Medium severity4.3NVD Advisory· Published Nov 11, 2026

CVE-2026-126784

Description

Missing rate limiting, per-account submission quota and geographic validation in the publicar_aviso RPC function in Lagarto Chivato 0.4.1 and earlier on Web allows remote authenticated attackers to flood the moderation queue via unlimited submission of notices with arbitrary coordinates.

Affected products

Lagarto/Chivatoinferred
Range: <=0.4.1
Lagarto Chivato/Lagarto Chivatollm-create
Range: <=0.4.1

Patches

Vulnerability mechanics

References

www.grayback.es/advisoriesnvd
www.grayback.es/en/advisoriesnvd

News mentions

No linked articles in our index yet.

cvss	0.280
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000