CWE-799 · Input Validation and Logic
Improper Control of Interaction Frequency
63CVEs
SortMost likely exploited
63 CVEs with CWE-799 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2023-35621Microsoft Dynamics 365 Finance and Operations Denial of Service VulnerabilityMicrosoft · Dynamics 365 for Finance and Operations · CVSS 7.5 · 2023-12-12 | 7.5 | 2.3% | 2023-12-12 |
| CVE-2016-6543A captured MAC/device ID of an iTrack Easy can be registered under multiple user accounts allowing access to getgps GPS dataiTrack · Easy · 2018-07-13 | – | 2.1% | 2018-07-13 |
| CVE-2021-37910ASUS GT-AXE11000, RT-AX3000, RT-AX55, RT-AX58U, TUF-AX3000 - Improper AuthenticationASUS · GT-AXE11000 · CVSS 3.7 · 2021-11-12 | 3.7 | 2.1% | 2021-11-12 |
| CVE-2021-32705Lack of ratelimit on public DAV endpointnextcloud · security-advisories · CVSS 5.3 · 2021-07-12 | 5.3 | 1.7% | 2021-07-12 |
| CVE-2021-41177Rate-limits not working on instances without configured memory cache backendnextcloud · security-advisories · CVSS 8.1 · 2021-10-25 | 8.1 | 1.6% | 2021-10-25 |
| CVE-2021-32703Lack of ratelimit on shareinfo endpointnextcloud · security-advisories · CVSS 5.3 · 2021-07-12 | 5.3 | 1.5% | 2021-07-12 |
| CVE-2021-32678Ratelimit not applied on OCS API responsesnextcloud · security-advisories · CVSS 3.7 · 2021-07-12 | 3.7 | 1.4% | 2021-07-12 |
| CVE-2021-32741Lack of ratelimit on public share link mount endpointnextcloud · security-advisories · CVSS 5.3 · 2021-07-12 | 5.3 | 1.3% | 2021-07-12 |
| CVE-2020-5141A vulnerability in SonicOS allows a remote unauthenticated attacker to brute force Virtual Assist ticket ID in the firewall SSLVPN service. This vulnerability affected SonicOS Gen…SonicWall · SonicOS · 2020-10-12 | – | 1.2% | 2020-10-12 |
| CVE-2023-2758Contec CONPROSYS HMI System (CHS) v3.5.2 Denial of ServiceContec · CONPROSYS HMI System · CVSS 3.7 · 2023-05-31 | 3.7 | 1.0% | 2023-05-31 |
| CVE-2026-24017An Improper Control of Interaction Frequency vulnerability [CWE-799] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7…Fortinet · FortiWeb · CVSS 7.3 · 2026-03-10 | 7.3 | 0.9% | 2026-03-10 |
| CVE-2024-34695WOWS Karma vulnerable to a post submission bounce/timing attackSakuraIsayeki · WOWS-Karma · CVSS 6.3 · 2024-05-10 | 6.3 | 0.8% | 2024-05-10 |
| CVE-2023-27279IBM Aspera Faspex denial of serviceIBM · Aspera Faspex · CVSS 6.5 · 2024-04-19 | 6.5 | 0.7% | 2024-04-19 |
| CVE-2026-54738Lemmy: Rate limit bypass via X-Forwarded-For header spoofing in actix-web ConnectionInfoLemmyNet · lemmy · CVSS 6.5 · 2026-08-19 | 6.5 | 0.6% | 2026-08-19 |
| CVE-2023-38068In JetBrains YouTrack before 2023.1.16597 captcha was not properly validated for Helpdesk formsJetBrains · YouTrack · CVSS 6.5 · 2023-07-12 | 6.5 | 0.5% | 2023-07-12 |
| CVE-2025-54321In Ascertia SigningHub through 8.6.8, there is a lack of rate limiting on the reset password function, leading to an email bombing vulnerability. An authenticated attacker can exp…Ascertia · Signinghub · CVSS 9.8 · 2025-11-18 | 9.8 | 0.5% | 2025-11-18 |
