namespace mesh-wide. The root cause lives in Kuma's open-source KDS sync code, which Kong Mesh's control plane is built on. https://euvd.enisa.europa.eu/enisa/EUVD-2026-12755 euvd:EUVD-2026-12755 Mon, 17 Aug 2026 12:05:18 +0000 EUVD jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.2.1, user control of the `options` argument of the `output` function allows attackers to inject arbitrary HTML (such as scripts) into the browser context the created PDF is opened in. The vulnerability can be exploited in the following scenario: the attacker provides values for the output options, for example via a web interface. These values are then passed unsanitized (automatically or semi-automatically) to the attack victim. The victim creates and opens a PDF with the attack vector using one of the vulnerable method overloads inside their browser. The attacker can thus inject scripts that run in the victims browser context and can extract or modify secrets from this context. The vulnerability has been fixed in jspdf@4.2.1. As a workaround, sanitize user input before passing it to the output method. https://euvd.enisa.europa.eu/enisa/EUVD-2026-0847 euvd:EUVD-2026-0847 Mon, 17 Aug 2026 12:05:14 +0000 EUVD jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.0.0, user control of the first argument of the loadFile method in the node.js build allows local file inclusion/path traversal. If given the possibility to pass unsanitized paths to the loadFile method, a user can retrieve file contents of arbitrary files in the local file system the node process is running in. The file contents are included verbatim in the generated PDFs. Other affected methods are `addImage`, `html`, and `addFont`. Only the node.js builds of the library are affected, namely the `dist/jspdf.node.js` and `dist/jspdf.node.min.js` files. The vulnerability has been fixed in jsPDF@4.0.0. This version restricts file system access per default. This semver-major update does not introduce other breaking changes. Some workarounds areavailable. With recent node versions, jsPDF recommends using the `--permission` flag in production. The feature was introduced experimentally in v20.0.0 and is stable since v22.13.0/v23.5.0/v24.0.0. For older node versions, sanitize user-provided paths before passing them to jsPDF. https://euvd.enisa.europa.eu/enisa/EUVD-2026-36281 euvd:EUVD-2026-36281 Mon, 17 Aug 2026 12:05:13 +0000 EUVD Vim is an open source, command line text editor. Prior to version 9.2.0495, a Vimscript code injection vulnerability exists in s:NetrwBookHistSave() in the netrw plugin (runtime/pack/dist/opt/netrw/autoload/netrw.vim) when serializing browsed directory paths to the history file ~/.vim/.netrwhist. A directory name derived from the filesystem is interpolated into a single-quoted Vimscript string literal without escaping embedded single quotes, allowing a crafted directory name to break out of the string context and execute arbitrary Vimscript, including shell commands via system() and :!, the next time the history file is sourced. This issue has been patched in version 9.2.0495. https://euvd.enisa.europa.eu/enisa/EUVD-2026-19873 euvd:EUVD-2026-19873 Mon, 17 Aug 2026 12:05:13 +0000 EUVD Vite is a frontend tooling framework for JavaScript. From 7.1.0 to before 7.3.2 and 8.0.5, on the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, *.crt) can be retrieved with HTTP 200 responses when query parameters such as ?raw, ?import&raw, or ?import&url&inline are appended. This vulnerability is fixed in 7.3.2 and 8.0.5. https://euvd.enisa.europa.eu/enisa/EUVD-2026-11653 euvd:EUVD-2026-11653 Mon, 17 Aug 2026 12:05:13 +0000 EUVD flatted is a circular JSON parser. Prior to 3.4.0, flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential $ indices, the recursion depth is unbounded, causing a stack overflow that crashes the Node.js process. This vulnerability is fixed in 