PT-2025-38173

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A flaw was discovered in the Linux kernel related to the alloc sk msg function. Specifically, alloc sk msg could be called from a non-sleepable context, potentially leading to issues...

PT-2025-38157

Name of the Vulnerable Software and Affected Versions: Perplexity AI GPT-4 affected versions not specified Description: An issue in Perplexity AI GPT-4 allows a remote attacker to obtain sensitive information via a GET parameter. Recommendations: At the moment, there is no information about a new...

CVE-2025-55115

CVE-2025-55115 affects BMC Control-M/Agent versions 9.0.18–9.0.20 (and potentially earlier unsupported builds). The vulnerability is a path traversal in the Control-M/Agent that can enable local privilege escalation when an attacker has access to the system running the Agent. Impact is described ...

PT-2025-46758

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel related to race conditions when using task locktsk-group leader within the sys prlimit64 function and its associated do prlimit path. Specifically, the...

CVE-2025-6088 Improper Authorization in danny-avila/librechat

In version 0.7.8 of danny-avila/librechat, improper authorization controls in the conversation sharing feature allow unauthorized access to other users' conversations if the conversation ID is known. Although UUIDv4 conversation IDs are generated server-side and are difficult to brute force, they...

PT-2025-44688

Name of the Vulnerable Software and Affected Versions Google Chrome affected versions not specified Description A flaw exists in Google Chrome that could allow attackers to impact the system. The issue is an out-of-bounds read within the V8 JavaScript engine. Microsoft Edge, being Chromium-based,...

PT-2025-36383

Name of the Vulnerable Software and Affected Versions: versions prior to SMU affected versions not specified Description: An integer overflow in the SMU could allow a privileged attacker to potentially write memory beyond the end of the reserved dRAM area, resulting in loss of integrity or...

PT-2025-36343

Name of the Vulnerable Software and Affected Versions: ERP versions prior to 14.89.2 ERP versions 15.0.0 through 15.75.1 Description: ERP, a free and open source Enterprise Resource Planning tool, is susceptible to error-based SQL Injection due to insufficient validation of parameters. This allow...

CVE-2025-58371

CVE-2025-58371 affects Roo Code (versions ≤ 3.26.6). A GitHub workflow used unsanitized pull request metadata in a privileged context, enabling an attacker to craft input that caused Remote Code Execution (RCE) on the Actions runner. The runner’s broad permissions and access to repository secrets...

CVE-2025-57807 ImageMagick BlobStream Forward-Seek Under-Allocation

ImageMagick is free and open-source software used for editing and manipulating digital images. ImageMagick versions lower than 14.8.2 include insecure functions: SeekBlob, which permits advancing the stream offset beyond the current end without increasing capacity, and WriteBlob, which then expan...

Dave Gamble cJSON version 1.7.2 and earlier contains a CWE-415: Double Free vulnerability in cJSON library that can result in Possible crash or RCE. This attack appear to be exploitable via Attacker must be able to force victim to print JSON data, depending on how cJSON library is used this could be either local or over a network. This vulnerability appears to have been fixed in 1.7.3.

...

PT-2025-36088

Name of the Vulnerable Software and Affected Versions: SystemSettingsFragment.java affected versions not specified Description: A logic error exists in the initPhoneSwitch function within SystemSettingsFragment.java. This issue may lead to a Factory Reset Protection FRP bypass, potentially...

CVE-2025-58161 MobSF Path Traversal in GET /download/<filename> using absolute filenames

MobSF is a mobile application security testing tool used. In version 4.4.0, the GET /download/ route uses string path verification via os.path.commonprefix, which allows an authenticated user to download files outside the DWDDIR download directory from "neighboring" directories whose absolute pat...

CVE-2025-30277 Qsync Central

An improper certificate validation vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Qsync Central...

CVE-2025-29894 Qsync Central

An SQL injection vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Qsync Central 4.5.0.7 2025/04/23...

PT-2025-35199

Name of the Vulnerable Software and Affected Versions: Gitblit affected versions not specified Description: This issue is an authentication bypass vulnerability in Gitblit, an open-source Java stack for managing Git repositories. The vulnerability involves exploiting opportunities within the MINA...

CVE-2025-58050 PCRE2: heap-buffer-overflow read in match_ref due to missing boundary restoration in SCS

The PCRE2 library is a set of C functions that implement regular expression pattern matching. In version 10.45, a heap-buffer-overflow read vulnerability exists in the PCRE2 regular expression matching engine, specifically within the handling of the scs:... Scan SubString verb when combined with...

PT-2025-34847 · Clininet · Clininet

Name of the Vulnerable Software and Affected Versions: CliniNET affected versions not specified Description: The vulnerability allows unauthenticated users to download a file containing session ID data by directly accessing the /cgi-bin/CliniNET.prd/utils/userlogxls.pl endpoint. Recommendations: ...

Google Chrome Security Update (stable-channel-update-for-desktop_26-2025-08) - Linux

Google Chrome is prone to an use after free vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:google:chrome";...

Linux Distros Unpatched Vulnerability : CVE-2020-15138

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Prism is vulnerable to Cross-Site Scripting. The easing preview of the Previewers plugin has an XSS vulnerability that allows attackers to execute arbitrary cod...