CVEs published October 15, 2025
187 CVEs were published on October 15, 2025: 15 critical, 83 high. 1 is now in CISA KEV.
- Published
- 187
- Critical
- 15
- High
- 83
- Medium
- 75
- Low
- 5
- Unrated
- 9
- Now in CISA KEV
- 1
- Fix available
- 95
Most affected products
- Linux
- 34
- F5 BIG-IP
- 32
- Adobe Animate
- 4
- F5OS - Appliance · F5OS - Chassis
- 4
- Eclipse Foundation NetX Duo
- 3
- F5 BIG-IP Next SPK · F5 BIG-IP Next CNF +1
- 3
- Adobe Bridge
- 2
- Apple macOS
- 2
- Cisco Session Initiation Protocol (SIP) Software
- 2
- Eclipse Foundation ThreadX
- 2
Critical 15
- CVE-2025-11832APIs Lack Rate LimitingAzure Access Technology BLU-IC2 · Azure Access Technology B…
- CVE-2025-62410--disallow-code-generation-from-strings is not sufficient for isolating untrusted JavaScript in happy-domcapricorn86 happy-dom · happy-dom
- CVE-2025-53521BigIP APM VulnerabilityF5 BIG-IP
- CVE-2025-10294OwnID Passwordless Login <= 1.3.4 - Authentication Bypassvictornavarro OwnID Passwordless Login
- CVE-2025-9967Orion SMS OTP Verification <= 1.1.7 - Authentication Bypass via Account Takeovergsayed786 Orion SMS OTP Verification.
- CVE-2025-10041Flex QR Code Generator <= 1.2.5 - Unauthenticated Arbitrary File Uploadajitdas Flex QR Code Generator
- CVE-2025-39975smb: client: fix wrong index reference in smb2_compound_op()Linux
- CVE-2023-7305SmartBI RMIServlet Unrestricted File Upload RCEGuangzhou Smart Software Co. SmartBI
- CVE-2011-10033WordPress Plugin is-human <= v1.4.2 Eval Injection RCEis-human WordPress Plugin
- CVE-2018-25117VestaCP Debian Installer Malicious Backdoor Supply Chain CompromiseVesta Control Panel
- CVE-2017-20205Valve Source SDK Stack-Based Buffer Overflow RCEValve Software Source SDK
- CVE-2023-7304Ruijie RG-UAC nmc_sync.php Command InjectionRuijie Networks Co. RG-UAC
- CVE-2017-20204DBLTek GoIP Telnet Admin Interface Undocumented BackdoorDBL Technology (DBLTek) GoIP
- CVE-2023-7311BYTEVALUE Intelligent Flow Control Router Command InjectionBYTEVALUE (Luoyang Baiwei Intelligent Technology Co., Ltd.)…
- CVE-2025-56749Creativeitem Academy LMS up to and including 6.14 uses a hardcoded default JWT secret for token signing.
