Cisa Thorium
7 CVEs affecting Cisa Thorium. Latest disclosed: 2025-09-17. Critical: 0, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-35431 | Medium | 5.4 | 2025-09-17 | CISA Thorium does not escape user controlled strings used in LDAP queries. An authenticated remote attacker can modify LDAP authorization data such as group me… |
CVE-2025-35436 | Medium | 5.3 | 2025-09-17 | CISA Thorium uses '.unwrap()' to handle errors related to account verification email messages. An unauthenticated remote attacker could cause a crash by provid… |
CVE-2025-35432 | Medium | 5.3 | 2025-09-17 | CISA Thorium does not rate limit requests to send account verification email messages. A remote unauthenticated attacker can send unlimited messages to a user… |
CVE-2025-35433 | Medium | 5.0 | 2025-09-17 | CISA Thorium does not properly invalidate previously used tokens when resetting passwords. An attacker that possesses a previously used token could still log i… |
CVE-2025-35430 | Medium | 5.0 | 2025-09-17 | CISA Thorium does not adequately validate the paths of downloaded files via 'download_ephemeral' and 'download_children'. A remote, authenticated attacker coul… |
CVE-2025-35435 | Medium | 4.3 | 2025-09-17 | CISA Thorium accepts a stream split size of zero then divides by this value. A remote, authenticated attacker could cause the service to crash. Fixed in commit… |
CVE-2025-35434 | Medium | 4.2 | 2025-09-17 | CISA Thorium does not validate TLS certificates when connecting to Elasticsearch. An unauthenticated attacker with access to a Thorium cluster could impersonat… |