CVE-2024-45596

Directus is a real-time API and App dashboard for managing SQL database content. An unauthenticated user can access credentials of last authenticated user via OpenID or OAuth2 where the authentication URL did not include redirect query string. This happens because on that endpoint for both OpenId...

CVE-2024-28189

Judge0 is an open-source online code execution system. The application uses the UNIX chown command on an untrusted file within the sandbox. An attacker can abuse this by creating a symbolic link symlink to a file outside the sandbox, allowing the attacker to run chown on arbitrary files outside o...

PT-2025-5736

Name of the Vulnerable Software and Affected Versions: BIG-IP Next Central Manager affected versions not specified Description: The issue concerns the logging of sensitive information in the pgaudit log files when users log in through the web interface or API using local authentication. This...

PT-2025-1660 · Vmware · Horizon Client For Mac

Name of the Vulnerable Software and Affected Versions: Omnissa Horizon Client for macOS affected versions not specified Description: The issue is due to a logic flaw, allowing attackers with user privileges to escalate their privileges to root on the system where the Horizon Client for macOS is...

PT-2025-4854 · Pmd · Pmd

Name of the Vulnerable Software and Affected Versions: PMD affected versions not specified Description: PMD is an extensible multilanguage static code analyzer. The passphrase for the PMD and PMD Designer release signing keys are included in a jar published to Maven Central. Although the private...

PT-2025-2266 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: No information is available about the vulnerable software and its affected versions. Description: The reason for the rejection is mentioned, but no further details are provided about the issue. Recommendations: At the moment, there is no...

PT-2025-5372 · Pam · Pam

Name of the Vulnerable Software and Affected Versions: PAM affected versions not specified Description: The issue allows an unauthenticated attacker to access information in the PAM database. Recommendations: At the moment, there is no information about a newer version that contains a fix for thi...

PT-2025-5373 · Broadcom · Symantec Privileged Access Management

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: An improper input validation allows an unauthenticated attacker to alter PAM logs by sending a specially crafted HTTP request. There is no information...

CVE-2025-24795 The Snowflake Connector for Python uses insecure cache files permissions

The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. On Linux systems, when temporary credential...

CVE-2025-24884 kube-audit-rest's example logging configuration could disclose secret values in the audit log

kube-audit-rest is a simple logger of mutation/creation requests to the k8s api. If the "full-elastic-stack" example vector configuration was used for a real cluster, the previous values of kubernetes secrets would have been disclosed in the audit messages. This vulnerability is fixed in 1.0.16...

PT-2025-4230 · Microsoft · Azure Ai Face Service

Name of the Vulnerable Software and Affected Versions: Azure AI Face Service affected versions not specified Description: An authentication bypass by spoofing in Azure AI Face Service allows an authorized attacker to elevate privileges over a network. This issue has been exploited in real-world...

PT-2025-5638 · Crates.Io · Fast-Float2

Name of the Vulnerable Software and Affected Versions: No specific software or version is mentioned. Description: The issue arises from the fast float2::common::AsciiStr::first method within the AsciiStr struct, which uses the unsafe keyword to read from memory without performing bounds checking...

Security Bulletin:IBM Security QRadar EDR Software contains a vulnerability (CVE-2024-45654)

Summary IBM Security ReaQta is vulnerable to potential unauthorized actions by authenticated users due to reliance on untrusted inputs. The vulnerability have been resolved in the latest update. Vulnerability Details CVEID:CVE-2024-45654 DESCRIPTION: IBM Security ReaQta could allow an authenticat...

SUSE CVE-2025-24367

Cacti is an open source performance and fault management framework. An authenticated Cacti user can abuse graph creation and graph template functionality to create arbitrary PHP scripts in the web root of the application, leading to remote code execution on the server. This vulnerability is fixed...

PT-2025-5665 · Git +1 · Opencv

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A crash has been reported with an UNKNOWN READ crash type. The crash state involves several functions, including cv::PngDecoder::compose frame,...

CVE-2025-24356

fastd is a VPN daemon which tunnels IP packets and Ethernet frames over UDP. When receiving a data packet from an unknown IP address/port combination, fastd will assume that one of its connected peers has moved to a new address and initiate a reconnect by sending a handshake packet. This "fast...

CVE-2025-22604

CVE-2025-22604 affects Cacti, where a flaw in the multi-line SNMP result parser allows authenticated users to inject malformed OIDs; processing by ss_net_snmp_disk_io() or ss_net_snmp_disk_bytes() uses part of an OID as a key in an array that feeds a system command, causing a command execution vu...

CVE-2024-54146 Cacti has a SQL Injection vulnerability when view host template

Cacti is an open source performance and fault management framework. Cacti has a SQL injection vulnerability in the template function of hosttemplates.php using the graphtemplate parameter. This vulnerability is fixed in 1.2.29...

PT-2025-5664 · Git +1 · Ghostscript

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a stack-buffer-underflow read error. Technical details include a crash type of Stack-buffer-underflow READ 4, with the crash stat...

PT-2025-4014 · Joeybling · Bootplus

Name of the Vulnerable Software and Affected Versions: JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d Description: A vulnerability has been found in the qrCode function of the file src/main/java/io/github/controller/QrCodeController.java. The manipulation of the text argument...