https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-15T17:34:16.758718+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-257078 EUVD-2026-257078 2026-10-15T17:34:16.761435+00:00 EUVD-2026-257078 https://cve.radiocsirt.org/vuln/fkie_cve-2025-56449 fkie_cve-2025-56449 2026-10-15T17:34:16.761465+00:00

A security vulnerability was identified in Obsidian Scheduler's REST API 5.0.0 thru 6.3.0. If an account is locked out due to not enrolling in MFA (e.g. after the 7-day enforcement window), the REST API still allows the use of Basic Authentication to authenticate and perform administrative actions. In particular, the default admin account was found to be locked out via the web interface but still usable through the REST API. This allowed creation of a new privileged user, bypassing MFA protections. This undermines the intended security posture of MFA enforcement.

 https://cve.radiocsirt.org/vuln/ghsa-94hh-4gmr-5mv9 GHSA-94hh-4gmr-5mv9 2026-10-15T17:34:16.761498+00:00

A security vulnerability was identified in Obsidian Scheduler's REST API 5.0.0 thru 6.3.0. If an account is locked out due to not enrolling in MFA (e.g. after the 7-day enforcement window), the REST API still allows the use of Basic Authentication to authenticate and perform administrative actions. In particular, the default admin account was found to be locked out via the web interface but still usable through the REST API. This allowed creation of a new privileged user, bypassing MFA protections. This undermines the intended security posture of MFA enforcement.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2158 WID-SEC-W-2025-2158 — Obsidian: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen 2026-10-15T17:34:16.761518+00:00

Ein Angreifer kann eine Schwachstelle in Obsidian ausnutzen, um Sicherheitsvorkehrungen zu umgehen.