| CVE-2024-45788No Rate Limiting VulnerabilityReedos Software Solutions · Mutual Fund Distribution Product (aiM-Star) · CVSS 8.7 · 2024-09-11 | 8.7 | 0.5% | 2024-09-11 |
| CVE-2026-85586phpMyFAQ before 4.1.8 CAPTCHA Bypass via store parameterthorsten · phpMyFAQ · CVSS 6.9 · 2026-09-04 | 6.9 | 0.5% | 2026-09-04 |
| CVE-2024-47654No Rate Limiting vulnerabilityShilpi Computers · Client Dashboard · CVSS 7.1 · 2024-10-04 | 7.1 | 0.5% | 2024-10-04 |
| CVE-2024-35246Westermo L210-F2G Lynx Improper Control of Interaction FrequencyWestermo · L210-F2G Lynx · CVSS 7.5 · 2024-06-20 | 7.5 | 0.5% | 2024-06-20 |
| CVE-2024-32943Westermo L210-F2G Lynx Improper Control of Interaction FrequencyWestermo · L210-F2G Lynx · CVSS 7.5 · 2024-06-20 | 7.5 | 0.5% | 2024-06-20 |
| CVE-2024-51557No Rate Limiting Vulnerability in Wave 2.0Brokerage Technology Solutions · Wave 2.0 · CVSS 7.1 · 2024-11-04 | 7.1 | 0.5% | 2024-11-04 |
| CVE-2026-41343OpenClaw < 2026.3.31 - Denial of Service via LINE Webhook Handler Pre-Auth ConcurrencyOpenClaw · OpenClaw · CVSS 5.3 · 2026-04-23 | 5.3 | 0.5% | 2026-04-23 |
| CVE-2024-48942The Syracom Secure Login (2FA) plugin for Jira, Confluence, and Bitbucket through 3.1.4.5 allows remote attackers to easily brute-force the 2FA PIN via the plugins/servlet/twofact…Syracom · Secure Login · CVSS 9.1 · 2024-10-09 | 9.1 | 0.5% | 2024-10-09 |
| CVE-2025-57816Fides Webserver API Rate Limiting Vulnerability in Proxied Environmentsethyca · fides · CVSS 6.3 · 2025-09-08 | 6.3 | 0.5% | 2025-09-08 |
| CVE-2026-54594OmniBlocks: Spamming in Discussions tab possible via disc.ymlOmniBlocks · monorepo · CVSS 5.3 · 2026-09-17 | 5.3 | 0.5% | 2026-09-17 |
| CVE-2025-26524No Rate Limiting Vulnerability in RupeeWeb trading platformRupeeseed Technology Ventures · RupeeWeb · CVSS 5.1 · 2025-02-14 | 5.1 | 0.4% | 2025-02-14 |
| CVE-2024-57603An issue in MaysWind ezBookkeeping 0.7.0 allows a remote attacker to escalate privileges via the lack of rate limiting.Mayswind · Ezbookkeeping · CVSS 6.3 · 2025-02-12 | 6.3 | 0.4% | 2025-02-12 |
| CVE-2023-40332WordPress WP-PostRatings plugin <= 1.91 - Rating limit Bypass vulnerabilityLester ‘GaMerZ’ Chan · WP-PostRatings · CVSS 5.3 · 2024-06-04 | 5.3 | 0.4% | 2024-06-04 |
| CVE-2025-13882Multiple Security Vulnerabilities in IBM Sterling Partner Engagement Manager.IBM · Sterling Partner Engagement Manager Essentials Edition · CVSS 5.3 · 2026-09-18 | 5.3 | 0.4% | 2026-09-18 |
| CVE-2024-24873WordPress Polls CP plugin <= 1.0.71 - Polls Limitation Bypass vulnerabilityCodePeople · CP Polls · CVSS 5.3 · 2024-05-17 | 5.3 | 0.4% | 2024-05-17 |
| CVE-2026-41346OpenClaw 2026.2.26 < 2026.3.31 - Denial of Service via Improper Pending Pairing Request Cap EnforcementOpenClaw · OpenClaw · CVSS 5.3 · 2026-04-23 | 5.3 | 0.4% | 2026-04-23 |
| CVE-2024-23565HCL Aftermarket EPC is vulnerable to email flooding as the application does not have a proper mail limitation mechanism at Forget Password functionality. The actor could b e a hum…HCLSoftware · Aftermarket EPC · CVSS 5.3 · 2026-07-17 | 5.3 | 0.4% | 2026-07-17 |
