Monthly
Rate limit bypass in Lemmy prior to 0.19.19 and 1.0.0-beta.1 allows unauthenticated remote attackers to circumvent all IP-based throttling by injecting a spoofed address as the first value of the X-Forwarded-For header. Because the bundled docker/nginx.conf forwards XFF headers using $proxy_add_x_forwarded_for rather than $remote_addr, attackers control the address that actix-web's ConnectionInfo::realip_remote_addr reads, receiving a fresh rate-limit bucket per request. No public exploit or CISA KEV listing exists, but exploitation is trivially automated and directly enables account registration spam, credential brute-forcing, comment spam, content scraping, bulk uploads, and repeated settings imports.
Rate-limit bypass in the Wazuh server API (versions 4.6.0 up to but not including 4.14.5) lets an authenticated client inject events into analysisd beyond the administrator-configured global request cap. A logic error in CheckRateLimitsMiddleware.dispatch() makes the /events endpoint's hardcoded 30/min check overwrite the general max_request_per_minute result, so /events requests keep succeeding even after the global limit is exhausted. No public exploit identified at time of analysis; EPSS is low (0.21%, 12th percentile) and CISA SSVC records no known exploitation.
Resource flooding in MIA Technology Pizzy Library versions 1.0.0.26250 through 1.3.9.26250 allows authenticated remote attackers to abuse improper interaction frequency controls (CWE-799) to degrade availability and tamper with integrity. With a CVSS 3.1 base score of 7.1 and no public exploit identified at time of analysis, the flaw primarily threatens service availability in deployments that expose the library over the network. The advisory was coordinated through Turkey's TR-CERT, with no CISA KEV listing and no EPSS data provided.
Remote authenticated attackers can flood PDKS (Personnel and Document Tracking System) through uncontrolled interaction frequency, achieving high integrity and availability impacts without confidentiality breach. This workforce management software by MeWare Software Development Inc. is vulnerable to denial-of-service conditions and potential data integrity compromise through rate-limiting bypass. Affects versions from V16.20200313 through VMYR_3.5.2025117. TR-CERT advisory available, EPSS data not provided, no CISA KEV listing identified.
Denial of service in OpenClaw versions 2026.2.26 through pre-2026.3.31 allows unauthenticated remote attackers to exhaust the shared pending pairing-request window on multi-account channel deployments, blocking legitimate accounts from initiating new pairing or onboarding. The root flaw is a quota-scoping error: the cap on pending requests was enforced per channel file rather than per account, so one actor's requests consume capacity allocated to unrelated accounts. The GHSA advisory confirms this is an availability-only impact - no cross-account data access, approval, or authorization bypass is possible. No public exploit or CISA KEV listing exists; EPSS probability is 0.10%, reflecting minimal real-world exploitation pressure at time of analysis.
Resource exhaustion in OpenClaw npm package versions up to 2026.3.28 allows remote unauthenticated attackers to degrade availability of the LINE webhook integration by flooding the endpoint with concurrent requests before signature verification occurs. The CVSS 4.0 score of 6.9 reflects network-accessible, zero-privilege exploitation with bounded low availability impact; the vendor's own triage classifies severity as low due to the transient, non-persistent nature of the disruption. No public exploit code exists and no active exploitation is confirmed - SSVC marks exploitation status as none, though the attack is rated automatable.
Rate limiting bypass in OpenClaw's WebSocket gateway (npm package ≤ 2026.3.28) allows unauthenticated remote attackers to conduct unbounded brute-force attempts against shared-secret passwords by including a fake DeviceToken field in WebSocket handshake requests, suppressing the IP-based rate limiter. The maintainer's own triage classifies the practical risk as narrow, noting that only deployments relying on weak shared passwords face meaningful threat since high-entropy secrets remain non-bruteforceable regardless of rate limiting. No public exploit code exists, EPSS is 0.04%, and SSVC exploitation status is none - consistent with a low-priority patching target outside of weak-credential deployments.
HCL Aftermarket DPC version 1.0.0 is vulnerable to excessive spamming that consumes server bandwidth and processing resources, potentially causing denial of service to legitimate users. The vulnerability requires user interaction (UI:R per CVSS vector) and is remotely exploitable without authentication, resulting in partial availability impact. No public exploit code or active exploitation has been identified at time of analysis, though the low barrier to exploitation (AC:L) makes this a practical attack vector for resource exhaustion.
IBM Aspera Console versions 3.3.0 through 3.4.8 contain an improper rate-limiting vulnerability in the email service that allows authenticated users to trigger a denial of service condition. An attacker with valid credentials can abuse the email functionality by sending requests at excessive frequencies, exhausting service resources and rendering the email feature unavailable to legitimate users. This vulnerability requires authentication and does not provide confidentiality or integrity impact, resulting in a moderate CVSS score of 5.3.
Medium severity vulnerability in wpDiscuz (WordPress plugin). wpDiscuz before 7.6.47 contains a missing rate limiting vulnerability that allows unauthenticated attackers to subscribe arbitrary email addresses to post notifications by sending POST requests to the wpdAddSubscription handler in class.WpdiscuzHelperAjax.php. Attackers can exploit LIKE wildcard characters in the subscription query to match multiple email addresses and generate unwanted notific...