3.4.0. https://www.bleepingcomputer.com/news/security/philips-and-ge-investigating-clop-ransomware-data-theft-claims/ bleepingcomputer security:https://www.bleepingcomputer.com/news/security/philips-and-ge-investigating-clop-ransomware-data-theft-claims/ Mon, 17 Aug 2026 07:25:02 -0400 BleepingComputer Security Tech giants General Electric (GE) and Philips have also confirmed they're investigating claims that the Clop ransomware gang breached their systems and stole data. [...] https://nvd.nist.gov/vuln/detail/CVE-2026-74901 nvd:CVE-2026-74901 Mon, 17 Aug 2026 11:16:45 +0000 NVD CVE openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in pqc.py where AES-GCM decryption failures trigger fallback to unauthenticated AES-CTR mode. Attackers can modify ciphertext in transit to bypass integrity verification and perform bit-flipping attacks without detection. https://nvd.nist.gov/vuln/detail/CVE-2026-74900 nvd:CVE-2026-74900 Mon, 17 Aug 2026 11:16:45 +0000 NVD CVE openssl_encrypt versions before 1.4.0 contain a critical vulnerability in pqc.py where KEM decapsulation failures silently fall back to simulation mode, generating a deterministic shared secret from only 16 bytes of the private key and publicly available encapsulated key data. Attackers who obtain 16 bytes of the private key can compute the shared secret and decrypt all ciphertext, as the fallback triggers on any KEM failure without raising an error. https://nvd.nist.gov/vuln/detail/CVE-2026-74899 nvd:CVE-2026-74899 Mon, 17 Aug 2026 11:16:44 +0000 NVD CVE openssl_encrypt versions before 1.4.0 contain a sandbox escape vulnerability in IsolatedPluginExecutor that exposes Python type objects in restricted exec() builtins. Attackers can traverse the Python class hierarchy via __class__.__mro__.__subclasses__() to access system functions and execute arbitrary OS commands. https://nvd.nist.gov/vuln/detail/CVE-2026-74896 nvd:CVE-2026-74896 Mon, 17 Aug 2026 11:16:44 +0000 NVD CVE openssl_encrypt versions before 1.4.0 contain a sandbox escape vulnerability in the DangerousPatternVisitor AST analyzer that fails to detect dunder attribute traversal techniques. Attackers can use __class__, __bases__, __subclasses__(), and __globals__ chains to access restricted functions and execute arbitrary system commands from plugin code. https://nvd.nist.gov/vuln/detail/CVE-2026-74895 nvd:CVE-2026-74895 Mon, 17 Aug 2026 11:16:44 +0000 NVD CVE openssl_encrypt versions before 1.4.0 fail to apply sandbox restrictions in the default process isolation mode for plugin execution. Attackers can execute malicious plugins with unrestricted access to the filesystem, network, subprocess execution, and all Python modules. https://nvd.nist.gov/vuln/detail/CVE-2026-74894 nvd:CVE-2026-74894 Mon, 17 Aug 2026 11:16:44 +0000 NVD CVE openssl_encrypt before 1.4.0 contains an authentication bypass vulnerability in the verify_api_token function that accepts any non-empty Bearer token string without validation. Attackers can upload arbitrary public keys, enumerate all keys, and revoke keys belonging to any user by providing any Bearer token in the Authorization header. https://nvd.nist.gov/vuln/detail/CVE-2026-74893 nvd:CVE-2026-74893 Mon, 17 Aug 2026 11:16:44 +0000 NVD CVE openssl_encrypt versions before 1.4.0 contain hardcoded default JWT signing secrets in config.py that pass validation checks. Attackers with access to source code can forge valid JWT tokens for any client_id to gain authenticated access to keyserver and telemetry APIs. https://nvd.nist.gov/vuln/detail/CVE-2026-74892 nvd:CVE-2026-74892 Mon, 17 Aug 2026 11:16:44 +0000 NVD CVE openssl_encrypt versions before 1.4.0 contain a hardcoded default secret key in the standalone telemetry server configuration that is used for API key hashing. Attackers who know this default value can predict or forge API key hashes to compromise telemetry API