Monthly
Coordinated abuse reporting in the self-hosted ClawHub application/backend lets four distinct ordinary authenticated accounts push any visible skill to moderationStatus: hidden with no moderator in the loop, silently removing it from the catalog - and official/vendor-published skills are not exempt. Because the reporter quota only counts reports filed against currently-visible targets, the same four accounts can recycle the trick against additional skills, so the effect is repeatable catalog suppression rather than a one-off. Exploitation requires only ordinary authenticated users (CVSS vector PR:L, no moderator or admin role) and coordinated multi-account control; no public exploit code and no confirmed active exploitation (CISA KEV) have been identified at time of analysis. The vendor CVSS 4.0 score of 8.7 (VC:H/VI:H/VA:H) is more severe than the independent CVSS 3.1 assessment of AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H, which correctly bounds the impact to catalog visibility (no data read, no code execution); affected deployments are self-hosted ClawHub at or before revision cbfee7343ddc867316dd9b3de6fa8856730f9f41, while the npm CLI and OpenClaw runtime are separate products and are not affected.
Rate-limit bypass in the Wazuh server API (versions 4.6.0 up to but not including 4.14.5) lets an authenticated client inject events into analysisd beyond the administrator-configured global request cap. A logic error in CheckRateLimitsMiddleware.dispatch() makes the /events endpoint's hardcoded 30/min check overwrite the general max_request_per_minute result, so /events requests keep succeeding even after the global limit is exhausted. No public exploit identified at time of analysis; EPSS is low (0.21%, 12th percentile) and CISA SSVC records no known exploitation.
Resource flooding in MIA Technology Pizzy Library versions 1.0.0.26250 through 1.3.9.26250 allows authenticated remote attackers to abuse improper interaction frequency controls (CWE-799) to degrade availability and tamper with integrity. With a CVSS 3.1 base score of 7.1 and no public exploit identified at time of analysis, the flaw primarily threatens service availability in deployments that expose the library over the network. The advisory was coordinated through Turkey's TR-CERT, with no CISA KEV listing and no EPSS data provided.
Remote authenticated attackers can flood PDKS (Personnel and Document Tracking System) through uncontrolled interaction frequency, achieving high integrity and availability impacts without confidentiality breach. This workforce management software by MeWare Software Development Inc. is vulnerable to denial-of-service conditions and potential data integrity compromise through rate-limiting bypass. Affects versions from V16.20200313 through VMYR_3.5.2025117. TR-CERT advisory available, EPSS data not provided, no CISA KEV listing identified.
Parse Server versions prior to 9.5.2-alpha.10 and 8.6.23 allow remote attackers to bypass rate limiting protections by submitting multiple requests within a single batch request, since batch processing routes requests internally and circumvents Express middleware controls. Deployments relying on built-in rate limiting are vulnerable to abuse and denial of service attacks. A patch is available in the specified versions.
Fortinet FortiWeb versions 7.0 through 8.0.2 contain an improper rate-limiting flaw that allows unauthenticated remote attackers to bypass authentication attempt restrictions through crafted requests. This vulnerability enables attackers to conduct brute-force password attacks against FortiWeb instances with reduced constraints, with success dependent on attacker resources and target password complexity. No patch is currently available for affected versions.
Unauthenticated visitors can bypass the image-captcha requirement on baserCMS mail forms by posting directly to the public Web API endpoint POST /baser/api/bc-mail/mail_messages/add/{mailContentId}.json, whose add() action and MailMessagesService::create() never invoke BcCaptchaService::check() the way the web-UI MailController::submit() flow does. Only mail forms that are still accepting submissions and have auth_captcha enabled are exposed (5.0.0 through 5.3.1 and 5.4.0 through 5.4.1); closed forms are still rejected by the isAccepting() guard added for CVE-2026-30878. A successful bypass lets an attacker script repeated submissions that flood the administrator inbox, cause the site's own mail server to send attacker-influenced auto-replies to third-party addresses when the form has an email field, and accumulate mail_messages rows when save_info is enabled; severity is 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), there is no CISA KEV entry, and the upstream advisory supplies code-level reproduction steps rather than confirmed working exploit tooling.
