12715 matches found
PT-2025-28479
Name of the Vulnerable Software and Affected Versions: Ivanti Endpoint Manager Mobile EPMM versions prior to 12.5.0.2 Description: The issue allows a remote authenticated attacker with high privileges to achieve remote code execution through OS command injection. Recommendations: For versions pri...
PT-2025-28439 · Qualcomm · Qualcomm Chipsets
Name of the Vulnerable Software and Affected Versions: Qualcomm chipsets versions prior to the fixed version Description: A cryptographic issue occurs due to the use of an insecure connection method while downloading. This issue affects over 100 Qualcomm chipsets used in many Android devices...
PT-2025-28771 · Adobe · Framemaker
Name of the Vulnerable Software and Affected Versions: Adobe Framemaker versions 2020.8 through 2022.6 Description: Adobe Framemaker is susceptible to a NULL Pointer Dereference issue that may result in application denial-of-service. Exploitation of this issue requires a user to open a malicious...
PT-2025-28770 · Adobe · Illustrator
Name of the Vulnerable Software and Affected Versions: Illustrator versions 28.7.6 and earlier Illustrator version 29.5.1 and earlier Description: Illustrator versions 28.7.6 and 29.5.1, and earlier, are affected by an out-of-bounds read issue that may result in the disclosure of sensitive memory...
PT-2025-28486
Name of the Vulnerable Software and Affected Versions: Ivanti Endpoint Manager Mobile EPMM versions prior to 12.5.0.2 Ivanti Endpoint Manager Mobile EPMM version 12.4.0.3 Ivanti Endpoint Manager Mobile EPMM version 12.3.0.3 Description: The issue allows a remote authenticated attacker with high...
PT-2025-28390 · Unknown · Tia Administrator
Name of the Vulnerable Software and Affected Versions: TIA Administrator versions prior to V3.0.6 Description: A vulnerability has been identified in the affected application, allowing low-privileged users to trigger installations by overwriting cache files and modifying the download path. This...
Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code
Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code. Users are recommended to upgrade to version 1.11.4 or 1.12.0, which fix this issue...
PT-2025-28466 · Ivanti · Ivanti Endpoint Manager
Name of the Vulnerable Software and Affected Versions: Ivanti Endpoint Manager versions prior to 2024 SU3 Ivanti Endpoint Manager versions prior to 2022 SU8 Security Update 1 Description: The issue is related to the improper use of encryption in the agent of Ivanti Endpoint Manager. This allows a...
APSB25-59 : Security update available for Adobe InCopy
Adobe has released a security update for Adobe InCopy. This update addresses critical vulnerabilities that could lead to arbitrary code execution...
PT-2025-28760 · Adobe · Indesign Desktop
Name of the Vulnerable Software and Affected Versions: InDesign Desktop versions 19.5.3 and earlier Description: InDesign Desktop versions 19.5.3 and earlier are susceptible to an Access of Uninitialized Pointer issue, potentially leading to arbitrary code execution with current user privileges...
WordPress PowerFolio plugin <= 3.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom JS vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via Custom JS vulnerability discovered by Webbernaut in WordPress Plugin PowerFolio versions = 3.2.0...
CVE-2025-53531 WeGIA allows Uncontrolled Resource Consumption via the fid parameter
WeGIA is a web manager for charitable institutions. The Wegia server has a vulnerability that allows excessively long HTTP GET requests to a specific URL. This issue arises from the lack of validation for the length of the fid parameter. Tests confirmed that the server processes URLs up to 8,142...
CVE-2025-53377 WebGia allows Cross-Site Scripting (XSS) in cadastro_dependente_pessoa_nova.php via the id_funcionario parameter
WeGIA is a web manager for charitable institutions. A Reflected Cross-Site Scripting XSS vulnerability was identified in the cadastrodependentepessoanova.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the idfuncionario parameter. This...
CVE-2025-53376 Dokploy allows attackers to run arbitrary OS commands on the Dokploy host.
Dokploy is a self-hostable Platform as a Service PaaS that simplifies the deployment and management of applications and databases. An authenticated, low-privileged user can run arbitrary OS commands on the Dokploy host. The tRPC procedure docker.getContainersByAppNameMatch interpolates the...
WordPress PW WooCommerce On Sale! plugin <= 1.39 - Broken Access Control Vulnerability
Broken Access Control Vulnerability discovered by theviper17 in WordPress Plugin PW WooCommerce On Sale! versions = 1.39...
LlamaIndex has an XML Entity Expansion vulnerability in its sitemap parser
An XML Entity Expansion vulnerability, also known as a 'billion laughs' attack, exists in the sitemap parser of the run-llama/llamaindex repository, specifically affecting the Papers Loaders package before version 0.3.2 in llama-index v0.10.0 and above through v0.12.29. This vulnerability allows ...
WordPress CSS3 Compare Pricing Tables for WordPress plugin <= 11.6 - Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao KhanhVCI - VNPT in WordPress Plugin CSS3 Compare Pricing Tables for WordPress versions = 11.6...
RHSA-2025:10378 Red Hat Security Advisory: tigervnc security update
Bulletin has no description...