CVE-2025-27515

Laravel is a web application framework. When using wildcard validation to validate a given file or image field files., a user-crafted malicious request could potentially bypass the validation rules. This vulnerability is fixed in 11.44.1 and 12.1.1...

CVE-2025-21095

Path traversal may lead to arbitrary file download. The score without least privilege principle violation is as calculated below. In combination with other issues it may facilitate further compromise of the device. Remediation in Version 6.8.0, release date: 01-Mar-25...

CVE-2025-22493

Secure flag not set and SameSIte was set to Lax in the Foreseer Reporting Software FRS. Absence of this secure flag could lead into the session cookie being transmitted over unencrypted HTTP connections. This security issue has been resolved in the latest version of FRS v1.5.100...

PT-2025-10103

Name of the Vulnerable Software and Affected Versions Helpdesk versions prior to 3.3.3 Description An improper certificate validation issue has been reported, which could allow remote attackers to compromise the system's security if exploited. Recommendations For versions prior to 3.3.3, update t...

PT-2025-10041

Name of the Vulnerable Software and Affected Versions GraphicsMagick versions prior to 1.3.46 Description The issue concerns the mishandling of palette buffer allocation in WPG, which is a part of GraphicsMagick. Recommendations For versions prior to 1.3.46, update to version 1.3.46 or later to...

CVE-2025-27506 NocoDB Vulnerable to Reflected Cross-Site Scripting on Reset Password Page

NocoDB is software for building databases as spreadsheets. The API endpoint related to the password reset function is vulnerable to Reflected Cross-Site-Scripting. The endpoint /api/v1/db/auth/password/reset/:tokenId is vulnerable to Reflected Cross-Site-Scripting. The flaw occurs due to...

CVE-2025-25191 Group-Office has a Stored XSS Vulnerability via user's name field

Group-Office is an enterprise CRM and groupware tool. This Stored XSS vulnerability exists where user input in the Name field is not properly sanitized before being stored. This vulnerability is fixed in 6.8.100...

CVE-2024-58078 misc: misc_minor_alloc to use ida for all dynamic/misc dynamic minors

In the Linux kernel, the following vulnerability has been resolved: misc: miscminoralloc to use ida for all dynamic/misc dynamic minors miscminoralloc was allocating id using ida for minor only in case of MISCDYNAMICMINOR but miscminorfree was always freeing ids using idafree causing a mismatch a...

CVE-2025-1979

Versions of the package ray before 2.43.0 are vulnerable to Insertion of Sensitive Information into Log File where the redis password is being logged in the standard logging. If the redis password is passed as an argument, it will be logged and could potentially leak the password. This is only...

CVE-2025-20923

Improper access control in Galaxy Wearable prior to version 2.2.61.24112961 allows local attackers to launch arbitrary activity with Galaxy Wearable privilege...

CVE-2025-1979

Versions of the package ray before 2.43.0 are vulnerable to Insertion of Sensitive Information into Log File where the redis password is being logged in the standard logging. If the redis password is passed as an argument, it will be logged and could potentially leak the password. This is only...

PT-2025-17726 · Apache +2 · Apache Httpclient +3

Name of the Vulnerable Software and Affected Versions: Apache HttpClient versions 5.4.0 through 5.4.2 Description: A bug in PSL validation logic disables domain checks, affecting cookie management and host name verification. This issue was discovered by the Apache HttpClient team. Recommendations...

PT-2025-9900

Name of the Vulnerable Software and Affected Versions Samsung Notes versions prior to 4.4.26.71 Description The issue is related to an out-of-bounds write in the parsing of jpeg images, which allows local attackers to execute arbitrary code. Recommendations For versions prior to 4.4.26.71, update...

PT-2025-9896 · Samsung · Samsung Notes

Name of the Vulnerable Software and Affected Versions: Samsung Notes versions prior to 4.4.26.71 Description: The issue is related to an out-of-bounds read when applying binary data to text in Samsung Notes. This could potentially allow local attackers to read memory. Recommendations: For version...

PT-2025-9887 · Samsung · Samsung Notes

Name of the Vulnerable Software and Affected Versions: Samsung Notes versions prior to 4.4.26.71 Description: The issue is related to an out-of-bounds read in the SPen string reading functionality. This allows attackers to read out-of-bounds memory, potentially leading to information disclosure...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: tipc: Return non-zero value from tipcudpaddr2str on error CVE-2024-42284 In the Linux kernel, the following vulnerability has been resolved: RDMA/iwcm: Fix a use-after-free related to destroying CM IDs...

PT-2025-9891 · Samsung · Samsung Notes

Name of the Vulnerable Software and Affected Versions: Samsung Notes versions prior to 4.4.26.71 Description: The issue is related to an out-of-bounds read in action link data, which allows attackers to read out-of-bounds memory. Recommendations: For versions prior to 4.4.26.71, update to version...

OPENSUSE-SU-2025:14855-1 go1.23-1.23.7-1.1 on GA media

These are all security issues fixed in the go1.23-1.23.7-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2025-9899 · Samsung · Samsung Notes

Name of the Vulnerable Software and Affected Versions: Samsung Notes versions prior to 4.4.26.71 Description: The issue is related to an out-of-bounds read in the parsing of wbmp images. This allows local attackers to access out-of-bounds memory. Recommendations: For versions prior to 4.4.26.71,...

PT-2025-9902 · Samsung · Samsung Notes

Name of the Vulnerable Software and Affected Versions: Samsung Notes versions prior to 4.4.26.71 Description: The issue is related to an out-of-bounds write in the parsing of bmp images, which can be exploited by local attackers to execute arbitrary code. Recommendations: For versions prior to...