PT-2025-4631 · Unknown · Embedpress Document Block – Upload & Embed Docs

Name of the Vulnerable Software and Affected Versions: Document Block – Upload & Embed Docs versions 1.1.0 and earlier Description: The issue is related to a Missing Authorization vulnerability in the EmbedPress Document Block – Upload & Embed Docs. This vulnerability affects the ability to...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS through the generateRow method. An attacker can execute arbitrary JavaScript code in the user's browser by crafting a malicious XML file that bypasses the XSS sanitizer when processed and rendered as HTML...

CVE-2025-24883 go-ethereum has a DoS via malicious p2p message

go-ethereum geth is a golang execution layer implementation of the Ethereum protocol. A vulnerable node can be forced to shutdown/crash using a specially crafted message. This vulnerability is fixed in 1.14.13...

PT-2025-1610 · WordPress · Storely

Name of the Vulnerable Software and Affected Versions: Storely theme for WordPress versions up to and including 16.6 Description: The issue allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts in pages. This is due to insufficient input sanitizati...

CVE-2025-24793

The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. A function from the...

CVE-2025-24795

The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. On Linux systems, when temporary credential...

GHSA-2VPQ-FH52-J3WV snowflake-connector-python vulnerable to SQL Injection in write_pandas

Issue Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. A function from the snowflake.connector.pandastools module is vulnerable to SQL injection. This vulnerability affects versions 2.2.5 through 3.13.0. Snowflake fixed the issue in version 3.13.1...

CVE-2025-23211

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. A Jinja2 SSTI vulnerability allows any user to execute commands on the server. In the case of the provided Docker Compose file as root. This vulnerability is fixed in 1.5.24...

CVE-2025-24365

CVE-2025-24365 affects vaultwarden (unofficial Bitwarden-compatible server in Rust, previously bitwarden_rs). The description in connected sources shows an attacker can obtain owner rights of another organization by knowing the victim organization ID and being the owner/admin of a different organ...

CVE-2025-24364 vaultwarden allows RCE in the admin panel

vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwardenrs. Attacker with authenticated access to the vaultwarden admin panel can execute arbitrary code in the system. The attacker could then change some settings to use sendmail as mail agent but adjus...

CVE-2024-54145

Cacti is an open source performance and fault management framework. Cacti has a SQL injection vulnerability in the getdiscoveryresults function of automationdevices.php using the network parameter. This vulnerability is fixed in 1.2.29...

CVE-2024-54146

Cacti is an open source performance and fault management framework. Cacti has a SQL injection vulnerability in the template function of hosttemplates.php using the graphtemplate parameter. This vulnerability is fixed in 1.2.29...

UBUNTU-CVE-2024-54145

Cacti is an open source performance and fault management framework. Cacti has a SQL injection vulnerability in the getdiscoveryresults function of automationdevices.php using the network parameter. This vulnerability is fixed in 1.2.29...

CVE-2024-54145 Cacti has a SQL Injection vulnerability when request automation devices

Cacti is an open source performance and fault management framework. Cacti has a SQL injection vulnerability in the getdiscoveryresults function of automationdevices.php using the network parameter. This vulnerability is fixed in 1.2.29...

CVE-2024-54146 Cacti has a SQL Injection vulnerability when view host template

Cacti is an open source performance and fault management framework. Cacti has a SQL injection vulnerability in the template function of hosttemplates.php using the graphtemplate parameter. This vulnerability is fixed in 1.2.29...

CVE-2024-45598

Cacti is an open source performance and fault management framework. Prior to 1.2.29, an administrator can change the Poller Standard Error Log Path parameter in either Installation Step 5 or in Configuration-Settings-Paths tab to a local file inside the server. Then simply going to Logs tab and...

PT-2025-2800 · Adguard · Adguard Application

Name of the Vulnerable Software and Affected Versions: AdGuard Application versions 7.18.1 and earlier Description: The issue allows an attacker to execute arbitrary code via a crafted payload to the fontMatrix component. This enables the execution of arbitrary code, potentially leading to...

PT-2025-5556 · Unknown · Notfound Bridge Core

Name of the Vulnerable Software and Affected Versions: NotFound Bridge Core versions n/a through 3.3 Description: The issue is related to a Missing Authorization vulnerability in NotFound Bridge Core. This vulnerability affects the authorization process, potentially allowing unauthorized access...

PT-2025-4925 · Unknown · Rsvpmaker Volunteer Roles

Name of the Vulnerable Software and Affected Versions: RSVPMaker Volunteer Roles versions 1.5.1 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows reflected Cross-site Scripting XSS. This enables attackers to inject malicious...

Important: python3-jinja2

Issue Overview: Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to...