Excellent
Doma is making title and escrow a simpler, seamless process for lenders, agents and homebuyers across the country. We build transformative technology driven by our passion to improve the customer experience.
Excellent
Forsythe Appraisals is part of First American Mortgage Solutions. Established in 1940, Forsythe Appraisals is the oldest and largest staff appraisal company in the United States. With branch offices covering more than 40 metropolitan markets around the country, Forsythe Appraisals’ unique national platform includes an appraisal staff of over 200 full-time, W-2 employee appraisers offering expertise in a wide variety of property types and valuation solutions. Forsythe Appraisals provides comprehensive residential appraisal solutions, including all residential appraisal form types, desktop and other gap products, as well as HUD/FHA, alternative and statistically supported appraisals, and desk and field reviews. Areas of specialization include REO/foreclosures, jumbo loans, employee relocations (ERC), new construction, and complex properties. Forsythe Appraisals is now a proud part of the First American Mortgage Solutions family. The union of Forsythe Appraisals and First American Mortgage Solutions unites two family-founded industry pioneers whose combined real estate industry expertise and experience tops 200 years. With the addition of Forsythe Appraisals, First American Mortgage Solutions can now offer lenders an integrated valuation solution that provides access to staff appraisers nationwide and top-quality panel appraisers. This new valuation offering includes software solutions from ACI, fraud detection, loan quality and compliance analytics supported by First American’s number one industry position in real property data coverage. The expanded valuations capabilities broaden First American Mortgage Solutions’ end-to-end offerings and support its commitment to the Pursuit of Certainty in Lending™.
Security & Compliance Standards Overview
No incidents recorded for Doma in 2025.
No incidents recorded for Forsythe Appraisals in 2025.
Doma cyber incidents detection timeline including parent company and subsidiaries
Forsythe Appraisals cyber incidents detection timeline including parent company and subsidiaries
Last 3 Security & Risk Events by Company
Quadient DS-700 iQ devices through 2025-09-30 might have a race condition during the quick clicking of (in order) the Question Mark button, the Help Button, the About button, and the Help Button, leading to a transition out of kiosk mode into local administrative access. NOTE: the reporter indicates that the "behavior was observed sporadically" during "limited time on the client site," making it not "possible to gain more information about the specific kiosk mode crashing issue," and the only conclusion was "there appears to be some form of race condition." Accordingly, there can be doubt that a reproducible cybersecurity vulnerability was identified; sporadic software crashes can also be caused by a hardware fault on a single device (for example, transient RAM errors). The reporter also describes a variety of other issues, including initial access via USB because of the absence of a "lock-pick resistant locking solution for the External Controller PC cabinet," which is not a cybersecurity vulnerability (section 4.1.5 of the CNA Operational Rules). Finally, it is unclear whether the device or OS configuration was inappropriate, given that the risks are typically limited to insider threats within the mail operations room of a large company.
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions between 2.1.0 and 2.14.19, 3.2.0-rc1, 3.1.0-rc1 through 3.1.7, and 3.0.0-rc1 through 3.0.18 contain a race condition in the repository credentials handler that can cause the Argo CD server to panic and crash when concurrent operations are performed on the same repository URL. The vulnerability is located in numerous repository related handlers in the util/db/repository_secrets.go file. A valid API token with repositories resource permissions (create, update, or delete actions) is required to trigger the race condition. This vulnerability causes the entire Argo CD server to crash and become unavailable. Attackers can repeatedly and continuously trigger the race condition to maintain a denial-of-service state, disrupting all GitOps operations. This issue is fixed in versions 2.14.20, 3.2.0-rc2, 3.1.8 and 3.0.19.
Stored cross-site scripting (XSS) vulnerabilities in Web Content translation in Liferay Portal 7.4.0 through 7.4.3.112, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allow remote attackers to inject arbitrary web script or HTML via any rich text field in a web content article.
Keysight Ixia Vision has an issue with hardcoded cryptographic material which may allow an attacker to intercept or decrypt payloads sent to the device via API calls or user authentication if the end user does not replace the TLS certificate that shipped with the device. Remediation is available in Version 6.9.1, released on September 23, 2025.
An Insecure Direct Object Reference (IDOR) in the /dashboard/notes endpoint of Syaqui Collegetivity v1.0.0 allows attackers to impersonate other users and perform arbitrary operations via a crafted POST request.