OpenBao deployments that rely on role-scoped rate-limit quotas can have those quotas bypassed when a request is sent with a form-encoded body or with a forwarded client certificate, because role resolution fails and the backend-specific quota rule is not enforced. The affected ranges are OpenBao before 2.6.4 and 2.7.0 before 2.7.1; a caller with legitimate access to the token-issuance path can repeatedly issue tokens without consuming the configured role-based rate-limit budget. This is a moderate-severity control bypass rather than an urgent emergency, and no public exploit was identified at the time of analysis; vendor patches are available in 2.6.4 and 2.7.1.
Functionality misuse in the Drupal Webform contributed module (versions 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1) lets remote, unauthenticated attackers circumvent interaction-frequency controls such as submission or rate limits on affected forms. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, score 5.3) limits impact to low integrity misuse with no confidentiality or availability effect, and exploitation requires that a deployed site actually use the affected frequency-control feature; the precise trigger is not described in the available sources. No public exploit is identified at time of analysis, EPSS is 0.15% (4th percentile), the vuln.today priority label is this_month, and a vendor patch is available.
Missing rate limiting in Jivejdon's unauthenticated /account/smsVRAction endpoint allows remote attackers to send unlimited SMS messages to arbitrary phone numbers, leading to harassment and depletion of the operator's Tencent Cloud SMS balance. Affected commits range from e0306088 through ee67a65e, and exploitation requires the instance to have Tencent Cloud SMS integration configured and funded; attackers must first load newAccount.jsp to set session attributes before repeatedly calling the endpoint. No public exploit code or active exploitation has been identified, and this is assessed as a medium-severity resource and financial abuse issue rather than a high-priority emergency.
Coordinated abuse reporting in the self-hosted ClawHub application/backend lets four distinct ordinary authenticated accounts push any visible skill to moderationStatus: hidden with no moderator in the loop, silently removing it from the catalog - and official/vendor-published skills are not exempt. Because the reporter quota only counts reports filed against currently-visible targets, the same four accounts can recycle the trick against additional skills, so the effect is repeatable catalog suppression rather than a one-off. Exploitation requires only ordinary authenticated users (CVSS vector PR:L, no moderator or admin role) and coordinated multi-account control; no public exploit code and no confirmed active exploitation (CISA KEV) have been identified at time of analysis. The vendor CVSS 4.0 score of 8.7 (VC:H/VI:H/VA:H) is more severe than the independent CVSS 3.1 assessment of AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H, which correctly bounds the impact to catalog visibility (no data read, no code execution); affected deployments are self-hosted ClawHub at or before revision cbfee7343ddc867316dd9b3de6fa8856730f9f41, while the npm CLI and OpenClaw runtime are separate products and are not affected.
Rate-limit bypass in the Wazuh server API (versions 4.6.0 up to but not including 4.14.5) lets an authenticated client inject events into analysisd beyond the administrator-configured global request cap. A logic error in CheckRateLimitsMiddleware.dispatch() makes the /events endpoint's hardcoded 30/min check overwrite the general max_request_per_minute result, so /events requests keep succeeding even after the global limit is exhausted. No public exploit identified at time of analysis; EPSS is low (0.21%, 12th percentile) and CISA SSVC records no known exploitation.
Resource flooding in MIA Technology Pizzy Library versions 1.0.0.26250 through 1.3.9.26250 allows authenticated remote attackers to abuse improper interaction frequency controls (CWE-799) to degrade availability and tamper with integrity. With a CVSS 3.1 base score of 7.1 and no public exploit identified at time of analysis, the flaw primarily threatens service availability in deployments that expose the library over the network. The advisory was coordinated through Turkey's TR-CERT, with no CISA KEV listing and no EPSS data provided.