High 83
- CVE-2025-43281The issue was addressed with improved authentication.Apple macOS
- CVE-2025-11619Improper certificate validation when connecting to gateways in Devolutions Server 2025.3.2 and earlier allows attackers in MitM position to Devolutions Server
- CVE-2025-62371OpenSearch Data Prepper plugins trusts all SSL certificates by defaultopensearch-project data-prepper · org.opensearch.datapreppe…
- CVE-2025-62381sveltekit-superforms Prototype Pollution in `parseFormData` function of `formData.js`ciscoheat sveltekit-superforms · sveltekit-superforms
- CVE-2025-62382Frigate Vulnerable to Arbitrary File Read via Export Thumbnail "image_path" parameterblakeblackshear frigate
- CVE-2025-10577Sound Research SECOMNService Escalation of PrivilegeHP Sound Research
- CVE-2025-10576Sound Research SECOMNService Escalation of PrivilegeHP Sound Research
- CVE-2025-20350Cisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 with SIP Firmware Denial of Service VulnerabilityCisco Session Initiation Protocol (SIP) Software
- CVE-2025-62370Alloy Core has a DoS vulnerability on `alloy_dyn_abi::TypedData` hashingalloy-rs core · alloy-dyn-abi
- CVE-2025-61990TMM vulnerabilityF5 BIG-IP
- CVE-2025-57780F5OS VulnerabilityF5OS - Appliance · F5OS - Chassis
- CVE-2025-58071BIG-IP IPSec vulnerabilityF5 BIG-IP
- CVE-2025-61935BIG-IP Advanced WAF and ASM vulnerabilityF5 BIG-IP
- CVE-2025-10581A potential DLL hijacking vulnerability was discovered in the Lenovo PC Manager during an internal security assessment that could allow a loLenovo PC Manager
- CVE-2025-8486A potential vulnerability was reported in PC Manager that could allow a local authenticated user to execute code with elevated privileges.Lenovo PC Manager
- CVE-2025-61974BIG-IP SSL/TLS vulnerabilityF5 BIG-IP
- CVE-2025-59481BIG-IP iControl REST and tmsh vulnerabilityF5 BIG-IP
- CVE-2025-61960BIG-IP APM portal access vulnerabilityF5 BIG-IP
- CVE-2025-61955F5OS vulnerabilityF5OS - Appliance · F5OS - Chassis
- CVE-2025-54854BigIP APM VulnerabilityF5 BIG-IP
- CVE-2025-61958BIG-IP TMSH vulnerabilityF5 BIG-IP
- CVE-2025-58096BIG-IP TMM vulnerabilityF5 BIG-IP
- CVE-2025-54858BIG-IP Advanced WAF and ASM vulnerabilityF5 BIG-IP
- CVE-2025-53868BIG-IP SCP and SFTP vulnerabilityF5 BIG-IP
- CVE-2025-58120BIG-IP Next (CNF, SPK, and Kubernetes) vulnerabilityF5 BIG-IP Next SPK · F5 BIG-IP Next CNF +1
- CVE-2025-61951BIG-IP DTLS 1.2 VulnerabilityF5 BIG-IP
- CVE-2025-53856TMM vulnerabilityF5 BIG-IP
- CVE-2025-54479BIG-IP PEM vulnerabilityF5 BIG-IP
- CVE-2025-59778VELOS partition container network vulnerabilityF5OS - Chassis
- CVE-2025-41430BIG-IP SSL Orchestrator vulnerabilityF5 BIG-IP · F5 SSL Orchestrator
- CVE-2025-61938BIG-IP Advanced WAF and ASM bd process vulnerabilityF5 BIG-IP
- CVE-2025-55036BIG-IP SSL Orchestrator vulnerabilityF5 BIG-IP
- CVE-2025-59781BIG-IP DNS cache vulnerabilityF5 BIG-IP
- CVE-2025-46706BIG-IP iRules vulnerabilityF5 BIG-IP
- CVE-2025-55669BIG-IP HTTP/2 vulnerabilityF5 BIG-IP
- CVE-2025-48008BIG-IP MPTCP vulnerabilityF5 BIG-IP
- CVE-2025-60016BIG-IP SSL/TLS vulnerabilityF5 BIG-IP
- CVE-2025-59478BIG-IP AFM DoS protection profile vulnerabilityF5 BIG-IP
- CVE-2025-53474BIG-IP iRules vulnerabilityF5 BIG-IP
- CVE-2025-10313Find And Replace content for WordPress <= 1.1 - Missing Authorization to Unauthenticated Stored Cross-Site Scriptingjankimoradiya Find And Replace content for WordPress
- CVE-2025-10743Outdoor <= 1.3.2 - Unauthenticated SQL Injectionmaycorolbuche1 Outdoor
