https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T22:07:50.154738+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-32369 EUVD-2026-32369 2026-10-05T22:07:50.237258+00:00 EUVD-2026-32369 https://cve.radiocsirt.org/vuln/fkie_cve-2021-43177 fkie_cve-2021-43177 2026-10-05T22:07:50.237296+00:00

As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor prior to 4.0.2 it is possible to reuse a One-Time-Password (OTP) for one (and only one) immediately trailing interval. CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)

 https://cve.radiocsirt.org/vuln/ghsa-jm35-h8q2-73mp GHSA-jm35-h8q2-73mp — Improper one time password handling in devise-two-factor 2026-10-05T22:07:50.237329+00:00

Affected: RubyGems: devise-two-factor

### Impact As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor prior to 4.0.2 it is possible to reuse a One-Time-Password (OTP) for one (and only one) immediately trailing interval. ### Patches This vulnerability has been patched in version 4.0.2 which was released on March 24th, 2022. Individuals using this package are strongly encouraged to upgrade as soon as possible.

### Credit for discovery Benoit Côté-Jodoin Michael Nipper - https://github.com/tinfoil/devise-two-factor/issues/106

 https://cve.radiocsirt.org/vuln/gsd-2021-43177 gsd-2021-43177 2026-10-05T22:07:50.237359+00:00 gsd-2021-43177 https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-43177 UBUNTU-CVE-2021-43177 2026-10-05T22:07:50.237373+00:00

Affected: Ubuntu:16.04:LTS: ruby-devise-two-factor, Ubuntu:Pro:20.04:LTS: ruby-devise-two-factor, Ubuntu:Pro:22.04:LTS: ruby-devise-two-factor

As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor prior to 4.0.2 it is possible to reuse a One-Time-Password (OTP) for one (and only one) immediately trailing interval. CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)