Monthly
Rate-limit bypass in the Wazuh server API (versions 4.6.0 up to but not including 4.14.5) lets an authenticated client inject events into analysisd beyond the administrator-configured global request cap. A logic error in CheckRateLimitsMiddleware.dispatch() makes the /events endpoint's hardcoded 30/min check overwrite the general max_request_per_minute result, so /events requests keep succeeding even after the global limit is exhausted. No public exploit identified at time of analysis; EPSS is low (0.21%, 12th percentile) and CISA SSVC records no known exploitation.
Resource flooding in MIA Technology Pizzy Library versions 1.0.0.26250 through 1.3.9.26250 allows authenticated remote attackers to abuse improper interaction frequency controls (CWE-799) to degrade availability and tamper with integrity. With a CVSS 3.1 base score of 7.1 and no public exploit identified at time of analysis, the flaw primarily threatens service availability in deployments that expose the library over the network. The advisory was coordinated through Turkey's TR-CERT, with no CISA KEV listing and no EPSS data provided.
Remote authenticated attackers can flood PDKS (Personnel and Document Tracking System) through uncontrolled interaction frequency, achieving high integrity and availability impacts without confidentiality breach. This workforce management software by MeWare Software Development Inc. is vulnerable to denial-of-service conditions and potential data integrity compromise through rate-limiting bypass. Affects versions from V16.20200313 through VMYR_3.5.2025117. TR-CERT advisory available, EPSS data not provided, no CISA KEV listing identified.
Parse Server versions prior to 9.5.2-alpha.10 and 8.6.23 allow remote attackers to bypass rate limiting protections by submitting multiple requests within a single batch request, since batch processing routes requests internally and circumvents Express middleware controls. Deployments relying on built-in rate limiting are vulnerable to abuse and denial of service attacks. A patch is available in the specified versions.
Fortinet FortiWeb versions 7.0 through 8.0.2 contain an improper rate-limiting flaw that allows unauthenticated remote attackers to bypass authentication attempt restrictions through crafted requests. This vulnerability enables attackers to conduct brute-force password attacks against FortiWeb instances with reduced constraints, with success dependent on attacker resources and target password complexity. No patch is currently available for affected versions.
CAPTCHA validation in phpMyFAQ before 4.1.8 is completely skipped when the `store` parameter is set to `now` in question submission requests, exposing any publicly accessible instance to unauthenticated spam automation. Attackers exploiting this bypass can flood the FAQ database with arbitrary question entries and force outbound email notifications to administrators for each submission. No public exploit code or active exploitation has been identified, but the bypass is trivially reproducible through a single parameter manipulation.
Rate limit bypass in Lemmy prior to 0.19.19 and 1.0.0-beta.1 allows unauthenticated remote attackers to circumvent all IP-based throttling by injecting a spoofed address as the first value of the X-Forwarded-For header. Because the bundled docker/nginx.conf forwards XFF headers using $proxy_add_x_forwarded_for rather than $remote_addr, attackers control the address that actix-web's ConnectionInfo::realip_remote_addr reads, receiving a fresh rate-limit bucket per request. No public exploit or CISA KEV listing exists, but exploitation is trivially automated and directly enables account registration spam, credential brute-forcing, comment spam, content scraping, bulk uploads, and repeated settings imports.
Denial of service in OpenClaw versions 2026.2.26 through pre-2026.3.31 allows unauthenticated remote attackers to exhaust the shared pending pairing-request window on multi-account channel deployments, blocking legitimate accounts from initiating new pairing or onboarding. The root flaw is a quota-scoping error: the cap on pending requests was enforced per channel file rather than per account, so one actor's requests consume capacity allocated to unrelated accounts. The GHSA advisory confirms this is an availability-only impact - no cross-account data access, approval, or authorization bypass is possible. No public exploit or CISA KEV listing exists; EPSS probability is 0.10%, reflecting minimal real-world exploitation pressure at time of analysis.
Resource exhaustion in OpenClaw npm package versions up to 2026.3.28 allows remote unauthenticated attackers to degrade availability of the LINE webhook integration by flooding the endpoint with concurrent requests before signature verification occurs. The CVSS 4.0 score of 6.9 reflects network-accessible, zero-privilege exploitation with bounded low availability impact; the vendor's own triage classifies severity as low due to the transient, non-persistent nature of the disruption. No public exploit code exists and no active exploitation is confirmed - SSVC marks exploitation status as none, though the attack is rated automatable.
Rate limiting bypass in OpenClaw's WebSocket gateway (npm package ≤ 2026.3.28) allows unauthenticated remote attackers to conduct unbounded brute-force attempts against shared-secret passwords by including a fake DeviceToken field in WebSocket handshake requests, suppressing the IP-based rate limiter. The maintainer's own triage classifies the practical risk as narrow, noting that only deployments relying on weak shared passwords face meaningful threat since high-entropy secrets remain non-bruteforceable regardless of rate limiting. No public exploit code exists, EPSS is 0.04%, and SSVC exploitation status is none - consistent with a low-priority patching target outside of weak-credential deployments.
