PT-2025-5530 · Unknown · Herd Effects

Name of the Vulnerable Software and Affected Versions: Herd Effects versions through 6.2.1 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. Recommendations: For versions through 6.2.1, update t...

try/except* clauses could allow bypass RestrictedPython via type confusion bug in the CPython interpreter

Impact Via a type confusion bug in the CPython interpreter when using try/except RestrictedPython could be bypassed. We believe this should be fixed upstream in Python itself until that we remove support for try/except from RestrictedPython. It has been fixed for some Python versions. Patches...

PT-2025-4990 · Unknown · Notfound Youtube Video Grid

Name of the Vulnerable Software and Affected Versions: NotFound Youtube Video Grid versions 1.9 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for reflected cross-site scripting XSS. This means an attacker can inject...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the generateNavigation function, which translates the XLSX file into an HTML representation and displays it in the response without proper sanitization for the sheet's title. Remediation There is no fixed...

CVE-2024-24420

A reachable assertion in the decodelinkedtiie function of Magma = 1.8.0 fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486 allows attackers to cause a Denial of Service DoS via a crafted NAS packet...

PT-2025-5255

Name of the Vulnerable Software and Affected Versions Rara Theme UltraLight versions 1.2 and earlier Description The issue is related to improper neutralization of input during web page generation, which allows for reflected cross-site scripting XSS. This means an attacker can inject malicious...

PT-2025-4683 · Brizy Pro · Brizy Pro

Name of the Vulnerable Software and Affected Versions: Brizy Pro versions prior to 2.6.1 Description: The issue is related to improper neutralization of input during web page generation, which allows for reflected Cross-site Scripting XSS. This enables an attacker to inject malicious scripts into...

CVE-2025-24014

Vim is an open source, command line text editor. A segmentation fault was found in Vim before 9.1.1043. In silent Ex mode -s -e, Vim typically doesn't show a screen and just operates silently in batch mode. However, it is still possible to trigger the function that handles the scrolling of a gui...

CVE-2025-23220

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A SQL Injection vulnerability was identified in the WeGIA application, specifically in the adicionarraca.php endpoint. This vulnerability allows attackers to execute arbitrary SQL commands in...

PT-2025-3648 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to the fixed version Description: The issue is related to the btrfs compression functionality in the Linux kernel, specifically with the zlib compression path for S390 hardware acceleration. The problem arises when...

PT-2025-3856 · WordPress · Jetengine

Name of the Vulnerable Software and Affected Versions: JetEngine plugin for WordPress versions up to, and including, 3.6.2 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows authenticated attackers with...

ABB AC500v3 3.7.0.569 Directory Traversal / Privilege Escalation Exploit

------------------------------------------------------------------------------- title| Multiple Vulnerabilities in ABB AC500v3 product| ABB AC500v3 vulnerable version| =3.7.0.569 fixed version| 3.8.0 CVE number| CVE-2024-12429, CVE-2024-12430 impact| High homepage| https://global.abb found|...

PT-2025-4658 · Data443 · Data443 Posts Footer Manager

Name of the Vulnerable Software and Affected Versions: Data443 Posts Footer Manager versions n/a through 2.1.0 Description: The issue is related to improper neutralization of input during web page generation, which allows stored cross-site scripting XSS. This means that an attacker can inject...

PT-2025-4653 · Infomaniak · Infomaniak Staff Vod

Name of the Vulnerable Software and Affected Versions: Infomaniak Staff VOD Infomaniak versions 1.5.9 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For version...

CVE-2024-56511 DataEase has an unauthorized vulnerability

DataEase is an open source data visualization analysis tool. Prior to 2.10.4, there is a flaw in the authentication in the io.dataease.auth.filter.TokenFilter class, which can be bypassed and cause the risk of unauthorized access. In the io.dataease.auth.filter.TokenFilter class,...

CVE-2024-56511 DataEase has an unauthorized vulnerability

DataEase is an open source data visualization analysis tool. Prior to 2.10.4, there is a flaw in the authentication in the io.dataease.auth.filter.TokenFilter class, which can be bypassed and cause the risk of unauthorized access. In the io.dataease.auth.filter.TokenFilter class,...

SUSE CVE-2024-56362

Navidrome is an open source web-based music collection server and streamer. Navidrome stores the JWT secret in plaintext in the navidrome.db database file under the property table. This practice introduces a security risk because anyone with access to the database file can retrieve the secret. Th...

CVE-2025-22151

Strawberry GraphQL is a library for creating GraphQL APIs. Starting in 0.182.0 and prior to version 0.257.0, a type confusion vulnerability exists in Strawberry GraphQL's relay integration that affects multiple ORM integrations Django, SQLAlchemy, Pydantic. The vulnerability occurs when multiple...

Covert Timing Channel

Overview openssl is a package that wraps the OpenSSL library. Affected versions of this package are vulnerable to Covert Timing Channel through the decryption process. An attacker can decrypt messages or forge signatures by exchanging a large number of messages with the vulnerable service Marvin...

PT-2025-4446 · Unknown · Cf7Save Extension

Name of the Vulnerable Software and Affected Versions: Cf7Save Extension versions prior to 1 Description: The issue is related to improper neutralization of input during web page generation, which allows reflected Cross-site Scripting XSS. This enables attackers to inject malicious scripts into w...