- CVE-2025-11722Category and Products Accordion Panel <= 1.0 - Authenticated (Contributor+) Local File Inclusionikhodal Woocommerce Category and Products Accordion Panel
- CVE-2025-10299WPBifröst – Instant Passwordless Temporary Login Links <= 1.0.7 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalationhakik Bifröst – Instant Passwordless Temporary Login Links
- CVE-2025-11177External Login <= 1.11.2 - Unauthenticated SQL Injection via logtbenyon External Login
- CVE-2025-10051Demo Import Kit <= 1.1.0 - Authenticated (Admin+) Arbitrary File Uploadthemeinwp Demo Import Kit
- CVE-2025-10293Keyy Two Factor Authentication (like Clef) <= 1.2.3 - Authenticated (Subscriber+) Privilege Escalation via Account Takeovernexist Keyy Two Factor Authentication
- CVE-2025-10754DocoDoco Store Locator <= 1.0.1 - Authenticated (Editor+) Arbitrary File Uploadgeolocationtechnology DocoDoco Store Locator
- CVE-2025-40000wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait()Linux
- CVE-2025-39998scsi: target: target_core_configfs: Add length check to avoid buffer overflowLinux
- CVE-2025-39994media: tuner: xc5000: Fix use-after-free in xc5000_releaseLinux
- CVE-2025-39993media: rc: fix races with imon_disconnect()Linux
- CVE-2025-39990bpf: Check the helper function is valid in get_helper_protoLinux
- CVE-2025-39988can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflowLinux
- CVE-2025-39987can: hi311x: populate ndo_change_mtu() to prevent buffer overflowLinux
- CVE-2025-39986can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflowLinux
- CVE-2025-39985can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflowLinux
- CVE-2025-39983Bluetooth: hci_event: Fix UAF in hci_conn_tx_dequeueLinux
- CVE-2025-39982Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_syncLinux
- CVE-2025-39981Bluetooth: MGMT: Fix possible UAFsLinux
- CVE-2025-39979net/mlx5: fs, fix UAF in flow counter releaseLinux
- CVE-2025-39978octeontx2-pf: Fix potential use after free in otx2_tc_add_flow()Linux
- CVE-2025-39977futex: Prevent use-after-free during requeue-PILinux
- CVE-2025-39976futex: Use correct exit on failure from futex_hash_allocate_default()Linux
- CVE-2025-39973i40e: add validation for ring_len paramLinux
- CVE-2025-39972i40e: fix idx validation in i40e_validate_queue_mapLinux
- CVE-2025-39971i40e: fix idx validation in config queues msgLinux
- CVE-2025-39970i40e: fix input validation logic for action_metaLinux
- CVE-2025-39969i40e: fix validation of VF state in get resourcesLinux
- CVE-2025-39968i40e: add max boundary check for VF filtersLinux
- CVE-2025-39967fbcon: fix integer overflow in fbcon_do_set_fontLinux
- CVE-2025-39966iommufd: Fix race during abort for file descriptorsLinux
- CVE-2025-61941A path traversal issue exists in WXR9300BE6P series firmware versions prior to Ver.1.10.BUFFALO WXR9300BE6P series
- CVE-2025-11501Dynamically Display Posts <= 1.1 - Unauthenticated SQL Injectionmarkomaksym Dynamically Display Posts
- CVE-2025-26861RemoteCall Remote Support Program (for Operator) versions prior to 5.3.0 contain an uncontrolled search path element vulnerability.RSUPPORT CO. RemoteCall Remote Support Program
- CVE-2025-26860RemoteCall Remote Support Program (for Operator) versions prior to 5.1.0 contain an uncontrolled search path element vulnerability.RSUPPORT CO. RemoteCall Remote Support Program
- CVE-2025-26859RemoteView PC Application Console versions prior to 6.0.2 contain an uncontrolled search path element vulnerability.RSUPPORT CO. RemoteView PC Application Console
- CVE-2025-55080Improper Parameter Check in ThreadX Syscall ImplementationEclipse Foundation ThreadX
