PT-2025-12190

Name of the Vulnerable Software and Affected Versions h2oai/h2o-3 version 3.46.1 Description A vulnerability in the "/3/ImportFiles" endpoint allows an attacker to cause a denial of service. The endpoint takes a single GET parameter, path, which can be recursively set to reference itself, leading...

PT-2025-12459

Name of the Vulnerable Software and Affected Versions: Corosync versions 3.1.9 and earlier Description: The issue is a stack-based buffer overflow in the orf token endian convert function in exec/totemsrp.c via a large UDP packet, which can be exploited if encryption is disabled or the attacker...

PT-2025-13695 · Tenda · Tenda Fh1202

Name of the Vulnerable Software and Affected Versions: Tenda FH1202 version 1.2.0.14408 Description: A critical issue was found in the Web Management Interface of the affected software, specifically affecting an unknown part of the file /goform/qossetting. This issue leads to improper access...

PT-2025-12295 · Unknown · Mudler/Localai

Name of the Vulnerable Software and Affected Versions: mudler/localai version v2.21.1 mudler/localai versions prior to v2.22.0 Description: The issue arises due to improper sanitization of user input, allowing the injection and execution of arbitrary JavaScript code. This can lead to the executio...

PT-2025-12243 · Lunary · Lunary

Name of the Vulnerable Software and Affected Versions: lunary-ai/lunary versions be54057 and later Description: The issue allows users to upload and execute arbitrary regular expressions on the server, potentially leading to a Denial of Service DoS condition due to excessive resource consumption...

PT-2025-12374 · WordPress · Wp Ghost

Name of the Vulnerable Software and Affected Versions: Hide My WP Ghost versions n/a through 5.4.01 Description: The issue affects the Hide My WP Ghost plugin, allowing PHP Local File Inclusion due to improper control of filename for include/require statement in PHP program. This flaw can be...

PT-2025-12022 · Parisneo · Lollms-Webui

Name of the Vulnerable Software and Affected Versions: parisneo/lollms-webui versions v9.9 to the latest Description: The issue allows an attacker to list arbitrary directories on a Windows system by sending a specially crafted HTTP request to the "/open file" endpoint. This enables the attacker ...

PT-2025-12246 · Unknown · Lunary-Ai/Lunary

Name of the Vulnerable Software and Affected Versions: Lunary-ai/lunary version git 105a3f6 Description: The application allows users to upload their own regular expressions, which are then executed on the server side. Certain regular expressions can have exponential runtime complexity relative t...

PT-2025-11664 · Unknown · Site Reviews

Name of the Vulnerable Software and Affected Versions: Site Reviews WordPress plugin versions prior to 7.2.5 Description: The issue concerns the Site Reviews WordPress plugin, which does not properly sanitise and escape some of its review fields. This could allow unauthenticated users to perform...

PT-2025-11980 · Applio · Applio

Name of the Vulnerable Software and Affected Versions: Applio versions 3.2.8-bugfix and prior Description: Applio is a voice conversion tool vulnerable to unsafe deserialization in infer.py. This issue can lead to remote code execution. A fix was available on the main branch of the Applio...

CVE-2024-41975

CVE-2024-41975 concerns the CODESYS Edge Gateway for Windows with insecure defaults. Public sources converge on an unauthenticated remote attacker being able to obtain limited information about the PLC network; however, careful access controls in PLC user management appear to prevent actual contr...

PT-2025-11596 · Vestel · Vestel Evc04 Configuration Interface

Name of the Vulnerable Software and Affected Versions: Vestel EVC04 Configuration Interface versions prior to 18.03.2025 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection...

PT-2025-11643 · G Net · G-Net Dashcam Bb Gonx

Name of the Vulnerable Software and Affected Versions: G-Net Dashcam BB GONX devices affected versions not specified Description: An issue was discovered where default credentials for the SSID cannot be changed, allowing any nearby attacker to connect to the dashcam's network without restriction...

PT-2025-11462 · Totolink · Totolink Ex1800T

Name of the Vulnerable Software and Affected Versions: TOTOLINK EX1800T versions 9.1.0cu.2112 B20220316 and earlier Description: A critical issue has been found in the TOTOLINK EX1800T, affecting the function setPasswordCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument admpas...

PT-2025-25226 · Gnu +1 · Http Request2 +1

Name of the Vulnerable Software and Affected Versions: Tunnelblick versions 3.5beta06 through 6.x Tunnelblick version 7.0 and earlier Description: The issue is related to the HTTP Request2 library used for processing HTTP requests in the Tunnelblick VPN client. It involves information disclosure...

PT-2025-11148 · WordPress · Wp E-Customers Beta

Name of the Vulnerable Software and Affected Versions: WP e-Customers Beta WordPress plugin version 0.0.1 Description: The issue concerns a Reflected Cross-Site Scripting problem. It arises because the WP e-Customers Beta WordPress plugin does not properly sanitise and escape a parameter before...

PT-2025-11182 · Tenda · Tenda Rx3

Name of the Vulnerable Software and Affected Versions: Tenda RX3 US RX3V1.0br V16.03.13.11 multi TDE01 Description: The issue is related to a Buffer Overflow vulnerability via the list parameter at the "/goform/SetVirtualServerCfg" API endpoint. This allows attackers to cause a Denial of Service...

PT-2025-11143 · Pagelayer · Pagelayer

Name of the Vulnerable Software and Affected Versions: The Page Builder: Pagelayer versions up to, and including, 1.9.8 Description: The issue is related to insufficient validation on the pagelayer save content function, allowing authenticated attackers with Contributor-level access and above to...

PT-2025-11211 · Dataease · Dataease

Name of the Vulnerable Software and Affected Versions: DataEase versions prior to 2.10.6 Description: DataEase is an open source business intelligence and data visualization tool. A patch bypass issue allows authenticated users to read and deserialize arbitrary files through the background JDBC...

PT-2025-11105 · Softether · Softether Vpn

Name of the Vulnerable Software and Affected Versions: SoftEther VPN version 5.02.5187 Description: The issue is related to a Buffer Overflow in the Internat.c file via the UniToStrForSingleChars function. Recommendations: For SoftEther VPN version 5.02.5187, consider disabling the...