Regular Expression Denial Of Service (ReDoS)

transformers is vulnerable to Regular Expression Denial of Service ReDoS. The vulnerability is due to a flawed regular expression pattern used in the getimports function to filter try/except blocks, which allows an attacker to craft input strings that cause catastrophic backtracking...

PT-2025-29097 · Ibm · Ibm Analytics Content Hub

Name of the Vulnerable Software and Affected Versions: IBM Analytics Content Hub versions 2.0 through 2.3 Description: The software may reveal detailed technical error messages, potentially exposing information about the application framework to a remote attacker. This information could be used f...

PT-2025-29076 · Gitlab · Gitlab Ce/Ee

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 17.11 through 17.11.5 GitLab CE/EE versions 18.0 through 18.0.3 GitLab CE/EE versions 18.1 through 18.1.1 Description: An issue has been discovered in GitLab CE/EE that, under certain conditions, could allow an attacker ...

PT-2025-28958 · Builder.Io · @Builder.Io/Qwik-City

Name of the Vulnerable Software and Affected Versions: @builder.io/qwik-city versions prior to 1.13.0 Description: The @builder.io/qwik-city meta-framework for Qwik is susceptible to an issue where improper handling of invalid qfunc during the execution of a Qwik Server Action QRL can lead to a...

mcp-remote 操作系统命令注入漏洞

mcp-remote is an MCP linking software by the individual developer Glen Maddern. An operating system command injection vulnerability exists in mcp-remote, which stems from the presence of OS command injection when connecting to an untrusted MCP server...

CVE-2025-49604

For Realtek AmebaD devices, a heap-based buffer overflow was discovered in Ameba-AIoT ameba-arduino-d before version 3.1.9 and ameba-rtos-d before commit c2bfd8216a1cbc19ad2ab5f48f372ecea756d67a on 2025/07/03. In the WLAN driver defragment function, lack of validation of the size of fragmented...

WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via `redirectURL` Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via redirectURL Parameter vulnerability discovered by Asaf Mozes in WordPress Plugin Gutenberg Blocks by Kadence Blocks versions = 3.5.10...

Qualcomm WLAN Software Vulnerability - Lenovo Support US

No description provided...

Remote Code Execution (RCE)

github.com/lf-edge/ekuiper is vulnerable to Remote Code Execution RCE. The vulnerability is due to insufficient restrictions in the /config/uploads API, allowing directory traversal ../ to write files outside the intended directory, potentially leading to remote code execution if run with root...

CVE-2025-49729

creationtimestamp| type| source ---|---|--- 2025-07-08 15:56:31+00:00| seen| https://www.thezdi.com/blog/2025/7/8/the-july-2025-security-update-review 2025-07-08 20:30:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lti5ejncff2w...

WordPress smart SEO plugin <= 4.0 - SQL Injection Vulnerability

SQL Injection Vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme smart SEO versions = 4.0...

BELL-CVE-2025-38229

Bulletin has no description...

BELL-CVE-2025-38230

Bulletin has no description...

BELL-CVE-2025-38214

Bulletin has no description...

BELL-CVE-2025-38226

Bulletin has no description...

PT-2025-28277 · Sap · Sap Netweaver Business Warehouse

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Business Warehouse CCAW affected versions not specified Description: The issue allows a privileged attacker to cause a high CPU load by executing RFC enabled function modules without any input parameters. This results in reduced...

PT-2025-28633

Name of the Vulnerable Software and Affected Versions: Juju affected versions not specified Description: The issue concerns the "/log" endpoint on a Juju controller, which lacked sufficient authorization checks. This allowed unauthorized users to access debug messages that could contain sensitive...

PT-2025-28764

Name of the Vulnerable Software and Affected Versions: InDesign Desktop versions 19.5.3 and earlier Description: InDesign Desktop versions 19.5.3 and earlier are susceptible to an Integer Underflow vulnerability. Successful exploitation of this issue could lead to arbitrary code execution with th...

PT-2025-28775 · Adobe · Framemaker

Name of the Vulnerable Software and Affected Versions: Adobe Framemaker versions 2020.8, 2022.6 and earlier Description: The issue is a Heap-based Buffer Overflow that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction...

PT-2025-28640 · Dimension · Dimension

Name of the Vulnerable Software and Affected Versions: Dimension versions 4.1.2 and earlier Description: The issue is an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitati...