PT-2025-45566

Name of the Vulnerable Software and Affected Versions aThemes Addons for Elementor plugin for WordPress versions through 1.1.5 Description The aThemes Addons for Elementor plugin for WordPress has a flaw that allows for the injection of malicious web scripts. This is due to inadequate handling of...

CVE-2025-64488 SuiteCRM: Authenticated SQL Injection Possible in Reschedule Call Module

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. In versions 7.14.7 and below and 8.0.0-beta.1 through 8.9.0 8.0.0-beta.1, an attacker can craft a malicious callid that alters the logic of the SQL query or injects arbitrary SQL. An attack can...

CVE-2025-64488 SuiteCRM: Authenticated SQL Injection Possible in Reschedule Call Module

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. In versions 7.14.7 and below and 8.0.0-beta.1 through 8.9.0 8.0.0-beta.1, an attacker can craft a malicious callid that alters the logic of the SQL query or injects arbitrary SQL. An attack can...

CVE-2025-64488

The CVE-2025-64488 affects SuiteCRM. An attacker can craft a malicious call_id to alter SQL query logic or inject arbitrary SQL, leading to unauthorized data access, data exfiltration, and potentially full database compromise. Affected versions: SuiteCRM 7.14.7 and earlier, and 8.0.0-beta.1 throu...

CVE-2025-64488 SuiteCRM: Authenticated SQL Injection Possible in Reschedule Call Module

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. In versions 7.14.7 and below and 8.0.0-beta.1 through 8.9.0 8.0.0-beta.1, an attacker can craft a malicious callid that alters the logic of the SQL query or injects arbitrary SQL. An attack can...

CVE-2025-63783

A Broken Object Level Authorization BOLA vulnerability was discovered in the tRPC project mutation APIs update, delete, add/remove tag of the Onlook web application 0.2.32. The vulnerability exists because the API fails to verify the ownership or membership of the currently authenticated user for...

PT-2025-45466

Name of the Vulnerable Software and Affected Versions Onlook web application version 0.2.32 Description A Broken Object Level Authorization BOLA issue exists in the tRPC project mutation APIs update, delete, add/remove tag of the Onlook web application. The API does not properly validate if the...

PT-2025-45523

Name of the Vulnerable Software and Affected Versions SuiteCRM versions 7.14.7 and below SuiteCRM versions 8.0.0-beta.1 through 8.9.0 Description SuiteCRM is a Customer Relationship Management CRM software application. An attacker can manipulate the call id to modify SQL query logic or inject...

CVE-2025-12489

evernote-mcp-server openBrowser Command Injection Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of evernote-mcp-server. An attacker must first obtain the ability to execute low-privileged code on the target system in...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990533)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990533 advisory. In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix possible memory leak in lpfcrcvpadisc The call to lpfcsli4resumerpi in...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990387)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990387 advisory. In the Linux kernel, the following vulnerability has been resolved: i40e: Fix call trace in setuptxdescriptors After PF reset and ethtool -t there was call trace in...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-990140)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990140 advisory. In the Linux kernel, the following vulnerability has been resolved: ocfs2: free inode when ocfs2getinitinode fails syzbot is reporting busy inodes after unmount, for...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990212)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990212 advisory. In the Linux kernel, the following vulnerability has been resolved: btrfs: fix information leak in btrfsioctllogicaltoino Syzbot reported the following information...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989242)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989242 advisory. In the Linux kernel, the following vulnerability has been resolved: arm64: ftrace: consistently handle PLTs. Sometimes it is necessary to use a PLT entry to call an...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989281)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989281 advisory. In the Linux kernel, the following vulnerability has been resolved: scsi: qedf: Add stagwork to all the vports Call trace seen when creating NPIV ports, only 32 out ...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-990085)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990085 advisory. In the Linux kernel, the following vulnerability has been resolved: nfsd: fix nfs4openowner leak when concurrent nfsd4open occur The action force umountumount -f wil...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-989586)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989586 advisory. In the Linux kernel, the following vulnerability has been resolved: i40e: Fix call trace in setuptxdescriptors After PF reset and ethtool -t there was call trace in...

PT-2025-48856

Уязвимость модуля Call операционной системы HarmonyOS связана с некорректной проверкой безопасности для стандартных элементов. Эксплуатация уязвимости может позволить нарушителю вызвать отказ в обслуживании...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989745)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989745 advisory. In the Linux kernel, the following vulnerability has been resolved: media: venus: hfi: avoid null dereference in deinit If venusprobe fails at pmruntimeputsync the...

PT-2025-48308

Name of the Vulnerable Software and Affected Versions Huawei HarmonyOS versions 5.0.1 through 5.1.0 Huawei HarmonyOS version 6.0.0 Description An improper criterion security check exists within the call module. Successful exploitation of this issue may cause features to perform abnormally...