CVE-2025-35432

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

CISA Thorium does not rate limit requests to send account verification email messages. A remote unauthenticated attacker can send unlimited messages to a user who is pending verification. Fixed in 1.1.1 by adding a rate limit set by default to 10 minutes.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

Vendor	Product	Versions
CISA	Thorium	>= 1.0.0, < 1.1.1

References

Timeline

Published: Sep 17, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-354338.8CISA Thorium does not properly invalidate previously used tokens when resetting passwords. An attacker that possesses a previously used toke CVE-2025-354349.8CISA Thorium does not validate TLS certificates when connecting to Elasticsearch. An unauthenticated attacker with access to a Thorium clust CVE-2025-354354.3CISA Thorium accepts a stream split size of zero then divides by this value. A remote, authenticated attacker could cause the service to cra CVE-2025-354367.5CISA Thorium uses '.unwrap()' to handle errors related to account verification email messages. An unauthenticated remote attacker could caus CVE-2025-35448.0A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014 and classified as cri CVE-2025-35458.0A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. It has been classifi CVE-2025-354519.8PTZOptics and possibly other ValueHD-based pan-tilt-zoom cameras use hard-coded, default administrative credentials. The passwords can readi CVE-2025-354529.8PTZOptics and possibly other ValueHD-based pan-tilt-zoom cameras use default, shared credentials for the administrative web interface.CVE-2025-35468.0A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. It has been declared CVE-2025-35476.3A vulnerability classified as critical was found in frdel Agent-Zero 0.8.1.2. This vulnerability affects unknown code of the file /get_work_CVE-2025-354717.8conda-forge openssl-feedstock before 066e83c (2024-05-20), on Microsoft Windows, configures OpenSSL to use an OPENSSLDIR file path that can CVE-2025-35483.3A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp up to 5.4.3. This issue affects the fu