- CVE-2025-6042Lisfinity Core - Lisfinity Core plugin used for pebas® Lisfinity WordPress theme <= 1.4.0 - Unauthenticated Privilege Escalation to EditorLisfinity Core - Lisfinity Core plugin used for pebas® Lisf…
- CVE-2025-11746XStore | Multipurpose WooCommerce Theme <= 9.5.4 - Authenticated (Subscriber+) Local File Inclusion8theme XStore
- CVE-2024-13991Huijietong Cloud Video Platform fileDownload Arbitrary File ReadHuijietong Cloud Video Platform
- CVE-2025-54268Bridge | Heap-based Buffer Overflow (CWE-122)Adobe Bridge
- CVE-2025-61804Animate | Heap-based Buffer Overflow (CWE-122)Adobe Animate
- CVE-2025-54279Animate | Use After Free (CWE-416)Adobe Animate
Medium, low and unrated 89
- CVE-2025-43282A double free issue was addressed with improved memory management.Apple iOS and iPadOS · Apple iPadOS +4
- CVE-2025-43313A logic issue was addressed with improved restrictions.Apple macOS
- CVE-2025-43280The issue was resolved by not loading remote images.Apple iOS and iPadOS
- CVE-2025-11568Luksmeta: data corruption when handling luks1 partitions with luksmetaLatchset luksmeta · Red Hat Enterprise Linux +1
- CVE-2025-62375go-witness Improper Verification of AWS EC2 Identity Documentsin-toto go-witness · github.com/in-toto/go-witness
- CVE-2025-62378CommandKit exposes incorrect command name in context object for message command aliasesunderctrl-io commandkit · commandkit
- CVE-2025-62380Mailgen has HTML Injection and XSS Filter Bypass in Plaintext Emailseladnava mailgen · mailgen
- CVE-2025-54271Creative Cloud Desktop | Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)Adobe Creative Cloud Desktop
- CVE-2025-20360Multiple Cisco Products Snort 3 MIME Denial of Service VulnerabilityCisco Cyber Vision · Cisco Secure Firewall Threat Defense (…
- CVE-2025-20359Multiple Cisco Products Snort 3 MIME Information Disclosure or Denial of Service VulnerabilityCisco Cyber Vision · Cisco Secure Firewall Threat Defens… +1
- CVE-2025-20351Cisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 with SIP Firmware Cross-Site Scripting VulnerabilityCisco Session Initiation Protocol (SIP) Software
- CVE-2025-20329Cisco TelePresence Collaboration Endpoint and RoomOS Software Information Disclosure VulnerabilityCisco RoomOS Software
- CVE-2025-58133Zoom Rooms Clients - Authentication BypassZoom Communications Zoom Rooms
- CVE-2025-58132Zoom Clients for Windows - Command InjectionZoom Communications Zoom Clients for Windows
- CVE-2025-62379Open Redirect in reflex-dev/reflexreflex-dev reflex · reflex
- CVE-2025-59419Netty netty-codec-smtp SMTP Command Injection Vulnerability Allowing Email Forgerynetty · io.netty:netty-codec-smtp
- CVE-2025-2529IBM Terracotta denial of serviceIBM Terracotta
- CVE-2025-61933BIG-IP APM cross-site scripting (XSS) vulnerabilityF5 BIG-IP
- CVE-2025-53860F5OS-A FIPS HSM vulnerabilityF5OS - Appliance
- CVE-2025-10699A vulnerability was reported in the Lenovo LeCloud client application that, under certain conditions, could allow information disclosure.Lenovo LeCloud Client
- CVE-2025-9548A potential null pointer dereference vulnerability was reported in the Lenovo Power Management Driver that could allow a local authenticatedLenovo Power Management Driver
- CVE-2025-6026An improper certificate validation vulnerability was reported in the Lenovo Universal Device Client (UDC) that could allow a user capable ofLenovo Universal Device Client
- CVE-2025-55083Broken bounds check in Broken bounds check in _nx_secure_tls_process_clienthello_psk_extension()Eclipse Foundation NetX Duo
