PT-2025-21936 · Undefined · Undefined

🚨 CVE-2025-190800 in Auth0 WordPress plugin allows brute force attacks on session cookies, risking unauthorized access. Update to version 5.3.0 or later and consider rotating cookie encryption keys.🔧 Read more: https://t.co/aLcSs7CcDK BruteForceAttack CyberSecurity Vulert https://t.co/3Z8lZDmI2j...

GHSA-9WG9-93H9-J8CH Auth0 Symfony SDK Vulnerable to Brute Force Authentication Tags of CookieStore Sessions

Overview Session cookies of applications using the Auth0 symfony SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access. Am I Affected? You are affected by this vulnerability if you meet the following pre-conditions: 1...

CVE-2025-48187

RAGFlow through 0.18.1 allows account takeover because it is possible to conduct successful brute-force attacks against email verification codes to perform arbitrary account registration, login, and password reset. Codes are six digits and there is no rate limiting...

PT-2025-21792 · Ragflow · Ragflow

Name of the Vulnerable Software and Affected Versions: RAGFlow versions 0.18.1 and earlier Description: The issue allows account takeover due to the possibility of conducting successful brute-force attacks against email verification codes. This enables arbitrary account registration, login, and...

CVE-2025-48187

RAGFlow through 0.18.1 allows account takeover because it is possible to conduct successful brute-force attacks against email verification codes to perform arbitrary account registration, login, and password reset. Codes are six digits and there is no rate limiting...

CVE-2025-48187

CVE-2025-48187 affects RAGFlow up to version 0.18.1. The root cause is brute-force attacks on six-digit email verification codes without rate limiting, enabling account takeover via arbitrary registration, login, or password reset. Multiple connected sources confirm the issue and its impact. Prac...

Authentication Bypass

Mattermost is vulnerable to Authentication Bypass. The vulnerability is due to insufficient enforcement of login failure limits due to the failure to lock out LDAP users after repeated unsuccessful login attempts, allowing attackers to trigger external LDAP account lockouts via brute-force attemp...

CVE-2025-47275

Auth0-PHP provides the PHP SDK for Auth0 Authentication and Management APIs. Starting in version 8.0.0-BETA1 and prior to version 8.14.0, session cookies of applications using the Auth0-PHP SDK configured with CookieStore have authentication tags that can be brute forced, which may result in...

CVE-2025-47781 Rallly Insufficient Password Login Token Entropy Leads to Account Takeover

Rallly is an open-source scheduling and collaboration tool. Versions up to and including 3.22.1 of the application features token based authentication. When a user attempts to login to the application, they insert their email and a 6 digit code is sent to their email address to complete the...

Alibaba Cloud Linux 3 : 0152: idm:DL1 (ALINUX3-SA-2024:0152)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2024:0152 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2024-2698: A vulnerability was found i...

CVE-2023-34732

An issue in the userId parameter in the change password function of Flytxt NEON-dX v0.0.1-SNAPSHOT-6.9-qa-2-9-g5502a0c allows attackers to execute brute force attacks to discover user passwords...

CVE-2023-34732

The Flytxt NEON-dX software (specifically version v0.0.1-SNAPSHOT-6.9-qa-2-9-g5502a0c ) contains an Authenticated Function Abuse vulnerability. The change password function relies on the userId parameter instead of the authenticated session or token, allowing an attacker to brute-force other user...

CVE-2025-46833 Programs/P73_SimplePythonEncryption.py has weak cryptographic key

Programs/P73SimplePythonEncryption.py illustrates a simple Python encryption example using the RSA Algorithm. In versions prior to commit 6ce60b1, an attacker may be able to decrypt the data using brute force attacks and because of this the whole application can be impacted. This issue has been...

CVE-2025-46833 Programs/P73_SimplePythonEncryption.py has weak cryptographic key

Programs/P73SimplePythonEncryption.py illustrates a simple Python encryption example using the RSA Algorithm. In versions prior to commit 6ce60b1, an attacker may be able to decrypt the data using brute force attacks and because of this the whole application can be impacted. This issue has been...

PT-2025-20413 · Unknown · P73 Simplepythonencryption.Py

Name of the Vulnerable Software and Affected Versions: Programs/P73 SimplePythonEncryption.py versions prior to commit 6ce60b1 Description: The issue affects a Python encryption example using the RSA Algorithm, allowing an attacker to potentially decrypt data using brute force attacks, which can...

CVE-2025-3218

IBM i 7.2, 7.3, 7.4, 7.5, and 7.6 is vulnerable to authentication and authorization attacks due to incorrect validation processing in IBM i Netserver. A malicious actor could use the weaknesses, in conjunction with brute force authentication attacks or to bypass authority restrictions, to access...

CVE-2025-3218

IBM i 7.2, 7.3, 7.4, 7.5, and 7.6 is vulnerable to authentication and authorization attacks due to incorrect validation processing in IBM i Netserver. A malicious actor could use the weaknesses, in conjunction with brute force authentication attacks or to bypass authority restrictions, to access...

CVE-2025-3218

The CVE-2025-3218 entry pertains to IBM i Netserver: IBM i versions 7.2–7.6 are vulnerable to authentication and authorization attacks due to incorrect validation processing in Netserver. The root cause is improper validation handling, enabling a malicious actor to bypass authority restrictions o...

PT-2025-19902 · Ibm · Ibm I

Name of the Vulnerable Software and Affected Versions: IBM i versions 7.2 through 7.6 Description: The issue concerns authentication and authorization attacks due to incorrect validation processing in IBM i Netserver. A malicious actor could exploit these weaknesses, in conjunction with brute for...

PT-2025-18941 · Unknown +1 · Mojolicious +1

Name of the Vulnerable Software and Affected Versions: Mojolicious versions 7.28 through 9.39 Description: The issue concerns the generation of weak HMAC session secrets in Mojolicious for Perl. When creating a default app, a weak secret is written to the application's configuration file using th...