Monthly
Account takeover in Flarum forum software before 1.8.16 lets remote unauthenticated attackers reuse expired password reset tokens by POSTing them directly to the reset endpoint, bypassing the 24-hour token lifetime that is only enforced when the reset form is rendered. Because SavePasswordController::handle() calls PasswordToken::findOrFail() with no expiry check, anyone holding a stale-but-still-existing token can set a new password and log in as that user. Reported by VulnCheck; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
sigstore-go versions up to and including 1.2.0 accept Sigstore bundles signed with expired long-lived public keys because the verifier omits the timestamp-validity check when using `ExpiringKey`-wrapped verifiers. An attacker who obtains expired signing key material can produce bundles that pass verification despite the key's configured expiry window, undermining supply chain integrity guarantees enforced by key rotation policies. This affects only the self-managed long-lived key workflow - standard Sigstore deployments using Fulcio certificate authorities are explicitly unaffected. No public exploit identified at time of analysis.
Password-reset tokens in Gogs self-hosted Git service (versions before 0.14.3) remain valid for the full account-activation lifetime - up to 3 hours by default - regardless of the administrator-configured `RESET_PASSWORD_CODE_LIVES` setting, because `GenerateActivateCode()` hardcodes `conf.Auth.ActivateCodeLives` into the token at generation time. An attacker who obtains an intercepted reset token can exploit it far beyond the intended expiry window to perform full account takeover, exposing all private repositories and source code. No KEV listing at time of analysis, but publicly available exploit code exists within the GitHub Security Advisory GHSA-5c3f-6486-3g7g.
IBM Sterling Partner Engagement Manager versions 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2 contain an authentication bypass vulnerability that allows unauthenticated attackers to extract sensitive user information by leveraging expired access tokens over the network without requiring special privileges or user interaction. The vulnerability has a CVSS score of 5.3 with low attack complexity, meaning exploitation is straightforward and requires no special conditions, though the impact is limited to confidentiality breaches with no integrity or availability compromise.
IBM Db2 10.5.0 through 10.5.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux could allow an authenticated user to regain access after account lockout due to. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Fedora Secure Boot CA certificate shipped with shim in Fedora was expired which could lead to old or invalid signed boot components being loaded. Rated medium severity (CVSS 4.1). No vendor patch available.
Password can be used past expiry in PgBouncer due to auth_query not taking into account Postgres its VALID UNTIL value, which allows an attacker to log in with an already expired password. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Zitadel is open-source identity infrastructure software. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity.
A vulnerability was found in Keycloak. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Lack of consideration of key expiry when validating signatures in Conduit, allowing an attacker which has compromised an expired key to forge requests as the remote server, as well as PDUs with. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Account takeover in Flarum forum software before 1.8.16 lets remote unauthenticated attackers reuse expired password reset tokens by POSTing them directly to the reset endpoint, bypassing the 24-hour token lifetime that is only enforced when the reset form is rendered. Because SavePasswordController::handle() calls PasswordToken::findOrFail() with no expiry check, anyone holding a stale-but-still-existing token can set a new password and log in as that user. Reported by VulnCheck; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
sigstore-go versions up to and including 1.2.0 accept Sigstore bundles signed with expired long-lived public keys because the verifier omits the timestamp-validity check when using `ExpiringKey`-wrapped verifiers. An attacker who obtains expired signing key material can produce bundles that pass verification despite the key's configured expiry window, undermining supply chain integrity guarantees enforced by key rotation policies. This affects only the self-managed long-lived key workflow - standard Sigstore deployments using Fulcio certificate authorities are explicitly unaffected. No public exploit identified at time of analysis.
Password-reset tokens in Gogs self-hosted Git service (versions before 0.14.3) remain valid for the full account-activation lifetime - up to 3 hours by default - regardless of the administrator-configured `RESET_PASSWORD_CODE_LIVES` setting, because `GenerateActivateCode()` hardcodes `conf.Auth.ActivateCodeLives` into the token at generation time. An attacker who obtains an intercepted reset token can exploit it far beyond the intended expiry window to perform full account takeover, exposing all private repositories and source code. No KEV listing at time of analysis, but publicly available exploit code exists within the GitHub Security Advisory GHSA-5c3f-6486-3g7g.
IBM Sterling Partner Engagement Manager versions 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2 contain an authentication bypass vulnerability that allows unauthenticated attackers to extract sensitive user information by leveraging expired access tokens over the network without requiring special privileges or user interaction. The vulnerability has a CVSS score of 5.3 with low attack complexity, meaning exploitation is straightforward and requires no special conditions, though the impact is limited to confidentiality breaches with no integrity or availability compromise.
IBM Db2 10.5.0 through 10.5.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux could allow an authenticated user to regain access after account lockout due to. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Fedora Secure Boot CA certificate shipped with shim in Fedora was expired which could lead to old or invalid signed boot components being loaded. Rated medium severity (CVSS 4.1). No vendor patch available.
Password can be used past expiry in PgBouncer due to auth_query not taking into account Postgres its VALID UNTIL value, which allows an attacker to log in with an already expired password. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Zitadel is open-source identity infrastructure software. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity.
A vulnerability was found in Keycloak. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Lack of consideration of key expiry when validating signatures in Conduit, allowing an attacker which has compromised an expired key to forge requests as the remote server, as well as PDUs with. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.