CVE-2026-92003

MISP (versions ≤2.5.45) contains an unthrottled authentication-failure logging flaw. Two API authentication-failure branches—requests with no authentication key and requests with an API key of incorrect length —wrote directly to the Log model, bypassing the _shouldLog() throttle used by other fai...

PT-2026-91940

Affected versions of MISP do not consistently apply the existing authentication-failure logging throttle. Two API authentication failure branches wrote directly to the Log model: - API requests with no authentication key; - requests supplying an API key with an incorrect length Unlike other...

CVE-2026-48082 OpenReception's bootstrap challenge proof-of-work difficulty hardcoded to 16 bits, which enables abuse rate amplification

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.6, the bootstrap challenge endpoint at /api/tenants/id/appointments/bootstrap-challenge issues a SHA-256 proof-of-work with difficulty=4 hex zeros, equivalent to 16 bit...

CVE-2026-48082

OpenReception’s OpenReception appointment-booking software before v1.0.6 uses a bootstrap-challenge PoW endpoint (/api/tenants/{id}/appointments/bootstrap-challenge) that requires SHA-256 with difficulty=4 hex zeros (≈16 bits). Modern hardware solves this quickly, undermining rate-limiting for un...

SUSE CVE-2025-38063

In the Linux kernel, the following vulnerability has been resolved: dm: fix unconditional IO throttle caused by REQPREFLUSH When a bio with REQPREFLUSH is submitted to dm, sendemptyflush generates a flushbio with REQOPWRITE | REQPREFLUSH | REQSYNC, which causes the flushbio to be throttled by...

Shopify: Bypass a fix for report #708013

Summary: customerAccessTokenCreate mutation in the Storefront API does not correctly throttle login attempts. An issue in similar report https://hackerone.com/reports/708013 was already fixed, however, there is still a bypass. Steps To Reproduce: 1. Grab a Storefront API Token I got it from the B...

WordPress Wordfence Plugin <= 5.2.3 - Multiple Vulnerabilities

This plugin is prone to stored XSS, insufficient logging, throttle bypass and exploit detection bypass vulnerabilities. Solution Update plugin...