EUVD-2017-6012

Malware in sbrugna...

EUVD-2018-7527

Malware in sbrugna...

EUVD-2020-5602

Malware in sbrugna...

EUVD-2023-31325

Malicious code in bioql PyPI...

EUVD-2023-39171

Malicious code in bioql PyPI...

EUVD-2025-23661

Malicious code in bioql PyPI...

EUVD-2025-2766

Malicious code in bioql PyPI...

EUVD-2022-4731

Malicious code in bioql PyPI...

EUVD-2024-27672

Malicious code in bioql PyPI...

BIT-MASTODON-2025-54879 Mastodon e‑mail throttle misconfiguration allows unlimited email confirmations against unconfirmed emails

Mastodon is a free, open-source social network server based on ActivityPub Mastodon which facilitates LDAP configuration for authentication. In versions 3.1.5 through 4.2.24, 4.3.0 through 4.3.11 and 4.4.0 through 4.4.3, Mastodon's rate-limiting system has a critical configuration error where the...

CVE-2025-54879 Mastodon e‑mail throttle misconfiguration allows unlimited email confirmations against unconfirmed emails

Mastodon is a free, open-source social network server based on ActivityPub Mastodon which facilitates LDAP configuration for authentication. In versions 3.1.5 through 4.2.24, 4.3.0 through 4.3.11 and 4.4.0 through 4.4.3, Mastodon's rate-limiting system has a critical configuration error where the...

PT-2025-32007

Name of the Vulnerable Software and Affected Versions Mastodon versions 3.1.5 through 4.2.24 Mastodon versions 4.3.0 through 4.3.11 Mastodon versions 4.4.0 through 4.4.3 Description Mastodon’s rate-limiting system contains a configuration error where the email-based throttle for confirmation emai...

CVE-2025-4973

The Workreap plugin for WordPress, used by the Workreap - Freelance Marketplace WordPress Theme, is vulnerable to authentication bypass in all versions up to, and including, 3.3.1. This is due to the plugin not properly verifying a user's identity prior to logging them in when verifying an accoun...

CVE-2025-22385

An issue was discovered in Optimizely Configured Commerce before 5.2.2408. For newly created accounts, the Commerce B2B application does not require email confirmation. This medium-severity issue allows the mass creation of accounts. This could affect database storage; also, non-requested...

CVE-2022-1631

Users Account Pre-Takeover or Users Account Takeover. in GitHub repository microweber/microweber prior to 1.2.15. Victim Account Take Over. Since, there is no email confirmation, an attacker can easily create an account in the application using the Victim’s Email. This allows an attacker to gain...

CVE-2020-13342

An issue has been discovered in GitLab affecting versions prior to 13.2.10, 13.3.7 and 13.4.2: Lack of Rate Limiting at Re-Sending Confirmation Email...

CVE-2025-32782 Ash Authentication email link auto-click account confirmation vulnerability

Ash Authentication provides authentication for the Ash framework. The confirmation flow for account creation currently uses a GET request triggered by clicking a link sent via email. Some email clients and security tools e.g., Outlook, virus scanners, and email previewers may automatically follow...

PT-2025-16540 · Unknown · Ashauthentication

Name of the Vulnerable Software and Affected Versions: Ash Authentication versions prior to 4.7.0 Description: The confirmation flow for account creation in Ash Authentication uses a GET request triggered by clicking a link sent via email. Some email clients and security tools may automatically...

Moodle < 4.1.15 Multiple Vulnerabilities

According to its self-reported version, the Moodle install hosted on the remote host is 4.1.x prior to 4.1.15, 4.3.x prior to 4.3.9, or 4.4.x prior to 4.4.5. It is, therefore, affected by multiple vulnerabilities. - A potential denial of service risk due to guest sessions' longer timeout period. ...

Moodle 4.4.x < 4.4.5 Multiple Vulnerabilities

According to its self-reported version, the Moodle install hosted on the remote host is 4.1.x prior to 4.1.15, 4.3.x prior to 4.3.9, or 4.4.x prior to 4.4.5. It is, therefore, affected by multiple vulnerabilities. - A potential denial of service risk due to guest sessions' longer timeout period. ...