Rate limit bypass in Lemmy prior to 0.19.19 and 1.0.0-beta.1 allows unauthenticated remote attackers to circumvent all IP-based throttling by injecting a spoofed address as the first value of the X-Forwarded-For header. Because the bundled docker/nginx.conf forwards XFF headers using $proxy_add_x_forwarded_for rather than $remote_addr, attackers control the address that actix-web's ConnectionInfo::realip_remote_addr reads, receiving a fresh rate-limit bucket per request. No public exploit or CISA KEV listing exists, but exploitation is trivially automated and directly enables account registration spam, credential brute-forcing, comment spam, content scraping, bulk uploads, and repeated settings imports.
Rate-limit bypass in the Wazuh server API (versions 4.6.0 up to but not including 4.14.5) lets an authenticated client inject events into analysisd beyond the administrator-configured global request cap. A logic error in CheckRateLimitsMiddleware.dispatch() makes the /events endpoint's hardcoded 30/min check overwrite the general max_request_per_minute result, so /events requests keep succeeding even after the global limit is exhausted. No public exploit identified at time of analysis; EPSS is low (0.21%, 12th percentile) and CISA SSVC records no known exploitation.
Resource flooding in MIA Technology Pizzy Library versions 1.0.0.26250 through 1.3.9.26250 allows authenticated remote attackers to abuse improper interaction frequency controls (CWE-799) to degrade availability and tamper with integrity. With a CVSS 3.1 base score of 7.1 and no public exploit identified at time of analysis, the flaw primarily threatens service availability in deployments that expose the library over the network. The advisory was coordinated through Turkey's TR-CERT, with no CISA KEV listing and no EPSS data provided.
Remote authenticated attackers can flood PDKS (Personnel and Document Tracking System) through uncontrolled interaction frequency, achieving high integrity and availability impacts without confidentiality breach. This workforce management software by MeWare Software Development Inc. is vulnerable to denial-of-service conditions and potential data integrity compromise through rate-limiting bypass. Affects versions from V16.20200313 through VMYR_3.5.2025117. TR-CERT advisory available, EPSS data not provided, no CISA KEV listing identified.
Denial of service in OpenClaw versions 2026.2.26 through pre-2026.3.31 allows unauthenticated remote attackers to exhaust the shared pending pairing-request window on multi-account channel deployments, blocking legitimate accounts from initiating new pairing or onboarding. The root flaw is a quota-scoping error: the cap on pending requests was enforced per channel file rather than per account, so one actor's requests consume capacity allocated to unrelated accounts. The GHSA advisory confirms this is an availability-only impact - no cross-account data access, approval, or authorization bypass is possible. No public exploit or CISA KEV listing exists; EPSS probability is 0.10%, reflecting minimal real-world exploitation pressure at time of analysis.
Resource exhaustion in OpenClaw npm package versions up to 2026.3.28 allows remote unauthenticated attackers to degrade availability of the LINE webhook integration by flooding the endpoint with concurrent requests before signature verification occurs. The CVSS 4.0 score of 6.9 reflects network-accessible, zero-privilege exploitation with bounded low availability impact; the vendor's own triage classifies severity as low due to the transient, non-persistent nature of the disruption. No public exploit code exists and no active exploitation is confirmed - SSVC marks exploitation status as none, though the attack is rated automatable.
Rate limiting bypass in OpenClaw's WebSocket gateway (npm package ≤ 2026.3.28) allows unauthenticated remote attackers to conduct unbounded brute-force attempts against shared-secret passwords by including a fake DeviceToken field in WebSocket handshake requests, suppressing the IP-based rate limiter. The maintainer's own triage classifies the practical risk as narrow, noting that only deployments relying on weak shared passwords face meaningful threat since high-entropy secrets remain non-bruteforceable regardless of rate limiting. No public exploit code exists, EPSS is 0.04%, and SSVC exploitation status is none - consistent with a low-priority patching target outside of weak-credential deployments.
HCL Aftermarket DPC version 1.0.0 is vulnerable to excessive spamming that consumes server bandwidth and processing resources, potentially causing denial of service to legitimate users. The vulnerability requires user interaction (UI:R per CVSS vector) and is remotely exploitable without authentication, resulting in partial availability impact. No public exploit code or active exploitation has been identified at time of analysis, though the low barrier to exploitation (AC:L) makes this a practical attack vector for resource exhaustion.
IBM Aspera Console versions 3.3.0 through 3.4.8 contain an improper rate-limiting vulnerability in the email service that allows authenticated users to trigger a denial of service condition. An attacker with valid credentials can abuse the email functionality by sending requests at excessive frequencies, exhausting service resources and rendering the email feature unavailable to legitimate users. This vulnerability requires authentication and does not provide confidentiality or integrity impact, resulting in a moderate CVSS score of 5.3.
Medium severity vulnerability in wpDiscuz (WordPress plugin). wpDiscuz before 7.6.47 contains a missing rate limiting vulnerability that allows unauthenticated attackers to subscribe arbitrary email addresses to post notifications by sending POST requests to the wpdAddSubscription handler in class.WpdiscuzHelperAjax.php. Attackers can exploit LIKE wildcard characters in the subscription query to match multiple email addresses and generate unwanted notific...