- CVE-2025-60015F5OS out-of-bounds write vulnerabilityF5OS - Appliance · F5OS - Chassis
- CVE-2025-54755BIG-IP Configuration utility vulnerabilityF5 BIG-IP
- CVE-2025-59483BIG-IP Configuration utility and tmsh vulnerabilityF5 BIG-IP
- CVE-2025-60013F5OS-A FIPS HSM password vulnerabilityF5OS - Appliance
- CVE-2025-54805TMM VulnerabilityF5 BIG-IP Next SPK · F5 BIG-IP Next CNF +1
- CVE-2025-55670BIG-IP Next (CNF, SPK, and Kubernetes) vulnerabilityF5 BIG-IP Next SPK · F5 BIG-IP Next CNF +1
- CVE-2025-58424BIG-IP TMM vulnerabilityF5 BIG-IP
- CVE-2025-47150F5OS SNMP vulnerabilityF5OS - Appliance · F5OS - Chassis
- CVE-2025-58153BIG-IP HSB vulnerabilityF5 BIG-IP
- CVE-2025-58474BIG-IP Advanced WAF and ASM and NGINX App Protect DNS lookup vulnerabilityF5 BIG-IP · F5 NGINX App Protect WAF
- CVE-2025-47148BIG-IP APM and SSL Orchestrator vulnerabilityF5 BIG-IP
- CVE-2025-59269BIG-IP Configuration utility XSS vulnerabilityF5 BIG-IP
- CVE-2025-59268BIG-IP Configuration utility vulnerabilityF5 BIG-IP
- CVE-2025-9640Samba: vfs_streams_xattr uninitialized memory write possiblesamba · Red Hat Enterprise Linux +1
- CVE-2025-10869Stored Cross-Site Scripting (XSS) in Oct8ne ChatbotOct8ne Chatbot
- CVE-2025-55082Potential out of bound read and info leak in_nx_secure_tls_psk_identity_find()Eclipse Foundation NetX Duo
- CVE-2025-55081Potential out of bound read in _nx_secure_tls_process_clienthello()Eclipse Foundation NetX Duo
- CVE-2025-10682TARIFFUXX <= 1.4 - Authenticated (Contributor+) SQL Injection via tariffuxx_configurator ShortcodeTARIFFUXX
- CVE-2025-10194Shortcode Button <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scriptingeflyjason Shortcode Button
- CVE-2025-11701Zip Attachments <= 1.6 - Missing Authorization to Unauthenticated Private And Password-Protected Posts Attachment Disclosurequicoto Zip Attachments
- CVE-2025-10141Digiseller <= 1.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingDigiseller
- CVE-2025-10056Task Scheduler <= 1.6.3 - Authenticated (Admin+) Blind Server-Side Request Forgerymiunosoft Task Scheduler
- CVE-2025-11728Oceanpayment CreditCard Gateway <= 6.0 - Missing Authentication to Unauthenticated Order Status UpdateOceanpayment CreditCard Gateway
- CVE-2025-11196External Login <= 1.11.2 - Authenticated (Subscriber+) Sensitive Data Exposure via Test Connectiontbenyon External Login
- CVE-2025-10486Content Writer <= 3.6.8 - Unauthenticated Information Exposure via Log Filesteadycontent Content Writer
- CVE-2025-10140Quick Social Login <= 1.4.6 - Authenticated (Contributor+) Stored Cross-Site Scriptingandreiigna Quick Social Login
- CVE-2025-11692Zip Attachments <= 1.6 - Missing Authorization to Limited File Deletionquicoto Zip Attachments
- CVE-2025-11365WP Google Map Plugin <= 1.0 - Authenticated (Contributor+) SQL Injectionakbrohi WP Google Map Plugin
- CVE-2025-10303Library Management System <= 3.1 - Missing Authorization to Authenticated (Subscriber+) Settings Manipulationowthub Library Management System
- CVE-2025-10312Theme Importer <= 1.0 - Cross-Site Request Forgerysteve-forster Theme Importer
- CVE-2025-10300TopBar <= 1.0.0 - Cross-Site Request Forgery to Settings Updatefmeaddons TopBar
- CVE-2025-10135WP ViewSTL <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingfalldeaf WP ViewSTL
- CVE-2025-10038Binary MLM Plan <= 3.0 - Unauthenticated Limited Privilege Escalationletscms Binary MLM Plan
- CVE-2025-10132Dhivehi Text <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingdash8x Dhivehi Text
- CVE-2025-10133URLYar <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingsalamzadeh URLYar URL Shortner
