Threats Tagged 'cwe-799'

CVE-2026-82924 is an Improper Control of Interaction Frequency vulnerability in Expert Mail by Pusula Communication, IT, and Internet Industry and Trade Co. Ltd. This flaw allows brute force attacks due to insufficient rate limiting or interaction control. The vulnerability has a CVSS 3.1 base score of 5.3 (medium severity), indicating network attack vector, low attack complexity, no privileges or user interaction required, and limited confidentiality impact. It affects Expert Mail versions up to 2026-09-18. No patch or remediation information is currently provided.

CVE-2026-82924 is an improper control of interaction frequency vulnerability in Expert Mail by Pusula Communication, IT, and Internet Industry and Trade Co. Ltd. This flaw allows brute force attacks due to insufficient rate limiting or interaction controls. The vulnerability affects versions of Expert Mail up to and including 2026-09-18. It has a medium severity with a CVSS score of 5.3, indicating limited confidentiality impact and no integrity or availability impact.

Unauthenticated Broken Access Control in WP Event Solution <= 4.1.25 versions.

IBM TS4300 1.1.0.1 through 1.7.1.1 could allow an authenticated user to cause a denial of service in the email service due to improper control of interaction frequency.

IBM Sterling Partner Engagement Manager Essentials Edition 6.3.0.0 through 6.3.0.2, and 6.2.4.0 through 6.2.4.4 and IBM Sterling Partner Engagement Manager Standard Edition 6.2.4.0 through 6.2.4.4 could allow an unauthenticated user to cause a denial of service in the email service due to improper control of interaction frequency.

CVE-2026-54594 is a medium severity vulnerability in the OmniBlocks monorepo related to improper control of interaction frequency. Before a workflow remediation on June 6, 2026, the GitHub Actions workflow disc.yml triggered the createDiscussion mutation multiple times for the same issue when it was classified as off-topic. This occurred because the workflow did not track whether an issue had already been converted, allowing repeated edits to cause multiple discussions to be created, resulting in discussion spam and increased moderation workload. The issue was fixed by a specific commit that addressed this behavior.

CVE-2026-54738 is a vulnerability in LemmyNet's lemmy software related to improper control of interaction frequency. It allows unauthenticated attackers to bypass rate limiting by spoofing the client IP address in the X-Forwarded-For header. This affects multiple API endpoints including account registration, login, posting, commenting, searching, image uploading, and account import. The issue is fixed in versions 0.19.19 and 1.0.0-beta.1.

A vulnerability was found in VictoriaMetrics up to 1.146.0. Impacted is the function requestHandler of the file app/vmauth/main.go of the component VMAuth Authentication Endpoint. Performing a manipulation results in improper restriction of excessive authentication attempts. The attack is possible to be carried out remotely. The complexity of an attack is rather high. The exploitability is considered difficult. The exploit has been made public and could be used. Upgrading to version 1.147.0 is recommended to address this issue. The patch is named 119ba0fb5be8024d50c5ba946599b2e69e8803ea. Upgrading the affected component is recommended.

A vulnerability has been found in mangroup dtale up to 3.22.0. This issue affects the function Login of the file dtale/auth.py of the component Login Endpoint. Such manipulation leads to improper restriction of excessive authentication attempts. The attack can be executed remotely. This attack is characterized by high complexity. The exploitability is assessed as difficult. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

HCL Aftermarket EPC is vulnerable to email flooding as the application does not have a proper mail limitation mechanism at Forget Password functionality. The actor could b e a human or an automated process such as a virus or bot. This could be used to cause a denial of service, compromise program logic or other consequences.