authentication. https://nvd.nist.gov/vuln/detail/CVE-2026-74891 nvd:CVE-2026-74891 Mon, 17 Aug 2026 11:16:44 +0000 NVD CVE openssl_encrypt versions before 1.4.0 contain hardcoded database credentials in standalone server configuration files. Attackers on the same network can access PostgreSQL databases using well-known default credentials to retrieve sensitive data. https://nvd.nist.gov/vuln/detail/CVE-2026-74889 nvd:CVE-2026-74889 Mon, 17 Aug 2026 11:16:43 +0000 NVD CVE openssl_encrypt versions before 1.4.0 use HKDF with no salt and static info parameter in key normalization functions, reducing entropy extraction and determinism. Attackers can exploit predictable key derivation with identical inputs to weaken cryptographic security against multi-target attacks. https://nvd.nist.gov/vuln/detail/CVE-2026-74888 nvd:CVE-2026-74888 Mon, 17 Aug 2026 11:16:43 +0000 NVD CVE openssl_encrypt versions before 1.4.0 use a non-standard PBKDF2 key derivation construction with iterations=1 per call in an outer loop, creating a KDF whose security properties have not been formally analyzed. Attackers can exploit this weakened key derivation to more efficiently crack passwords protecting legacy encrypted files compared to standard PBKDF2 implementations. https://nvd.nist.gov/vuln/detail/CVE-2026-74886 nvd:CVE-2026-74886 Mon, 17 Aug 2026 11:16:43 +0000 NVD CVE openssl_encrypt versions before 1.4.0 contain a plugin sandbox bypass vulnerability where the PluginImportGuard blocks a different set of modules than the AST analyzer's DANGEROUS_MODULES set. Attackers can bypass AST analysis through string obfuscation or encoding to import unblocked dangerous modules like sys, shutil, multiprocessing, importlib, and pickle for arbitrary code execution. https://nvd.nist.gov/vuln/detail/CVE-2026-74884 nvd:CVE-2026-74884 Mon, 17 Aug 2026 11:16:43 +0000 NVD CVE openssl_encrypt versions before 1.4.0 contain a path traversal vulnerability in the _is_safe_path method where the plugin_id parameter is not sanitized before constructing the plugin config directory path. Attackers can declare a malicious plugin_id containing path traversal sequences like '../' to access arbitrary directories outside the intended plugin directory. https://nvd.nist.gov/vuln/detail/CVE-2026-74883 nvd:CVE-2026-74883 Mon, 17 Aug 2026 11:16:42 +0000 NVD CVE openssl_encrypt versions before 1.4.0 contain a sandbox bypass vulnerability where the plugin sandbox fails to restrict alternative file access methods like pathlib.Path and io.open. Attackers can import pathlib or io modules to read and write arbitrary files, completely bypassing the restricted_open file access controls. https://nvd.nist.gov/vuln/detail/CVE-2026-74882 nvd:CVE-2026-74882 Mon, 17 Aug 2026 11:16:42 +0000 NVD CVE openssl_encrypt versions before 1.4.0 contain an insecure default configuration that trusts the entire RFC 1918 private address space in IntegrityProxyConfig trusted_proxies. Attackers on private networks can forge client certificate headers to bypass mTLS authentication when ProxyAuth validation is relaxed or modified. https://nvd.nist.gov/vuln/detail/CVE-2026-74880 nvd:CVE-2026-74880 Mon, 17 Aug 2026 11:16:42 +0000 NVD CVE openssl_encrypt versions before 1.4.0 accept refresh tokens as URL query parameters in keyserver and telemetry server routes. Attackers can extract tokens from server logs, proxy logs, browser history, and HTTP Referer headers to gain unauthorized access. https://nvd.nist.gov/vuln/detail/CVE-2026-74879 nvd:CVE-2026-74879 Mon, 17 Aug 2026 11:16:42 +0000 NVD CVE openssl_encrypt versions before 1.4.0 contain an information disclosure vulnerability in the /ready endpoint that returns full database exception strings to unauthenticated callers. Attackers can trigger database errors to extract sensitive information including hostnames, IP addresses, connection parameters, and potentially credentials from exception