Rate-limit bypass in the Wazuh server API (versions 4.6.0 up to but not including 4.14.5) lets an authenticated client inject events into analysisd beyond the administrator-configured global request cap. A logic error in CheckRateLimitsMiddleware.dispatch() makes the /events endpoint's hardcoded 30/min check overwrite the general max_request_per_minute result, so /events requests keep succeeding even after the global limit is exhausted. No public exploit identified at time of analysis; EPSS is low (0.21%, 12th percentile) and CISA SSVC records no known exploitation.
Resource flooding in MIA Technology Pizzy Library versions 1.0.0.26250 through 1.3.9.26250 allows authenticated remote attackers to abuse improper interaction frequency controls (CWE-799) to degrade availability and tamper with integrity. With a CVSS 3.1 base score of 7.1 and no public exploit identified at time of analysis, the flaw primarily threatens service availability in deployments that expose the library over the network. The advisory was coordinated through Turkey's TR-CERT, with no CISA KEV listing and no EPSS data provided.
Remote authenticated attackers can flood PDKS (Personnel and Document Tracking System) through uncontrolled interaction frequency, achieving high integrity and availability impacts without confidentiality breach. This workforce management software by MeWare Software Development Inc. is vulnerable to denial-of-service conditions and potential data integrity compromise through rate-limiting bypass. Affects versions from V16.20200313 through VMYR_3.5.2025117. TR-CERT advisory available, EPSS data not provided, no CISA KEV listing identified.
Parse Server versions prior to 9.5.2-alpha.10 and 8.6.23 allow remote attackers to bypass rate limiting protections by submitting multiple requests within a single batch request, since batch processing routes requests internally and circumvents Express middleware controls. Deployments relying on built-in rate limiting are vulnerable to abuse and denial of service attacks. A patch is available in the specified versions.
Fortinet FortiWeb versions 7.0 through 8.0.2 contain an improper rate-limiting flaw that allows unauthenticated remote attackers to bypass authentication attempt restrictions through crafted requests. This vulnerability enables attackers to conduct brute-force password attacks against FortiWeb instances with reduced constraints, with success dependent on attacker resources and target password complexity. No patch is currently available for affected versions.
CAPTCHA validation in phpMyFAQ before 4.1.8 is completely skipped when the `store` parameter is set to `now` in question submission requests, exposing any publicly accessible instance to unauthenticated spam automation. Attackers exploiting this bypass can flood the FAQ database with arbitrary question entries and force outbound email notifications to administrators for each submission. No public exploit code or active exploitation has been identified, but the bypass is trivially reproducible through a single parameter manipulation.
Rate limit bypass in Lemmy prior to 0.19.19 and 1.0.0-beta.1 allows unauthenticated remote attackers to circumvent all IP-based throttling by injecting a spoofed address as the first value of the X-Forwarded-For header. Because the bundled docker/nginx.conf forwards XFF headers using $proxy_add_x_forwarded_for rather than $remote_addr, attackers control the address that actix-web's ConnectionInfo::realip_remote_addr reads, receiving a fresh rate-limit bucket per request. No public exploit or CISA KEV listing exists, but exploitation is trivially automated and directly enables account registration spam, credential brute-forcing, comment spam, content scraping, bulk uploads, and repeated settings imports.
Denial of service in OpenClaw versions 2026.2.26 through pre-2026.3.31 allows unauthenticated remote attackers to exhaust the shared pending pairing-request window on multi-account channel deployments, blocking legitimate accounts from initiating new pairing or onboarding. The root flaw is a quota-scoping error: the cap on pending requests was enforced per channel file rather than per account, so one actor's requests consume capacity allocated to unrelated accounts. The GHSA advisory confirms this is an availability-only impact - no cross-account data access, approval, or authorization bypass is possible. No public exploit or CISA KEV listing exists; EPSS probability is 0.10%, reflecting minimal real-world exploitation pressure at time of analysis.
Resource exhaustion in OpenClaw npm package versions up to 2026.3.28 allows remote unauthenticated attackers to degrade availability of the LINE webhook integration by flooding the endpoint with concurrent requests before signature verification occurs. The CVSS 4.0 score of 6.9 reflects network-accessible, zero-privilege exploitation with bounded low availability impact; the vendor's own triage classifies severity as low due to the transient, non-persistent nature of the disruption. No public exploit code exists and no active exploitation is confirmed - SSVC marks exploitation status as none, though the attack is rated automatable.
Rate limiting bypass in OpenClaw's WebSocket gateway (npm package ≤ 2026.3.28) allows unauthenticated remote attackers to conduct unbounded brute-force attempts against shared-secret passwords by including a fake DeviceToken field in WebSocket handshake requests, suppressing the IP-based rate limiter. The maintainer's own triage classifies the practical risk as narrow, noting that only deployments relying on weak shared passwords face meaningful threat since high-entropy secrets remain non-bruteforceable regardless of rate limiting. No public exploit code exists, EPSS is 0.04%, and SSVC exploitation status is none - consistent with a low-priority patching target outside of weak-credential deployments.