EUVD-2023-39182

Malicious code in bioql PyPI...

EUVD-2025-19010

Malicious code in bioql PyPI...

Insufficient Session Expiration

weblate is vulnerable to Insufficient Session Expiration. The vulnerability is due to unsafe settings for the second factor in 2FA due to sessions being allowed to persist for an unusually long period, and an attacker can maintain a valid session to repeatedly attempt authentication, thereby...

CVE-2025-56449

A security vulnerability was identified in Obsidian Scheduler's REST API 5.0.0 thru 6.3.0. If an account is locked out due to not enrolling in MFA e.g. after the 7-day enforcement window, the REST API still allows the use of Basic Authentication to authenticate and perform administrative actions...

CVE-2025-56449

A security vulnerability was identified in Obsidian Scheduler's REST API 5.0.0 thru 6.3.0. If an account is locked out due to not enrolling in MFA e.g. after the 7-day enforcement window, the REST API still allows the use of Basic Authentication to authenticate and perform administrative actions...

Fortra GoAnywhere Managed File Transfer (MFT) < 7.8.1 Broken Access Control (fi-2025-009)

According to its self-reported version, the instance of Fortra GoAnywhere Managed File Transfer MFT running on the remote web server is prior to 7.8.1. It is, therefore, affected by a broken access Control vulnerability: - Broken access control in Fortra's GoAnywhere MFT prior to 7.8.1 allows an...

CVE-2025-58658

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Proof Factor LLC Proof Factor - Social Proof Notifications proof-factor-social-proof-notifications allows Stored XSS.This issue affects Proof Factor - Social Proof Notifications: from n/a through =...

CVE-2025-35041

Airship AI Acropolis allows unlimited MFA attempts for 15 minutes after a user has logged in with valid credentials. A remote attacker with valid credentials could brute-force the 6-digit MFA code. Fixed in 10.2.35, 11.0.21, and 11.1.9...

Omise: 2FA requirement bypass when inviting team members

The application's requirement for users to enable 2FA before sending team invitations was bypassed by modifying client-side responses. This allowed invitations to be sent without enabling 2FA, defeating the security requirement...

GitHub Mandates 2FA and Short-Lived Tokens to Strengthen npm Supply Chain Security

GitHub on Monday announced that it will be changing its authentication and publishing options "in the near future" in response to a recent wave of supply chain attacks targeting the npm ecosystem, including the Shai-Hulud attack. This includes steps to address threats posed by token abuse and...

CVE-2025-58658

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Proof Factor LLC Proof Factor – Social Proof Notifications proof-factor-social-proof-notifications allows Stored XSS.This issue affects Proof Factor – Social Proof Notifications: from n/a through =...

WordPress Proof Factor – Social Proof Notifications Plugin <= 1.0.5 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Vinit Lakra in WordPress Plugin Proof Factor Social Proof Notifications versions = 1.0.5...

CVE-2025-58658

CVE-2025-58658 is a Stored XSS in the Proof Factor – Social Proof Notifications WordPress plugin. Affected: Proof Factor – Social Proof Notifications (WordPress) versions from n/a through 1.0.5. Root cause: improper input neutralization during web page generation. Impact: potential cross-site scr...

CVE-2025-58658 WordPress Proof Factor – Social Proof Notifications Plugin <= 1.0.5 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Proof Factor LLC Proof Factor – Social Proof Notifications proof-factor-social-proof-notifications allows Stored XSS.This issue affects Proof Factor – Social Proof Notifications: from n/a through =...

CVE-2025-58658 WordPress Proof Factor – Social Proof Notifications Plugin <= 1.0.5 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Proof Factor LLC Proof Factor – Social Proof Notifications proof-factor-social-proof-notifications allows Stored XSS.This issue affects Proof Factor – Social Proof Notifications: from n/a through =...

CVE-2025-58658

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Proof Factor LLC Proof Factor – Social Proof Notifications proof-factor-social-proof-notifications allows Stored XSS.This issue affects Proof Factor – Social Proof Notifications: from n/a through =...

CVE-2025-35041

Airship AI Acropolis allows unlimited MFA attempts for 15 minutes after a user has logged in with valid credentials. A remote attacker with valid credentials could brute-force the 6-digit MFA code. Fixed in 10.2.35, 11.0.21, and 11.1.9...

CVE-2025-35041 Airship AI Acropolis MFA insufficient rate limiting

Airship AI Acropolis allows unlimited MFA attempts for 15 minutes after a user has logged in with valid credentials. A remote attacker with valid credentials could brute-force the 6-digit MFA code. Fixed in 10.2.35, 11.0.21, and 11.1.9...

CVE-2025-35041

Airship AI Acropolis MFA vulnerability: after a valid login, there is no rate limiting for MFA attempts, allowing unlimited tries within a 15-minute window to brute-force the 6-digit code. Affected versions include those prior to 10.2.35, 11.0.21, and 11.1.9. Remediation is to upgrade to 10.2.35,...

Airship AI Acropolis 安全漏洞

Airship AI Acropolis is a video and wear Blue Flag data management platform from Airship AI in the United States. A security vulnerability exists in Airship AI Acropolis versions prior to 10.2.35, prior to 11.0.21, and prior to 11.1.9, which stems from allowing unlimited attempts at MFA...