Remote authenticated attackers can flood PDKS (Personnel and Document Tracking System) through uncontrolled interaction frequency, achieving high integrity and availability impacts without confidentiality breach. This workforce management software by MeWare Software Development Inc. is vulnerable to denial-of-service conditions and potential data integrity compromise through rate-limiting bypass. Affects versions from V16.20200313 through VMYR_3.5.2025117. TR-CERT advisory available, EPSS data not provided, no CISA KEV listing identified.
Parse Server versions prior to 9.5.2-alpha.10 and 8.6.23 allow remote attackers to bypass rate limiting protections by submitting multiple requests within a single batch request, since batch processing routes requests internally and circumvents Express middleware controls. Deployments relying on built-in rate limiting are vulnerable to abuse and denial of service attacks. A patch is available in the specified versions.
Fortinet FortiWeb versions 7.0 through 8.0.2 contain an improper rate-limiting flaw that allows unauthenticated remote attackers to bypass authentication attempt restrictions through crafted requests. This vulnerability enables attackers to conduct brute-force password attacks against FortiWeb instances with reduced constraints, with success dependent on attacker resources and target password complexity. No patch is currently available for affected versions.
Unauthenticated visitors can bypass the image-captcha requirement on baserCMS mail forms by posting directly to the public Web API endpoint POST /baser/api/bc-mail/mail_messages/add/{mailContentId}.json, whose add() action and MailMessagesService::create() never invoke BcCaptchaService::check() the way the web-UI MailController::submit() flow does. Only mail forms that are still accepting submissions and have auth_captcha enabled are exposed (5.0.0 through 5.3.1 and 5.4.0 through 5.4.1); closed forms are still rejected by the isAccepting() guard added for CVE-2026-30878. A successful bypass lets an attacker script repeated submissions that flood the administrator inbox, cause the site's own mail server to send attacker-influenced auto-replies to third-party addresses when the form has an email field, and accumulate mail_messages rows when save_info is enabled; severity is 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), there is no CISA KEV entry, and the upstream advisory supplies code-level reproduction steps rather than confirmed working exploit tooling.
OpenBao deployments that rely on role-scoped rate-limit quotas can have those quotas bypassed when a request is sent with a form-encoded body or with a forwarded client certificate, because role resolution fails and the backend-specific quota rule is not enforced. The affected ranges are OpenBao before 2.6.4 and 2.7.0 before 2.7.1; a caller with legitimate access to the token-issuance path can repeatedly issue tokens without consuming the configured role-based rate-limit budget. This is a moderate-severity control bypass rather than an urgent emergency, and no public exploit was identified at the time of analysis; vendor patches are available in 2.6.4 and 2.7.1.
Functionality misuse in the Drupal Webform contributed module (versions 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1) lets remote, unauthenticated attackers circumvent interaction-frequency controls such as submission or rate limits on affected forms. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, score 5.3) limits impact to low integrity misuse with no confidentiality or availability effect, and exploitation requires that a deployed site actually use the affected frequency-control feature; the precise trigger is not described in the available sources. No public exploit is identified at time of analysis, EPSS is 0.15% (4th percentile), the vuln.today priority label is this_month, and a vendor patch is available.
Missing rate limiting in Jivejdon's unauthenticated /account/smsVRAction endpoint allows remote attackers to send unlimited SMS messages to arbitrary phone numbers, leading to harassment and depletion of the operator's Tencent Cloud SMS balance. Affected commits range from e0306088 through ee67a65e, and exploitation requires the instance to have Tencent Cloud SMS integration configured and funded; attackers must first load newAccount.jsp to set session attributes before repeatedly calling the endpoint. No public exploit code or active exploitation has been identified, and this is assessed as a medium-severity resource and financial abuse issue rather than a high-priority emergency.