| CVE-2026-33434Wazuh: Rate Limit Bypass via /events Endpointwazuh · wazuh · CVSS 4.3 · 2026-07-16 | 4.3 | 0.4% | 2026-07-16 |
| CVE-2026-30972Parse Server has a rate limit bypass via batch request endpointparse-community · parse-server · CVSS 6.9 · 2026-03-10 | 6.9 | 0.4% | 2026-03-10 |
| CVE-2023-40673WordPress Cartpauj Register Captcha plugin <= 1.0.02 - Captcha Bypass vulnerabilitycartpauj · Cartpauj Register Captcha · CVSS 6.5 · 2024-06-04 | 6.5 | 0.4% | 2024-06-04 |
| CVE-2026-41333OpenClaw < 2026.3.31 - Authentication Rate Limiting Bypass via Fake DeviceTokenOpenClaw · OpenClaw · CVSS 3.7 · 2026-04-23 | 3.7 | 0.4% | 2026-04-23 |
| CVE-2025-29998No Rate Limiting Vulnerability in CAP back office applicationRising Technosoft · CAP back office application · CVSS 8.2 · 2025-03-13 | 8.2 | 0.4% | 2025-03-13 |
| CVE-2026-107830Jivejdon through commit ee67a65e Missing Rate Limiting via /account/smsVRAction SMS Endpointbanq · jivejdon · CVSS 5.3 · 2026-10-08 | 5.3 | 0.4% | 2026-10-08 |
| CVE-2021-37191A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). An unauthenticated attacker in the same network of the affected system could brute f…Siemens · SINEMA Remote Connect Server · CVSS 4.3 · 2021-09-14 | 4.3 | 0.4% | 2021-09-14 |
| CVE-2025-13211IBM Aspera Orchestrator Denial of ServiceIBM · Aspera Orchestrator · CVSS 5.3 · 2025-12-11 | 5.3 | 0.4% | 2025-12-11 |
| CVE-2026-7402Improper Rate Limiting in MeWare Software's PDKSMeWare Software Development Inc. · PDKS · CVSS 8.1 · 2026-04-30 | 8.1 | 0.4% | 2026-04-30 |
| CVE-2024-13274Open Social - Moderately critical - Denial of Service - SA-CONTRIB-2024-038Drupal · Open Social · CVSS 5.3 · 2025-01-09 | 5.3 | 0.4% | 2025-01-09 |
| CVE-2025-52570Letmein connection limiter allows an arbitrary amount of simultaneous connectionsmbuesch · letmein · CVSS 1.7 · 2025-06-24 | 1.7 | 0.4% | 2025-06-24 |
| CVE-2026-22216wpDiscuz before 7.6.47 - No Rate Limiting on Subscription Endpoints with LIKE Wildcard BypassgVectors · wpDiscuz · CVSS 6.5 · 2026-03-13 | 6.5 | 0.4% | 2026-03-13 |
| CVE-2025-36045TS4300 Tape Library addresses security vulnerabilityIBM · TS4300 · CVSS 4.3 · 2026-09-18 | 4.3 | 0.4% | 2026-09-18 |
| CVE-2023-51544WordPress RegistrationMagic plugin <= 5.2.5.0 - Form Submission Limit Bypass vulnerabilityMetagauss · RegistrationMagic · CVSS 5.3 · 2024-06-04 | 5.3 | 0.3% | 2024-06-04 |
| CVE-2025-52880Komga Vulnerable to Arbitrary Code Execution via Crafted EPUB Filegotson · komga · CVSS 4.2 · 2025-06-24 | 4.2 | 0.3% | 2025-06-24 |
| CVE-2024-9199Rate limit vulnerability in Clibo ManagerClibo Manager · Clibo Manager · CVSS 5.8 · 2024-09-26 | 5.8 | 0.3% | 2024-09-26 |
| CVE-2025-32378Shopware's default newsletter opt-in settings allow for mass sign-up abuseshopware · shopware · CVSS 6.9 · 2025-04-09 | 6.9 | 0.3% | 2025-04-09 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.