- CVE-2025-10186WhyDonate – FREE Donate button – Crowdfunding – Fundraising <= 4.0.15 - Missing Authorization to Unauthenticated wp_wdplugin_style Rww Deletionjjlemstra WhyDonate – FREE Donate button – Crowdfunding – F…
- CVE-2025-10575WP jQuery Pager <= 1.4.0 - Authenticated (Contributor+) SQL Injection via Shortcodeivycat WP jQuery Pager
- CVE-2025-10301FunKItools <= 1.0.2 - Cross-Site Request Forgery to Settings Updateflenskiproject FunKItools
- CVE-2025-10730Wp tabber widget <= 4.0 - Authenticated (Contributor+) SQL Injectiongopiplushotmailcom Wp tabber widget
- CVE-2025-10045onOffice for WP-Websites <= 6.5.1 - Authenticated (Editor+) SQL Injectiononofficeweb onOffice for WP-Websites
- CVE-2025-10310Rich Snippet Site Report <= 2.0.0105 - Authenticated (Admin+) SQL Injectionjayce53 Rich Snippet Site Report
- CVE-2025-10660WP Dashboard Chat <= 1.0.3 - Authenticated (Contributor+) SQL Injection via idnicholasbosch WP Dashboard Chat
- CVE-2025-10648Login with YourMembership - YM SSO Login <= 1.1.7 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'moym_display_test_attributes'cyberlord92 Login with YourMembership – YM SSO Login
- CVE-2025-10139WP BookWidgets <= 0.9 - Authenticated (Contributor+) Stored Cross-Site Scriptingremko WP BookWidgets
- CVE-2025-39999blk-mq: fix blk_mq_tags double free while nr_requests grownLinux
- CVE-2025-39997ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_freeLinux
- CVE-2025-39996media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_removeLinux
- CVE-2025-39995media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probeLinux
- CVE-2025-39992mm: swap: check for stable address space before operating on the VMALinux
- CVE-2025-39991wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load()Linux
- CVE-2025-39984net: tun: Update napi->skb after XDP processLinux
- CVE-2025-39980nexthop: Forbid FDB status change while nexthop is in a groupLinux
- CVE-2025-39974tracing/osnoise: Fix slab-out-of-bounds in _parse_integer_limit()Linux
- CVE-2025-55039Apache Spark, Apache Spark: RPC encryption defaults to unauthenticated AES-CTR mode, enabling man-in-the-middle ciphertext modification attacksApache Software Foundation Apache Spark · pyspark +2
- CVE-2025-11160WPBakery Page Builder <= 8.6.1 - Stored Cross-Site Scripting via Custom JS ModuleWPBakery Page Builder
- CVE-2025-11161WPBakery Page Builder <= 8.6.1 - Stored Cross-Site Scripting via vc_custom_heading ShortcodeWPBakery Page Builder
- CVE-2025-10406BlindMatrix e-Commerce < 3.1 - Contributor+ LFIBlindMatrix e-Commerce
- CVE-2025-31702A vulnerability exists in certain Dahua embedded products.Dahua IPC · Dahua SD
- CVE-2025-8561Ova Advent <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodeovatheme Ova Advent
- CVE-2025-11176Quick Featured Images <= 13.7.2 - Insecure Direct Object Reference to Image Manipulationkybernetikservices Quick Featured Images
- CVE-2025-55079Missing check for thread priorityEclipse Foundation ThreadX
- CVE-2025-54278Bridge | Heap-based Buffer Overflow (CWE-122)Adobe Bridge
- CVE-2025-54269Animate | Out-of-bounds Read (CWE-125)Adobe Animate
- CVE-2025-54270Animate | NULL Pointer Dereference (CWE-476)Adobe Animate
- CVE-2025-56746Creativeitem Academy LMS up to and including 5.13 does not regenerate session IDs upon successful authentication, enabling session fixation
- CVE-2025-56748Creativeitem Academy LMS up to and including 5.13 uses predictable password reset tokens based on Base64 encoded templates without rate limi