messages. https://nvd.nist.gov/vuln/detail/CVE-2026-74878 nvd:CVE-2026-74878 Mon, 17 Aug 2026 11:16:42 +0000 NVD CVE openssl_encrypt versions before 1.4.0 use an in-memory rate limiter for TOTP brute-force protection that is not shared across workers and is lost on server restart. Attackers can distribute authentication attempts across multiple server instances or retry immediately after a restart to bypass rate limiting protections. https://nvd.nist.gov/vuln/detail/CVE-2026-74877 nvd:CVE-2026-74877 Mon, 17 Aug 2026 11:16:42 +0000 NVD CVE openssl_encrypt versions before 1.4.0 contain a missing ownership verification vulnerability in the revoke_key method that allows authenticated clients to revoke any other client's key. Attackers can revoke arbitrary keys by providing a valid ML-DSA signature, bypassing the intended ownership restriction. https://nvd.nist.gov/vuln/detail/CVE-2026-74876 nvd:CVE-2026-74876 Mon, 17 Aug 2026 11:16:42 +0000 NVD CVE openssl_encrypt versions before 1.4.0 contain a vulnerability in PublicKeyBundle.from_dict() that creates key bundles from untrusted data without verifying signatures. Attackers can call from_dict() followed by to_identity() without signature verification to encrypt data using attacker-controlled public keys, leaking secrets. https://nvd.nist.gov/vuln/detail/CVE-2026-74875 nvd:CVE-2026-74875 Mon, 17 Aug 2026 11:16:41 +0000 NVD CVE openssl_encrypt versions before 1.4.0 silently skip JSON schema validation when the jsonschema library is not installed, allowing malformed metadata to be accepted. Attackers can remove the jsonschema package or supply unknown metadata format versions to bypass all schema checks and process malicious data. https://nvd.nist.gov/vuln/detail/CVE-2026-74874 nvd:CVE-2026-74874 Mon, 17 Aug 2026 11:16:41 +0000 NVD CVE openssl_encrypt versions before 1.4.0 use Python's non-cryptographic random module for steganographic pixel selection in the generate_pseudorandom_sequence function. Attackers who know the password can recover the Mersenne Twister state from approximately 624 outputs and predict pixel locations containing hidden data for extraction. https://nvd.nist.gov/vuln/detail/CVE-2026-74872 nvd:CVE-2026-74872 Mon, 17 Aug 2026 11:16:41 +0000 NVD CVE openssl_encrypt versions before 1.4.0 contain an arbitrary code execution vulnerability in the Whirlpool hash implementation that uses broad glob patterns to load .so modules without integrity verification. Attackers can place malicious .so files matching the whirlpool*py313*.so pattern in site-packages directories to achieve native code execution when the module is loaded. https://nvd.nist.gov/vuln/detail/CVE-2026-74869 nvd:CVE-2026-74869 Mon, 17 Aug 2026 11:16:41 +0000 NVD CVE stoatchat before 0.15.0 contains a missing authorization vulnerability in the Subscribe message handler that allows authenticated attackers to enumerate members and monitor profile updates of private servers without membership. Attackers can subscribe to any server's member-update topic by sending a Subscribe message with an arbitrary server ID, receiving live UserUpdate events including display names, avatars, and status changes for members they should not have access to. https://nvd.nist.gov/vuln/detail/CVE-2026-74868 nvd:CVE-2026-74868 Mon, 17 Aug 2026 11:16:41 +0000 NVD CVE SiYuan versions before 3.7.4 contain an unthrottled brute-force vulnerability in the Publish Service Basic Auth implementation (PublishServiceTransport.RoundTrip() in kernel/server/proxy/publish.go). The Publish Service runs on a separate, unauthenticated-by-default listener (default TCP port 6808) and gates named publish-viewer accounts (Conf.Publish.Auth.Accounts) with Basic Auth that has no rate limiting, per-account lockout, or backoff. Unauthenticated remote attackers can submit unlimited password guesses against named accounts to gain access to published notes/notebooks.