Fides Webserver API Rate Limiting Vulnerability in Proxied Environments

Summary The Fides Webserver API's built-in IP-based rate limiting is ineffective in environments with CDNs, proxies or load balancers. The system incorrectly applies rate limits based on directly connected infrastructure IPs rather than client IPs, and stores counters in-memory rather than in a...

Fides has a Lack of Brute-Force Protections on Authentication Endpoints

Summary The Fides Admin UI login endpoint relies on a general IP-based rate limit for all API traffic and lacks specific anti-automation controls designed to protect against brute-force attacks. This could allow attackers to conduct credential testing attacks, such as credential stuffing or...

GHSA-7Q62-R88R-J5GW Fides has a Lack of Brute-Force Protections on Authentication Endpoints

Summary The Fides Admin UI login endpoint relies on a general IP-based rate limit for all API traffic and lacks specific anti-automation controls designed to protect against brute-force attacks. This could allow attackers to conduct credential testing attacks, such as credential stuffing or...

Fides 安全漏洞

Fides is an open source privacy engineering platform open-sourced by Ethyca to manage the implementation of data privacy requests in the runtime environment and the enforcement of privacy regulations in code. A security vulnerability exists in Fides versions prior to 2.69.1, which stems from an I...

PT-2025-36509

Name of the Vulnerable Software and Affected Versions: Fides versions prior to 2.69.1 Description: Fides is an open-source privacy engineering platform. The built-in IP-based rate limiting in the Fides Webserver API is ineffective in environments utilizing CDNs, proxies, or load balancers. The...

CVE-2025-58352

Weblate is a web based localization tool. Versions lower than 5.13.1 contain a vulnerability that causes long session expiry during the second factor verification. The long session expiry could be used to circumvent rate limiting of the second factor. This issue is fixed in version 5.13.1...

SUSE CVE-2025-58352

Weblate is a web based localization tool. Versions lower than 5.13.1 contain a vulnerability that causes long session expiry during the second factor verification. The long session expiry could be used to circumvent rate limiting of the second factor. This issue is fixed in version 5.13.1...

Malicious code in equinox-rate-limiter-auriga-dotenv-parse-variables (npm)

The package equinox-rate-limiter-auriga-dotenv-parse-variables was found to contain malicious code...

Malicious code in yaml-rate-limiter-epimetheus-optimize-css-assets-webpack-plugin (npm)

The package yaml-rate-limiter-epimetheus-optimize-css-assets-webpack-plugin was found to contain malicious code...

MAL-2025-43543 Malicious code in auth-polaris-rate-limiter-optimize-css-assets-webpack-plugin (npm)

The package auth-polaris-rate-limiter-optimize-css-assets-webpack-plugin was found to contain malicious code...

MAL-2025-44147 Malicious code in equinox-rate-limiter-auriga-dotenv-parse-variables (npm)

The package equinox-rate-limiter-auriga-dotenv-parse-variables was found to contain malicious code...

Malicious code in rate-limiter-io-antares-loopback (npm)

The package rate-limiter-io-antares-loopback was found to contain malicious code...

Malicious code in rate-limiter-umbriel-neutronstar-slidev (npm)

The package rate-limiter-umbriel-neutronstar-slidev was found to contain malicious code...

MAL-2025-46557 Malicious code in warp-rate-limiter-ini-slidev (npm)

The package warp-rate-limiter-ini-slidev was found to contain malicious code...

MAL-2025-45756 Malicious code in rate-limiter-umbriel-neutronstar-slidev (npm)

The package rate-limiter-umbriel-neutronstar-slidev was found to contain malicious code...

MAL-2025-45755 Malicious code in rate-limiter-io-antares-loopback (npm)

The package rate-limiter-io-antares-loopback was found to contain malicious code...

Malicious code in warp-rate-limiter-ini-slidev (npm)

The package warp-rate-limiter-ini-slidev was found to contain malicious code...

MAL-2025-46753 Malicious code in yaml-rate-limiter-epimetheus-optimize-css-assets-webpack-plugin (npm)

The package yaml-rate-limiter-epimetheus-optimize-css-assets-webpack-plugin was found to contain malicious code...

SUSE-SU-2025:20669-1 Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes. The following security bugs were fixed: - CVE-2024-46733: btrfs: fix qgroup reserve leaks in cowfilerange bsc1230708. - CVE-2025-38006: net: mctp: Do not access ifaindex when missing bsc1244930. -...

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes. The following security bugs were fixed: CVE-2024-46733: btrfs: fix qgroup reserve leaks in cowfilerange bsc1230708. CVE-2025-38006: net: mctp: Do not access ifaindex when missing bsc1244930...