CVE-2024-34535

In Mastodon 4.1.6, API endpoint rate limiting can be bypassed by setting a crafted HTTP request header...

CVE-2023-45148

Nextcloud is an open source home cloud server. When Memcached is used as memcache.distributed the rate limiting in Nextcloud Server could be reset unexpectedly resetting the rate count earlier than intended. Users are advised to upgrade to versions 25.0.11, 26.0.6 or 27.1.0. Users unable to upgra...

CVE-2022-35925

BookWyrm is a social network for tracking reading. Versions prior to 0.4.5 were found to lack rate limiting on authentication views which allows brute-force attacks. This issue has been patched in version 0.4.5. Admins with existing instances will need to update their nginx.conf file that was...

CVE-2023-43650

JumpServer is an open source bastion host. The verification code for resetting user's password is vulnerable to brute-force attacks due to the absence of rate limiting. JumpServer provides a feature allowing users to reset forgotten passwords. Affected users are sent a 6-digit verification code,...

Shiori 安全漏洞

Shiori is a bookmark manager from Shiori open source. A security vulnerability exists in Shiori 1.7.4 and earlier versions, which stems from a lack of rate limiting on the login page and could allow an attacker to bypass authentication via brute force attack...

CVE-2025-60538

The CVE concerns shiori, affected in v1.7.4 and earlier, where the login page lacks rate limiting, enabling brute-force attempts to bypass authentication. The root cause is insufficient restrictions on login attempts, allowing unauthorized access under the Attack Vector: Network with low complexi...

CVE-2025-60538

A lack of rate limiting in the login page of shiori v1.7.4 and below allows attackers to bypass authentication via a brute force attack...

PT-2026-1823

Name of the Vulnerable Software and Affected Versions shiori versions 1.7.4 and below Description A missing rate limit on the login page allows attackers to bypass authentication through brute-force attempts. The affected component is the login functionality, specifically the authentication...

CVE-2025-60538

A lack of rate limiting in the login page of shiori v1.7.4 and below allows attackers to bypass authentication via a brute force attack...

CVE-2025-60538

A lack of rate limiting in the login page of shiori v1.7.4 and below allows attackers to bypass authentication via a brute force attack...

CVE-2025-50334

An issue in Technitium DNS Server v.13.5 allows a remote attacker to cause a denial of service via the rate-limiting component...

CVE-2025-50334

An issue in Technitium DNS Server v.13.5 allows a remote attacker to cause a denial of service via the rate-limiting component...

CVE-2025-50334

An issue in Technitium DNS Server v.13.5 allows a remote attacker to cause a denial of service via the rate-limiting component...

PT-2026-1811

Name of the Vulnerable Software and Affected Versions Technitium DNS Server version 13.5 Description An issue exists in the rate-limiting component of the software that allows a remote attacker to cause a denial of service. This impacts DNS service availability. Recommendations At the moment, the...

GL.iNet AX1800 安全漏洞

The GL.iNet AX1800 is a wireless router from China's Guanglian Intelligent Communication GL.iNet. A security vulnerability exists in the GL.iNet AX1800 version 4.6.4 and 4.6.8, which stems from a lack of rate limiting or account locking mechanism in the authenticated endpoints, which could lead t...

CVE-2025-50334

An issue in Technitium DNS Server v.13.5 allows a remote attacker to cause a denial of service via the rate-limiting component...

CVE-2025-50334

CVE-2025-50334 affects Technitium DNS Server v13.5, where the rate‑limiting component can be abused by a remote attacker to cause a denial of service. The available connected documents describe the issue as stemming from improper handling within the rate‑limiting logic, impacting DNS service avai...

Technitium DNS Server 安全漏洞

Technitium DNS Server is an open source authoritative and recursive DNS server from the Technitium team. It can be used to self-host DNS servers for privacy and security. A security vulnerability exists in Technitium DNS Server version 13.5 that stems from improper handling of the rate limiting...

CVE-2025-67090

GL.iNet AX1800 devices running firmware 4.6.4 or 4.6.8 are affected by CVE-2025-67090 due to lack of rate limiting or account lockout on the LuCI authentication endpoint (/cgi-bin/luci). This allows an unauthenticated attacker on the local network to perform unlimited password attempts against th...

CVE-2025-66838

In Aris v10.0.23.0.3587512 and before, the file upload functionality does not enforce any rate limiting or throttling, allowing users to upload files at an unrestricted rate. An attacker can exploit this behavior to rapidly upload a large volume of files, potentially leading to resource exhaustio...