WordPress wpForo Forum plugin 3.0.0-3.1.5 - Unauthenticated AI Credit Exhaustion via IP Rate Limit Bypass vulnerability

Unauthenticated AI Credit Exhaustion via IP Rate Limit Bypass vulnerability discovered by Usama Arshad in WordPress Plugin wpForo Forum versions 3.0.0-3.1.5...

CVE-2026-80514

The wpForo Forum WordPress plugin from 3.0.0 before 3.1.6 does not verify the source of client-supplied IP address headers before using them to key its per-visitor rate limit on paid AI requests, allowing unauthenticated attackers to bypass the limit by spoofing the header and exhaust the site...

CVE-2026-80514

The wpForo Forum WordPress plugin (versions 3.0.0 through 3.1.5 ) is vulnerable to unauthenticated AI credit exhaustion . The root cause is a failure to verify the source of client-supplied IP address headers, which are used to key the per-visitor rate limit on paid AI requests. An attacker can b...

CVE-2026-80514 wpForo Forum 3.0.0 - 3.1.5 - Unauthenticated AI Credit Exhaustion via IP Rate Limit Bypass

The wpForo Forum WordPress plugin from 3.0.0 before 3.1.6 does not verify the source of client-supplied IP address headers before using them to key its per-visitor rate limit on paid AI requests, allowing unauthenticated attackers to bypass the limit by spoofing the header and exhaust the site...

EUVD-2026-86626

The wpForo Forum WordPress plugin from 3.0.0 before 3.1.6 does not verify the source of client-supplied IP address headers before using them to key its per-visitor rate limit on paid AI requests, allowing unauthenticated attackers to bypass the limit by spoofing the header and exhaust the site...

CVE-2026-80514 wpForo Forum 3.0.0 - 3.1.5 - Unauthenticated AI Credit Exhaustion via IP Rate Limit Bypass

The wpForo Forum WordPress plugin from 3.0.0 before 3.1.6 does not verify the source of client-supplied IP address headers before using them to key its per-visitor rate limit on paid AI requests, allowing unauthenticated attackers to bypass the limit by spoofing the header and exhaust the site...

CVE-2026-97764

django-allauth before 65.19.4 does not have the expected limits on failed login attempts because, in some common configurations, an attacker can leverage the handling of diacritics e.g., accents for a higher effective limit...

CLEANSTART-2026-JF16968 Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures

CVE-2026-33818 affects multiple packages. Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures. See references for individual vulnerability details...

PT-2026-98417

Name of the Vulnerable Software and Affected Versions wpForo Forum WordPress plugin versions 3.0.0 through 3.1.5 Description The plugin fails to verify the source of client-supplied IP address headers used to key the per-visitor rate limit for paid AI requests. This allows unauthenticated attacke...

Linux Distros Unpatched Vulnerability : CVE-2026-98126

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb/client: validate new EOF for zero range When FALLOCFLZERORANGE is used without FALLOCFLKEEPSIZE, smb3zerorange may extend EOF without checking RLIMITFSIZE,...

CVE-2026-98126

In the Linux kernel, the following vulnerability has been resolved: smb/client: validate new EOF for zero range When FALLOCFLZERORANGE is used without FALLOCFLKEEPSIZE, smb3zerorange may extend EOF without checking RLIMITFSIZE, allowing the file to grow beyond the caller's file-size limit. Fix th...

VulnCheck KEV: CVE-2026-93622

Unauthenticated Cross Site Scripting XSS in WPS Limit Login = 1.5.9.3 versions...

CVE-2026-80514: Use of Less Trusted Source

The wpForo Forum WordPress plugin from 3.0.0 before 3.1.6 does not verify the source of client-supplied IP address headers before using them to key its per-visitor rate limit on paid AI requests, allowing unauthenticated attackers to bypass the limit by spoofing the header and exhaust the site...

Oracle Linux 9 : perl-DBI (ELSA-2026-71422)

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-71422 advisory. 1.643-9.6 - Force placeholder limit on : and :p too CVE-2026-73194 Related: RHEL-247327 Tenable has extracted the preceding description block directly from the...

SUSE CVE-2026-66067

RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, The stream open handler calls only checkvhostaccess; it omits the node/vhost/user connection-limit checks that rabbitreader performs for AMQP. A developer %% FIXME comment at the cited line explicitly acknowledges th...

AZL-103559 CVE-2026-93240 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: memcg: make the v1 soft limit knob inert The v1 soft limit has been deprecated since v6.12 and nobody has reported depending on it. Start the removal by decoupling the interface from the implementation: keep...

DEBIAN-CVE-2026-93240

In the Linux kernel, the following vulnerability has been resolved: memcg: make the v1 soft limit knob inert The v1 soft limit has been deprecated since v6.12 and nobody has reported depending on it. Start the removal by decoupling the interface from the implementation: keep...

CVE-2026-93240

In the Linux kernel, the following vulnerability has been resolved: memcg: make the v1 soft limit knob inert The v1 soft limit has been deprecated since v6.12 and nobody has reported depending on it. Start the removal by decoupling the interface from the implementation: keep...

UBUNTU-CVE-2026-93240

In the Linux kernel, the following vulnerability has been resolved: memcg: make the v1 soft limit knob inert The v1 soft limit has been deprecated since v6.12 and nobody has reported depending on it. Start the removal by decoupling the interface from the implementation: keep...

CVE-2026-93240

The Linux kernel includes a fix for the memcg subsystem to make the v1 soft limit knob inert. The v1 soft limit was deprecated in version v6.12 ; the update decouples the interface from the implementation by ignoring writes to memory.soft_limit_in_bytes and reporting the maximum value on read. Th...