PT-2025-30163

Name of the Vulnerable Software and Affected Versions Thor versions prior to 1.4.0 Description Thor versions prior to 1.4.0 can construct an unsafe shell command from library input. Recommendations Update Thor to version 1.4.0 or later...

CVE-2025-54314

CVE-2025-54314 is tied to Ruby’s Thor library. The IBM/endorsement bulletin confirms Thor versions before 1.4.0 can construct an unsafe shell command from library input. The vulnerability is mitigated by upgrading to Thor 1.4.0 or newer, as noted in official fixes; the supplier disputes the claim...

CVE-2025-48965

Mbed TLS before 3.6.4 has a NULL pointer dereference because mbedtlsasn1storenameddata can trigger conflicting data with val.p of NULL but val.len greater than zero...

CVE-2025-54314

Thor before 1.4.0 can construct an unsafe shell command from library input. NOTE: this is disputed by the Supplier because "the method that was fixed can only be used with arguments that are controlled by Thor, and there is no way an attacker can take control of those arguments."...

BELL-CVE-2025-38349

Bulletin has no description...

PT-2025-30138

Name of the Vulnerable Software and Affected Versions Jinher OA version 1.1 Description A vulnerability exists in the processing of the XmlHttp.aspx file, leading to XML external entity reference XXE. This issue can be exploited remotely. The exploit has been publicly disclosed. Recommendations A...

CVE-2025-52166

Incorrect access control in Software GmbH Agorum core open v11.9.2 & v11.10.1 allows authenticated attackers to escalate privileges to Administrator and access sensitive components and information...

CVE-2025-53901 Wasmtime has host panic with `fd_renumber` WASIp1 function

Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.4, 33.0.2, and 34.0.2, a bug in Wasmtime's implementation of the WASIp1 set of import functions can lead to a WebAssembly guest inducing a panic in the host embedder. The specific bug is triggered by calling pathopen after calling...

CVE-2025-54073 mcp-package-docs vulnerable to command injection in several tools

mcp-package-docs is an MCP Model Context Protocol server that provides LLMs with efficient access to package documentation across multiple programming languages and language server protocol LSP capabilities. A command injection vulnerability exists in the mcp-package-docs MCP Server prior to the...

CVE-2025-54073 mcp-package-docs vulnerable to command injection in several tools

mcp-package-docs is an MCP Model Context Protocol server that provides LLMs with efficient access to package documentation across multiple programming languages and language server protocol LSP capabilities. A command injection vulnerability exists in the mcp-package-docs MCP Server prior to the...

Incorrect Permission Assignment For Critical Resource

org.apache.apisix:apisix-plugin-runner is vulnerable to Incorrect Permission Assignment for Critical Resource. The vulnerability is due to improper file permission settings caused by insecure local listening file permissions, allowing a local attacker to elevate privileges...

BELL-CVE-2025-50065

Bulletin has no description...

CVE-2025-52164

Software GmbH Agorum core open v11.9.2 & v11.10.1 was discovered to store credentials in plaintext...

CVE-2025-52169

Agorum core open , an enterprise content management system by Agorum Software GmbH, is vulnerable to a reflected cross-site scripting (XSS) issue in versions v11.9.2 and v11.10.1 . The vulnerability arises from the improper neutralization of input during web page generation . An attacker could po...

PT-2025-30085 · Agorum Software Gmbh · Agorum Core

Name of the Vulnerable Software and Affected Versions: agorum Software GmbH Agorum core open versions 11.9.2 and 11.10.1 Description: The software contains a reflected cross-site scripting XSS issue. Recommendations: Update to a newer version that addresses this issue...

PT-2025-30225 · Totolink · Totolink T6

Name of the Vulnerable Software and Affected Versions: TOTOLINK T6 version 4.1.5cu.748 B20211015 Description: A critical issue exists in the MQTT Service component, specifically within the updateWifiInfo function. Manipulation of the serverIp argument can lead to a buffer overflow, allowing for...

PT-2025-30079

Name of the Vulnerable Software and Affected Versions GPAC versions up to 2.4 Description A null pointer dereference issue exists in the gf dash download init segment function within the src/media tools/dash client.c file. Manipulation of the base init url argument can trigger this issue. This ca...

CVE-2025-52169

agorum Software GmbH Agorum core open v11.9.2 & v11.10.1 was discovered to contain a reflected cross-site scripting XSS vulnerability...

PT-2025-30093

Name of the Vulnerable Software and Affected Versions qBittorrent versions prior to 5.1.2 Description qBittorrent does not prevent access to a local file referenced in a link URL. This issue affects the rsswidget.cpp and searchjobwidget.cpp files. Recommendations Update qBittorrent to version 5.1...

CVE-2025-7763 thinkgem JeeSite Site Controller SiteController.java select redirect

A vulnerability, which was classified as problematic, was found in thinkgem JeeSite up to 5.12.0. Affected is the function select of the file src/main/java/com/jeesite/modules/cms/web/SiteController.java of the component Site Controller. The manipulation of the argument redirect leads to open...