PT-2025-30061

Name of the Vulnerable Software and Affected Versions form-data versions 2.5.4 form-data versions 3.0.0 through 3.0.3 form-data versions 4.0.0 through 4.0.3 Description A vulnerability exists in the form-data JavaScript library due to the use of insufficiently random values when generating bounda...

PT-2025-30077 · Unknown · Agorum Core Open

Name of the Vulnerable Software and Affected Versions: Agorum core open versions 11.9.2 and 11.10.1 Description: The software stores credentials in plaintext. Recommendations: Apply necessary measures to prevent the storage of credentials in plaintext for Agorum core open version 11.9.2. Apply...

PT-2025-30063 · Splashin · Splashin

Name of the Vulnerable Software and Affected Versions: Splashin iOS version 2.0 Description: The Splashin iOS application version 2.0 does not enforce server-side interval restrictions for location updates for free-tier users. Recommendations: Update to a newer version that contains a fix for thi...

PT-2025-30017 · Mattermost · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost versions 9.11.x through 9.11.16 Mattermost versions 10.5.x through 10.5.6 Mattermost versions 10.7.x through 10.7.3 Mattermost versions 10.8.x through 10.8.1 Description: The software fails to verify authorization when retrieving...

PT-2025-30081

Name of the Vulnerable Software and Affected Versions CrushFTP versions prior to 10.8.5 CrushFTP versions prior to 11.3.4 23 Description An authentication bypass issue exists in the web management interface of CrushFTP due to improper validation of the AS2 protocol Applicability Statement 2, a...

PT-2025-30028 · Mattermost · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost versions 10.5.x through 10.5.7 Mattermost versions 9.11.x through 9.11.16 Description: Mattermost fails to negotiate a new token when accepting an invite. This allows a user who intercepts both the invite and the password to send...

PT-2025-30066 · Microsoft · Azure Machine Learning

Name of the Vulnerable Software and Affected Versions: Azure Machine Learning affected versions not specified Description: Weak authentication in Azure Machine Learning allows an authorized attacker to elevate privileges over a network. Recommendations: At the moment, there is no information abou...

Leviton AcquiSuite and Energy Monitoring Hub

RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to craft a malicious payload in URL parameters that would get executed in a client browser when accessed by a user, steal session tokens and control the service. 2. RECOMMENDED PRACTICES CISA recommends users...

PT-2025-29936 · Unknown · Nbcio-Boot

Name of the Vulnerable Software and Affected Versions: nbcio-boot version 1.0.3 Description: nbcio-boot version 1.0.3 contains a SQL injection issue via the userIds parameter at the /sys/user/deleteRecycleBin API endpoint. Recommendations: nbcio-boot version 1.0.3: Sanitize or validate the userId...

Protecting customers from Octo Tempest attacks across multiple industries

In recent weeks, Microsoft has observed Octo Tempest, also known as Scattered Spider, impacting the airlines sector, following previous activity impacting retail, food services, hospitality organizations, and insurance between April and July 2025. This aligns with Octo Tempest’s typical patterns ...

PT-2025-29754 · Unknown · Gymbase Theme Classes

Name of the Vulnerable Software and Affected Versions: GymBase Theme Classes versions n/a through 1.4 Description: GymBase Theme Classes suffers from a SQL Injection issue due to improper neutralization of special elements used in an SQL command. This allows for potential SQL Injection attacks...

PT-2025-29719

Name of the Vulnerable Software and Affected Versions Eclipse GlassFish versions 7.0.16 and earlier Description Eclipse GlassFish is susceptible to login brute-force attacks due to the absence of restrictions on the number of failed login attempts. Recommendations Apply a configuration to limit t...

PT-2025-29824

Name of the Vulnerable Software and Affected Versions Plack-Middleware-Session versions prior to 0.35 Description The default session ID generator in Plack-Middleware-Session for Perl uses a SHA-1 hash seeded with the built-in rand function, the epoch time, and the process ID PID. The PID...

PT-2025-29790 · WordPress · Vergatheme Electrician

Name of the Vulnerable Software and Affected Versions: vergatheme Electrician - Electrical Service WordPress versions through 1.0 Description: The software contains a cross-site scripting issue due to improper neutralization of input during web page generation. This allows for reflected cross-sit...

PT-2025-29752 · WordPress · Wp Delicious

Name of the Vulnerable Software and Affected Versions: WP Delicious versions through 1.8.4 Description: WP Delicious is susceptible to a DOM-Based Cross-site Scripting issue due to improper neutralization of input during web page generation. This allows for potential malicious code execution with...

PT-2025-29737 · WordPress · Crocoblock Jettricks

Name of the Vulnerable Software and Affected Versions: Crocoblock JetTricks versions through 1.5.4.1 Description: The software contains a cross-site scripting XSS issue that allows for stored XSS attacks. This occurs due to improper neutralization of input during web page generation...

PT-2025-29708 · WordPress · Malcure Malware Scanner — #1 Toolset For Wordpress Malware Removal

Name of the Vulnerable Software and Affected Versions: Malcure Malware Scanner — 1 Toolset for WordPress Malware Removal plugin for WordPress versions through 16.8 Description: The Malcure Malware Scanner — 1 Toolset for WordPress Malware Removal plugin for WordPress is vulnerable to Arbitrary Fi...

PT-2025-29837 · Nlnet +7 · Unbound +7

Name of the Vulnerable Software and Affected Versions: Unbound affected versions not specified Description: A multi-vendor cache poisoning vulnerability, named 'Rebirthday Attack', has been discovered in caching resolvers that support EDNS Client Subnet ECS. Unbound is vulnerable when compiled wi...

Security Bulletin: Apache Commons FileUpload used by IBM InfoSphere Identity Insight has a potential vulnerability (CVE-2025-48976))

Summary Apache Commons FileUpload used by IBM InforSphere Identity Insight provided a hard-coded limit of 10kB for the size of the headers associated with a multipart request. A specially crafted request that used a large number of parts with large headers could trigger excessive memory usage...

DSpace is vulnerable to Path Traversal attacks when importing packages using Simple Archive Format

Impact A path traversal vulnerability is possible during the import of an archive in Simple Archive Format, either from command-line ./dspace import command or from the "Batch Import Zip" user interface feature. This vulnerability likely impacts all versions of DSpace 1.x = 7.6.3, 8.0 = 8.1, and...