The Privacy Gap in API Security: Why Protecting APIs Shouldn’t Put Your Data at Risk

The more critical APIs become, the more sensitive data they carry identities, payment details, health records, customer preferences, tokens, keys, and more. And this is where organizations face a painful, often invisible problem: To protect APIs, many organizations end up exposing the very data...

CVE-2025-42615

In affected versions, vulnerability-lookup did not track or limit failed One-Time Password OTP attempts during Two-Factor Authentication 2FA verification. An attacker who already knew or guessed a valid username and password could submit an arbitrary number of OTP codes without causing the accoun...

CVE-2025-42615

In affected versions, vulnerability-lookup did not track or limit failed One-Time Password OTP attempts during Two-Factor Authentication 2FA verification. An attacker who already knew or guessed a valid username and password could submit an arbitrary number of OTP codes without causing the accoun...

EUVD-2025-201703

In affected versions, vulnerability-lookup did not track or limit failed One-Time Password OTP attempts during Two-Factor Authentication 2FA verification. An attacker who already knew or guessed a valid username and password could submit an arbitrary number of OTP codes without causing the accoun...

CVE-2025-42615 Improper Restriction of Excessive Authentication Attempts vulnerability in CIRCL Vulnerability-Lookup

In affected versions, vulnerability-lookup did not track or limit failed One-Time Password OTP attempts during Two-Factor Authentication 2FA verification. An attacker who already knew or guessed a valid username and password could submit an arbitrary number of OTP codes without causing the accoun...

CVE-2025-42615

Summary: CVE-2025-42615 affects Vulnerability-Lookup prior to 2.18.0 and stems from failing to rate-limit OTP attempts during 2FA, enabling brute-force style OTP submissions by an attacker with valid credentials. The concrete fix adds a persistent failed_otp_attempts counter, locks a user after 5...

PT-2025-49549

In affected versions, vulnerability-lookup did not track or limit failed One-Time Password OTP attempts during Two-Factor Authentication 2FA verification. An attacker who already knew or guessed a valid username and password could submit an arbitrary number of OTP codes without causing the accoun...

Criminal IP to Host Webinar: Beyond CVEs – From Visibility to Action with ASM

Torrance, California, USA, 5th December 2025, CyberNewsWire...

DNS Visibility Gap: Misconfigurations That Firewalls Miss in Network Security

...

Project View: A New Era of Prioritized and Actionable Cloud Security

In today's cloud-first world, security teams face an overwhelming flood of alerts, fragmented visibility, and reactive workflows. The complexity of modern cloud environments—spanning multi-cloud deployments, ephemeral assets, and decentralized ownership—demands a new approach to risk management...

CVE-2025-20383 Improper access control through push notifications for reports and alerts in Splunk Secure Gateway app

In Splunk Enterprise versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, and below 3.9.10, 3.8.58, and 3.7.28 of Splunk Secure Gateway app in Splunk Cloud Platform, a low-privileged user that does not hold the "admin" or "power" Splunk roles and subscribes to mobile push notifications could receive...

Wiz Product Announcements at re:Invent 2025: Expanding Visibility from Code to Cloud

Check out new product releases that help security and engineers work together to keep cloud environments secure...

EUVD-2025-200734

BlazeMeter Jenkins Plugin is Missing Authorization for Available Resources...

CVE-2025-13472 Missing authorization in BlazeMeter Jenkins Plugin

A fix was made in BlazeMeter Jenkins Plugin version 4.27 to allow users only with certain permissions to see the list of available resources like credential IDs, bzm workspaces and bzm project Ids. Prior to this fix, anyone could see this list as a dropdown on the Jenkins UI...

Empower CISOs with Visibility, Agility, Compliance, and Strategic ROI

Learn how Akamai Prolexic Network Cloud Firewall allows CISOs to manage risk, resilience, and reputation by delivering visibility, agility, and proactive defense...

Service Catalog is Here: Expand Risk Visibility for Your Service and Its Dependencies, Simplify Issue Ownership

Give security and developers a shared view of cloud risk, aligned to the way applications are built and maintained...

Mastering Software Governance with Hosted Technologies Inventory

Gain visibility into every technology in your environment and eliminate governance gaps...

CVE-2025-54515

The Secure Flag passed to Versal™ Adaptive SoC’s Trusted Firmware for Cortex®-A processors TF-A for Arm’s Power State Coordination Interface PSCI commands were incorrectly set to secure instead of using the processor’s actual security state. This would allow the PSCI requests to appear they were...

Beyond IAM Silos: Why the Identity Security Fabric is Essential for Securing AI and Non-Human Identities

Identity security fabric ISF is a unified architectural framework that brings together disparate identity capabilities. Through ISF, identity governance and administration IGA, access management AM, privileged access management PAM, and identity threat detection and response ITDR are all integrat...

6 Actionable Vulnerability Management Best Practices

Every unpatched vulnerability is more than just a technical flaw; it's a direct business risk. These security gaps are the entry points for breaches that lead to devastating financial losses, operational downtime, and long-term damage to your brand's reputation. When viewed through this lens,...