34119 matches found
Always-Incorrect Control Flow Implementation
Overview Affected versions of this package are vulnerable to Always-Incorrect Control Flow Implementation due to an inverted time comparison in the OIDC JWKS and token cache processes. An attacker can cause expired tokens to be reused or force repeated network requests to the OIDC provider by...
Always-Incorrect Control Flow Implementation
Overview Affected versions of this package are vulnerable to Always-Incorrect Control Flow Implementation due to an inverted time comparison in the OIDC JWKS and token cache processes. An attacker can cause expired tokens to be reused or force repeated network requests to the OIDC provider by...
CVE-2026-33667
OpenProject is an open-source project management application. In versions prior to 17.3.0, 2FA OTP verification in the confirmotp action of the twofactorauthentication module has no rate limiting, lockout mechanism, or failed-attempt tracking. The existing bruteforceblockafterfailedlogins setting...
GHSA-43FJ-QP3H-HRH5 Sync-in Server has Username Enumeration via Timing Attack
Summary The /api/auth/login endpoint contains a logic flaw that allows unauthenticated remote attackers to enumerate valid usernames by measuring the application's response time. Details The logic flaw can be located at the below point in source:...
Sync-in Server has Username Enumeration via Timing Attack
Summary The /api/auth/login endpoint contains a logic flaw that allows unauthenticated remote attackers to enumerate valid usernames by measuring the application's response time. Details The logic flaw can be located at the below point in source:...
CVE-2026-20132
creationtimestamp| type| source ---|---|--- 2026-04-15 18:52:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjkkwkad3q2r 2026-07-03 11:01:34+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpqfgidana2o...
CVE-2026-33667
OpenProject contains a 2FA bypass in versions before 17.3.0 due to missing rate limiting/lockout on the confirm_otp step of two_factor_authentication. The 2FA verification path (OTP and backup code) does not increment failed-attempt counters or apply delays, while the TOTP window allows roughly f...
CVE-2026-33667 OpenProject: 2FA OTP Verification Missing Rate Limiting
OpenProject is an open-source project management application. In versions prior to 17.3.0, 2FA OTP verification in the confirmotp action of the twofactorauthentication module has no rate limiting, lockout mechanism, or failed-attempt tracking. The existing bruteforceblockafterfailedlogins setting...
CVE-2026-30995
creationtimestamp| type| source ---|---|--- 2026-04-15 18:13:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjkipdu5s52o...
firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: JIT miscompilation in the JavaScript Engine: JIT component...
CVE-2025-40899
creationtimestamp| type| source ---|---|--- 2026-04-15 13:20:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjjyeesk4e2o 2026-04-15 17:00:14+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjken4pvfd2a 2026-04-17 17:30:59+00:00| published-proof-of-concept|...
Malicious code in neverinstallme (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 b5a369ecd7616b1dcdbeeca091c3b5bb9df2096c863fe89e9b45154708d5453a Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...
CVE-2026-40778
creationtimestamp| type| source ---|---|--- 2026-04-15 12:48:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjjwkf526i2z...
CVE-2026-28741
creationtimestamp| type| source ---|---|--- 2026-04-15 12:08:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjjudayl732o 2026-04-16 11:35:11+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mjmcwqgahd2b...
firefox: thunderbird: Undefined behavior in the WebRTC: Signaling component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Undefined behavior in the WebRTC: Signaling component...
firefox: thunderbird: Undefined behavior in the WebRTC: Signaling component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Undefined behavior in the WebRTC: Signaling component...
firefox: thunderbird: Denial-of-service in the WebRTC: Signaling component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Denial-of-service in the WebRTC: Signaling component...
firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: JIT miscompilation in the JavaScript Engine: JIT component...
firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: JIT miscompilation in the JavaScript Engine: JIT component...
firefox: thunderbird: Denial-of-service in the WebRTC: Signaling component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Denial-of-service in the WebRTC: Signaling component...