CVE-2025-66097

Cross-Site Request Forgery CSRF vulnerability in Igor Jerosimić I Order Terms i-order-terms allows Cross Site Request Forgery.This issue affects I Order Terms: from n/a through = 1.5.0...

EUVD-2025-198458

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in sonalsinha21 SKT Skill Bar skt-skill-bar allows DOM-Based XSS.This issue affects SKT Skill Bar: from n/a through = 2.5...

PT-2025-47807

Name of the Vulnerable Software and Affected Versions ESF-IDF versions 5.3.4 through 5.5.1 Description ESF-IDF, the Espressif Internet of Things IOT Development Framework, contains a flaw in its hardware JPEG decoder when used with the ESP32-P4. The software parser does not perform adequate...

PT-2025-47785

Name of the Vulnerable Software and Affected Versions Vault Terraform Provider versions prior to 5.5.0 Description The Vault Terraform Provider was configured with an insecure default setting for the LDAP auth method. Specifically, the deny null bind parameter defaulted to false, which could allo...

CVE-2025-65032

Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an Insecure Direct Object Reference IDOR vulnerability allows any authenticated user to change the display names of other participants in polls without being an admin or the poll owner. By manipulating the...

EUVD-2025-198343

Improper input neutralization in the stats-conversions.php script in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes potential information disclosure and session hijacking via a stored XSS attack...

firefox: thunderbird: Race condition in the Graphics component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Race condition in the Graphics component...

CVE-2025-65033

Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an authorization flaw in the poll management feature allows any authenticated user to pause or resume any poll, regardless of ownership. The system only uses the public pollId to identify polls, and it does not...

EUVD-2025-198232

Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an authorization flaw in the poll management feature allows any authenticated user to pause or resume any poll, regardless of ownership. The system only uses the public pollId to identify polls, and it does not...

Bridgetech VBC Server & Element Manager 安全漏洞

Bridgetech VBC Server & Element Manager is a broadcast core software platform from Bridgetech Norway. A security vulnerability exists in Bridgetech VBC Server & Element Manager versions 6.5.0-9 through 6.5.0-10, which originates from a stored cross-site script in the addName parameter of the...

PT-2025-47526

Name of the Vulnerable Software and Affected Versions bridgetech VBC Server & Element Manager versions 6.5.0-9 through 6.5.0-10 Description An issue exists in bridgetech VBC Server & Element Manager that allows unauthorized attackers to create and delete arbitrary accounts. Recommendations Update...

Bridgetech probes 安全漏洞

Bridgetech probes is a series of media link probes from the Norwegian company Bridgetech. A security vulnerability exists in Bridgetech probes, which originates from an attacker being able to obtain sensitive information such as administrator passwords via the /probe/core/setup/passwd endpoint. T...

WordPress Responsive Lightbox & Gallery plugin <= 2.5.3 - Authenticated (Author+) Server-Side Request Forgery vulnerability

Authenticated Author+ Server-Side Request Forgery vulnerability discovered by Dmitrii Ignatyev - CleanTalk Inc in WordPress Plugin Responsive Lightbox versions = 2.5.3...

PT-2025-47269

Name of the Vulnerable Software and Affected Versions Serv-U versions prior to 15.5.3 Description A Path Restriction Bypass exists in Serv-U that allows a malicious actor with administrative privileges to execute code on a directory. This requires administrative privileges to exploit. On Windows...

OPENSUSE-SU-2025:15739-1 itextpdf-5.5.13.4-1.1 on GA media

These are all security issues fixed in the itextpdf-5.5.13.4-1.1 package on the GA media of openSUSE Tumbleweed...

MAL-2025-190500 Malicious code in com.mixpanel.unity (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a617ed7539b6703818676ef051a6c12331b0e014026d1b56fb7d72775d7ad5a1 The package com.mixpanel.unity was found to contain malicious code. Source: ossf-package-analysis...

CVE-2025-13209 bestfeng oa_git_free WorkflowPredefineController.java updateWriteBack xml external entity reference

A weakness has been identified in bestfeng oagitfree up to 9.5. This affects the function updateWriteBack of the file yimioa-oa9.5\server\c-flow\src\main\java\com\cloudweb\oa\controller\WorkflowPredefineController.java. This manipulation of the argument writeProp causes xml external entity...

PT-2025-47061

Name of the Vulnerable Software and Affected Versions bestfeng oa git free versions up to 9.5 Description A flaw exists in bestfeng oa git free up to version 9.5. The issue is related to the manipulation of the writeProp argument within the updateWriteBack function located in the file...

oa_git_free 代码问题漏洞

bestfeng oagitfree line cloud process engine is an enterprise automation process platform from China Cloud OA bestfeng company. A code issue vulnerability exists in oagitfree 9.5 and earlier versions, which originates from the parameter in the file...

WordPress SKT Skill Bar plugin <= 2.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin SKT Skill Bar versions = 2.5...