Insufficient Session Expiration

Overview @strapi/admin is a Strapi Admin Affected versions of this package are vulnerable to Insufficient Session Expiration due to the failure to invalidate JWT after logout or account deactivation. An attacker can maintain unauthorized access by reusing a stolen or intercepted token until it...

CVE-2025-62174

Mastodon is a free, open-source social network server based on ActivityPub. In Mastodon before 4.4.6, 4.3.14, and 4.2.27, when an administrator resets a user account's password via the command-line interface using bin/tootctl accounts modify --reset-password, active sessions and access tokens for...

EUVD-2021-12808

Malware in sbrugna...

EUVD-2021-0921

Malware in sbrugna...

EUVD-2020-9426

Malware in sbrugna...

EUVD-2020-5559

Malware in sbrugna...

EUVD-2013-5269

Malware in sbrugna...

EUVD-2017-3798

Malware in sbrugna...

EUVD-2025-9330

Malicious code in bioql PyPI...

EUVD-2022-1476

Malicious code in bioql PyPI...

EUVD-2025-2227

Malicious code in bioql PyPI...

EUVD-2024-34087

Malicious code in bioql PyPI...

EUVD-2024-1994

Malicious code in bioql PyPI...

EUVD-2022-7575

Malicious code in bioql PyPI...

Improper Session Invalidation

payload is vulnerable to Improper Session Invalidation. The vulnerability is due to JSON Web Tokens JWT not being invalidated after logout, which allows an attacker who has stolen or intercepted a token to reuse it until its expiration...

Insufficient Session Expiration

Overview Affected versions of this package are vulnerable to Insufficient Session Expiration in the SpSessionTerminationSamlPortalFilter. An attacker can gain unauthorized access to user accounts by reusing old session tokens via the SLO API, causing the session to be reinitialized when it should...

CVE-2025-35433

CISA Thorium does not properly invalidate previously used tokens when resetting passwords. An attacker that possesses a previously used token could still log in after a password reset. Fixed in 1.1.1...

CVE-2025-35433

CVE-2025-35433 affects the CISA Thorium framework, where previously issued tokens may remain valid after a password reset, allowing an attacker to log in if they possess an old token. The vulnerability is documented with a high-severity CVSS v3.1 impact (Confidentiality, Integrity, Availability a...

CVE-2025-35433 CISA Thorium does not properly invalidate previously used tokens

CISA Thorium does not properly invalidate previously used tokens when resetting passwords. An attacker that possesses a previously used token could still log in after a password reset. Fixed in 1.1.1...

Infrahub: Deleted and expired API tokens can still authenticate

Impact A bug in the authentication logic will cause API tokens that were deleted and/or expired to be considered valid. This means that any API token that is associated with an active user account can authenticate successfully. Patches This issue is fixed in versions 1.3.9 and 1.4.5 Workarounds...