PT-2025-19991 · Crestron · Crestron Automate Vx

Name of the Vulnerable Software and Affected Versions: Crestron Automate VX versions 5.6.8161.21536 through 6.4.0.49 Description: The issue allows privilege escalation. It affects Crestron Automate VX, with no specific details on the number of potentially affected devices or real-world incidents...

PT-2025-19984 · Zitadel · Zitadel

Name of the Vulnerable Software and Affected Versions: ZITADEL versions prior to 3.0.0 ZITADEL versions prior to 2.71.9 ZITADEL versions prior to 2.70.10 Description: The issue concerns the Session API in ZITADEL, which allows developers to manage user sessions and use IdPs for authentication...

PT-2025-19959 · Seacms · Seacms

Name of the Vulnerable Software and Affected Versions: SeaCMS version 13.3 Description: A SQL injection issue was discovered in the admin comment news.php component. Recommendations: For SeaCMS version 13.3, update to a version that fixes the SQL injection vulnerability in the admin comment...

PT-2025-19958

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.4.0 through 7.4.3.131 Liferay DXP versions 2024.Q1.1 through 2024.Q4.5 Description A reflected cross-site scripting XSS issue exists in Liferay Portal and DXP. This allows a remote, unauthenticated attacker to inject...

PT-2025-19970 · Unknown · Passport-Wsfed-Saml2

Name of the Vulnerable Software and Affected Versions: passport-wsfed-saml2 versions 3.0.5 through 4.6.3 Description: A vulnerability in passport-wsfed-saml2 allows an attacker to impersonate any user during SAML authentication by tampering with a valid SAML response. This can be done by adding...

CBL Mariner 2.0 Security Update: kernel (CVE-2025-21731)

The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-21731 advisory. - In the Linux kernel, the following vulnerability has been resolved: nbd: don't allow reconnect after...

PT-2025-19895 · Unknown · Openharmony

Name of the Vulnerable Software and Affected Versions: OpenHarmony versions prior to 5.0.3 Description: The issue allows a local attacker to cause a denial of service DOS through a NULL pointer dereference. Recommendations: For versions prior to 5.0.3, update to a version that contains a fix for...

PT-2025-19832 · WordPress · Layoutboxx

Name of the Vulnerable Software and Affected Versions: LayoutBoxx plugin for WordPress versions up to and including 0.3.1 Description: The issue allows unauthenticated attackers to execute arbitrary shortcodes due to the software not properly validating a value before running do shortcode. This...

CBL Mariner 2.0 Security Update: kernel (CVE-2025-21683)

The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-21683 advisory. - In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bpfskselectreuseport memory lea...

Craft CMS Contains a Potential Remote Code Execution Vulnerability via Twig SSTI

Craft CMS contains a potential remote code execution vulnerability via Twig SSTI. You must have administrator access and ALLOWADMINCHANGES must be enabled for this to work. https://craftcms.com/knowledge-base/securing-craftset-allowAdminChanges-to-false-in-production Note: This is a follow-up to...

CVE-2025-24977 OpenCTI has remote code execution and sensitive secrets exposed through web hook

OpenCTI is an open cyber threat intelligence CTI platform. Prior to version 6.4.11 any user with the capability manage customizations can execute commands on the underlying infrastructure where OpenCTI is hosted and can access internal server side secrets by misusing the web-hooks. Since the...

RHSA-2025:4451 Red Hat Security Advisory: yelp security update

Bulletin has no description...

RHSA-2025:4447 Red Hat Security Advisory: xmlrpc-c security update

Bulletin has no description...

RHSA-2025:4439 Red Hat Security Advisory: libsoup security update

Bulletin has no description...

PT-2025-19707 · Outsystems · Outsystems

Name of the Vulnerable Software and Affected Versions: Outsystems versions prior to 3.1.0 Description: The issue arises because file extension and size validations are enforced solely on the client side in the Outsystems Multiple File Upload feature. This allows an attacker to intercept the uploa...

PT-2025-19800

Name of the Vulnerable Software and Affected Versions IBM Db2 for Linux, UNIX and Windows includes DB2 Connect Server versions 12.1.0 through 12.1.1 Description The issue could allow an authenticated user to cause a denial of service due to concurrent execution of shared resources. Recommendation...

PT-2025-19772

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.6.6 Description Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Low-privileged users can upload HTML files containing JavaScript code via the "/api/v1/files/"...

openSUSE Security Advisory (SUSE-SU-2025:1434-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

DLA-4153-1 containerd - security update

Bulletin has no description...

PT-2025-18935 · Unknown · Abundatrade Plugin

Name of the Vulnerable Software and Affected Versions: Abundatrade Plugin versions up to, and including, 1.8.02 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the 'abundatrade' page. This allows unauthenticated attackers to update...