Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
In Totara LMS v19.1.5 and before, the forgot password API does not implement rate limiting for the target email address. which can be used for an Email Bombing attack. NOTE: the Supplier's position is that the pwresettime configuration defaults to 30 minutes, the pwresettime configuration is a hard control enforced via flag PWRESET_STATUS_ALREADYSENT, and no further password-reset email messages are sent if this flag is active for a specific email address.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-31283 In Totara LMS v19.1.5 and before, the forgot password API does not implement rate limiting for the target email address. which can be used for an Email Bombing attack. https://www.cve.org/CVERecord?id=CVE-2026-31283
Post summary
This post discloses a rate‑limiting flaw in the –Totara LMS forgotten‑password API that could allow attackers to perform email‑bombing attacks. No PoC, exploit code, or patch information is provided.
CVE-2026-31283 CVE-2026-31283 Description Forgot password can be used to luanch... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-31283 Customizable Vulnerability Alerts: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=4
Post summary
The tweet succinctly mentions CVE-2026-31283 with a vague description and a link to a detail page but lacks concrete technical or actionable information.