PT-2025-28245 · Mediawiki · Mediawiki +1

Name of the Vulnerable Software and Affected Versions: Mediawiki - AbuseFilter Extension versions 1.39.0 through 1.39.12 Mediawiki - AbuseFilter Extension versions 1.42.0 through 1.42.6 Mediawiki - AbuseFilter Extension versions 1.43.0 through 1.43.1 Description: The issue is related to a Missing...

PT-2025-30226 · Tenda · Tenda Ac6

Name of the Vulnerable Software and Affected Versions: Tenda AC6 version 15.03.06.50 Description: A critical vulnerability exists in Tenda AC6 due to a buffer overflow in the setparentcontrolinfo function of the httpd component. The issue is exploitable remotely. Recommendations: Update Tenda AC6...

PT-2025-28230 · Splunk · Splunk Enterprise

Name of the Vulnerable Software and Affected Versions: Splunk Enterprise versions prior to 9.4.3 Splunk Enterprise versions prior to 9.3.5 Splunk Enterprise versions prior to 9.2.7 Splunk Enterprise versions prior to 9.1.10 Description: A user with a role containing the high-privilege capabilitie...

PT-2025-28229 · Splunk · Splunk Enterprise +1

Name of the Vulnerable Software and Affected Versions: Splunk Enterprise versions prior to 9.4.2 Splunk Enterprise versions prior to 9.3.5 Splunk Enterprise versions prior to 9.2.6 Splunk Enterprise versions prior to 9.1.9 Splunk Cloud Platform versions prior to 9.3.2411.103 Splunk Cloud Platform...

PT-2025-28149

Name of the Vulnerable Software and Affected Versions: llama index versions v0.12.21 through v0.12.28 Description: An XML Entity Expansion vulnerability, also known as a 'billion laughs' attack, exists in the sitemap parser of the run-llama/llama index repository. This issue allows an attacker to...

PT-2025-28168 · Unknown +1 · Urlshortener Extension +1

Name of the Vulnerable Software and Affected Versions: Mediawiki - UrlShortener Extension versions 1.42.X through 1.42.6 Mediawiki - UrlShortener Extension versions 1.43.X through 1.43.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known a...

PT-2025-28037 · Vercel · Vercel Hyper

Name of the Vulnerable Software and Affected Versions: vercel hyper versions up to 3.4.1 Description: A problematic vulnerability has been found in vercel hyper, affecting the function expand/braceExpand/ignoreMap of the file hyper/bin/rimraf-standalone.js. This issue leads to inefficient regular...

PT-2025-28029 · Alinto +1 · Sogo +1

Name of the Vulnerable Software and Affected Versions: Alinto SOPE SOGo versions 2.0.2 through 5.12.2 Description: This issue involves a NULL pointer dereference in sope-core/NGExtensions/NGHashMap.m that can lead to a crash of the SOGo application. The vulnerability occurs when a request contain...

PT-2025-28032 · Rustls · Rustls

Name of the Vulnerable Software and Affected Versions: rustls versions 0.23.13 through 0.23.17 Description: The issue allows a panic via a fragmented TLS ClientHello when rustls::server::Acceptor::accept is used. Recommendations: For rustls versions 0.23.13 through 0.23.17, update to version...

sudo-1.9.17p1-1.1 on GA media (moderate)

sudo-1.9.17p1-1.1 on GA media Announcement ID: openSUSE-SU-2025:15298-1 Rating: moderate Cross-References: CVE-2025-32462 CVE-2025-32463 CVSS scores: CVE-2025-32462 SUSE : 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2025-32462 SUSE : 7.3...

PT-2025-29189 · Tenda · Tenda O3V2

Name of the Vulnerable Software and Affected Versions: Tenda O3V2 version 1.0.0.123880 Description: A critical issue exists in Tenda O3V2. The formWifiBasicSet function within the /goform/setWrlBasicInfo file of the httpd component is susceptible to a stack-based buffer overflow. This occurs...

PT-2025-28018 · Mediawiki · Mediawiki Securepoll Extension

Name of the Vulnerable Software and Affected Versions: MediaWiki SecurePoll extension versions 1.39.X through 1.39.12 MediaWiki SecurePoll extension versions 1.42.X through 1.42.6 MediaWiki SecurePoll extension versions 1.43.X through 1.43.1 Description: The issue arises from the lack of validati...

PT-2025-27873 · WordPress · Wp Fancybox

Name of the Vulnerable Software and Affected Versions: Noor Alam WP fancybox versions 1.0.0 through 1.0.4 Description: The issue is related to improper neutralization of input during web page generation, which allows for stored Cross-site Scripting XSS. This enables attackers to inject malicious...

PT-2025-27885 · Unknown · Amazewp Fluxtore

Name of the Vulnerable Software and Affected Versions: amazewp fluXtore versions 1.6.0 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows the exploitation of incorrectly configured access control security levels. Recommendations: For amazewp...

PT-2025-27941 · Unknown · Thanhtungtnt Video List Manager

Name of the Vulnerable Software and Affected Versions: thanhtungtnt Video List Manager versions 1.7 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows attackers to execute malicious...

PT-2025-27879 · Unknown · Contact Us Page – Contact People

Name of the Vulnerable Software and Affected Versions: Contact Us page - Contact people LITE versions 3.7.4 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection,...

PT-2025-27881 · Cwd · Cwd Web Designer Easy Elements Hider

Name of the Vulnerable Software and Affected Versions: CWD Web Designer Easy Elements Hider versions 2.0 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for Stored Cross-site Scripting XSS. This means that an attacker can...

PT-2025-27928 · Inspirythemes · Realhome

Name of the Vulnerable Software and Affected Versions: Inspirythemes RealHomes versions through 4.4.0 Description: The issue is related to an Incorrect Privilege Assignment vulnerability that allows Privilege Escalation in InspiryThemes RealHomes. Recommendations: For versions through 4.4.0, upda...

PT-2025-27905 · Click & Pledge · Click & Pledge Connect

Name of the Vulnerable Software and Affected Versions: Click & Pledge Connect versions 25.04010101 through WP6.8 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for privilege escalation...

PT-2025-28022 · Zipkin +1 · Zipkin +1

Name of the Vulnerable Software and Affected Versions: Zipkin versions prior to 3.5.2 Description: The issue is related to the exposure of heap dump information through the "/heapdump" endpoint, which is associated with the use of Spring Boot Actuator. This endpoint is similar to a previously...