PT-2025-39083

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.4.0 through 7.4.3.112 Liferay DXP versions 2023.Q3.1 through 2023.Q3.10 Liferay DXP versions 2023.Q4.0 through 2023.Q4.7 Liferay Portal versions 7.4 GA through update 92 Description The Batch Engine does not correctly...

GHSA-GWRF-JF3H-W649 vulnerabilities

Vulnerabilities for packages: linkerd2-proxy-init, k8sgpt-operator, vault-benchmark, addon-resizer, vexctl, dagdotdev, kuberay-operator, secrets-store-csi-driver-provider-aws, ctop, local-path-provisioner, docker-credential-ecr-login, vault-k8s, newrelic-fluent-bit-output, blobfuse2,...

CVE-2025-47906 vulnerabilities

Vulnerabilities for packages: terraform-provider-sendgrid-fips, nvidia-nsight-compute-13.2, hivemind, prometheus-bind-exporter, cloud-provider-aws, lvm-driver, karpenter-fips, sftpgo-plugin-geoipfilter, nvidia-nsight-compute-12.8, kubernetes-dashboard-fips, blob-csi-fips, consul-fips, dagdotdev,...

GHSA-GWRF-JF3H-W649 vulnerabilities

Vulnerabilities for packages: terraform-provider-sendgrid-fips, nvidia-nsight-compute-13.2, hivemind, prometheus-bind-exporter, cloud-provider-aws, lvm-driver, karpenter-fips, sftpgo-plugin-geoipfilter, nvidia-nsight-compute-12.8, kubernetes-dashboard-fips, blob-csi-fips, consul-fips, dagdotdev,...

SUSE CVE-2025-58450

pREST PostgreSQL REST, is an API that delivers an application on top of a Postgres database. SQL injection is possible in versions prior to 2.0.0-rc3. The validation present in versions prior to 2.0.0-rc3 does not provide adequate protection from injection attempts. Version 2.0.0-rc3 contains a...

WordPress Password Reset with Code plugin < 0.0.17 - Insecure Password Reset Code Creation vulnerability

Insecure Password Reset Code Creation vulnerability discovered by Tommaso Gregori p1s1o in WordPress Plugin Password Reset with Code for WordPress REST API versions 0.0.17...

CVE-2025-5305 Password Reset with Code < 0.0.17 - Insecure Password Reset Code Creation

The Password Reset with Code for WordPress REST API WordPress plugin before 0.0.17 does not use cryptographically sound algorithms to generate OTP codes, potentially leading to account takeovers...

PT-2025-38299

Name of the Vulnerable Software and Affected Versions Password Reset with Code for WordPress REST API plugin versions prior to 0.0.17 Description The plugin does not employ cryptographically secure algorithms for generating One-Time Password OTP codes, which could allow for account takeovers...

CVE-2025-9808 The Events Calendar <= 6.15.2 - Missing Authorization to Unauthenticated Password-Protected Information Disclosure

The The Events Calendar plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 6.15.2 via the REST endpoint. This makes it possible for unauthenticated attackers to extract information about password-protected vendors or venues...

CVE-2025-10227

Missing Encryption of Sensitive Data CWE-311 in the Object Archive component in AxxonSoft Axxon One C-Werk before 2.0.8 on Windows and Linux allows a local attacker with access to exported storage or stolen physical drives to extract sensitive archive data in plaintext via lack of encryption at...

Vulnerabilities fixed in Cisco NX-OS Software

Cisco has fixed vulnerabilities in Cisco NX-OS Software for Nexus 3000 and 9000 Series Switches. The vulnerabilities are in several features of the Cisco NX-OS Software, including IS-IS, PIM6, logging, command-line interface CLI, and the REST API of the Nexus Dashboard. These vulnerabilities can ...

PT-2025-39377

Name of the Vulnerable Software and Affected Versions MikroTik RouterOS version 7 Description A buffer overflow issue exists in MikroTik RouterOS 7. The issue is located in the parse json element function within the libjson.so component, specifically accessible through the /rest/ip/address/print...

CVE-2025-10227

Missing Encryption of Sensitive Data CWE-311 in the Object Archive component in AxxonSoft Axxon One C-Werk before 2.0.8 on Windows and Linux allows a local attacker with access to exported storage or stolen physical drives to extract sensitive archive data in plaintext via lack of encryption at...

CVE-2025-10227 Lack of Encryption in Object Archive in AxxonSoft Axxon One (C-Werk) before 2.0.8

Missing Encryption of Sensitive Data CWE-311 in the Object Archive component in AxxonSoft Axxon One C-Werk before 2.0.8 on Windows and Linux allows a local attacker with access to exported storage or stolen physical drives to extract sensitive archive data in plaintext via lack of encryption at...

CVE-2025-10227 Lack of Encryption in Object Archive in AxxonSoft Axxon One (C-Werk) before 2.0.8

Missing Encryption of Sensitive Data CWE-311 in the Object Archive component in AxxonSoft Axxon One C-Werk before 2.0.8 on Windows and Linux allows a local attacker with access to exported storage or stolen physical drives to extract sensitive archive data in plaintext via lack of encryption at...

Cross-Site Scripting (XSS)

express-gateway is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper input handling in the REST Endpoint lib/rest/routes/apps.js, which allows an attacker to remotely inject and execute malicious scripts...

PT-2025-37046

Name of the Vulnerable Software and Affected Versions: AxxonSoft Axxon One versions prior to 2.0.8 Description: The Object Archive component in AxxonSoft Axxon One lacks encryption of sensitive data at rest. This allows a local attacker with access to exported storage or stolen physical drives to...

Linux Distros Unpatched Vulnerability : CVE-2022-48318

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - No authorisation controls in the RestAPI documentation for Tribe29's Checkmk = 2.1.0p13 and Checkmk = 2.0.0p29 which may lead to unintended information disclosu...

Linux Distros Unpatched Vulnerability : CVE-2022-48317

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Expired sessions were not securely terminated in the RestAPI for Tribe29's Checkmk = 2.1.0p10 and Checkmk = 2.0.0p28 allowing an attacker to use expired session...

Linux Distros Unpatched Vulnerability : CVE-2023-38888

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cross Site Scripting vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to obtain sensitive information and execute arbitrary code v...