Regular Expression Denial Of Service (ReDoS)

string-math is vulnerable to Regular Expression Denial of Service ReDoS. The vulnerability is due to inefficient regular expression processing, which allows the attack to be exploited via crafted input...

MAL-2025-5492 Malicious code in cors-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8939034e252aec0a1bb8e90a23fa9e524d966682283a461f00204f8bedf29c33 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2025-27554

Name of the Vulnerable Software and Affected Versions: Sentry versions prior to 25.5.0 Description: The issue allows an attacker with a malicious OAuth application registered with Sentry to take advantage of a race condition and improper handling of authorization code within Sentry, maintaining...

CVE-2025-45083

Incorrect access control in Ullu Android version v2.9.929 and IOS version v2.8.0 allows attackers to bypass parental pin feature via unspecified vectors...

BIT-GITLAB-2025-5846 Missing Authorization in GitLab

An issue has been discovered in GitLab EE affecting all versions from 16.10 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowed authenticated users to assign unrelated compliance frameworks to projects by sending crafted GraphQL mutations that bypassed...

WordPress Booking Calendar Contact Form plugin <= 1.2.58 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by kmaron1n in WordPress Plugin Booking Calendar Contact Form versions = 1.2.58...

WordPress MobiLoud plugin <= 4.6.6 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by ch4r0n in WordPress Plugin MobiLoud versions = 4.6.6...

BELL-CVE-2025-38084

Bulletin has no description...

Command Injection

ios-simulator-mcp is vulnerable to command injection. The vulnerability is due to unsafe use of Node.js exec with untrusted user input in the uitap tool, which allows attackers to inject shell meta-characters via arguments like duration, udid, x, and y...

📄 Hecate PC Remote Control 1.6.1.0 Remote System Control

Hecate PC Remote Control version 1.6.1.0 is vulnerable to unauthenticated system control. An attacker on the same network can send crafted UDP packets to the target without authentication, allowing them to remotely issue system-level commands such as lock, shutdown, restart, and sleep. Exploit...

PT-2025-27436 · Abb · Abb Lite Panel Pro

Name of the Vulnerable Software and Affected Versions: ABB Lite Panel Pro versions through 1.0.1 Description: The issue is related to Insufficient Session Expiration. This problem affects ABB Lite Panel Pro, allowing potential exploitation due to sessions not expiring as expected. Recommendations...

PT-2025-27471 · Akamai · Akamai Cloudtest

Name of the Vulnerable Software and Affected Versions: Akamai CloudTest versions prior to 60 2025.06.09 Description: The issue allows for Server-Side Request Forgery SSRF, which is a type of attack where an attacker can trick a server into making requests to internal or external resources. No...

PT-2025-27453 · Orkes · Orkes Conductor

Name of the Vulnerable Software and Affected Versions: Orkes Conductor version 3.21.11 Description: The issue allows remote attackers to execute arbitrary OS commands through unrestricted access to Java classes. This can lead to remote code execution in Orkes Conductor. Recommendations: Update to...

CVE-2024-12364

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Mavi Yeşil Software Guest Tracking Software allows SQL Injection. This issue affects Guest Tracking Software. NOTE: The vendor did not inform about the completion of the fixing process within the...

CVE-2025-53254

Cross-Site Request Forgery CSRF vulnerability in Themeisle Cyrlitera cyrlitera allows Cross Site Request Forgery.This issue affects Cyrlitera: from n/a through = 1.3.0...

GHSA-358M-FQ53-HP87 akka-cluster-metrics uses Java serialization for cluster metrics

In Akka through 2.10.6, akka-cluster-metrics uses Java serialization for cluster metrics...

PT-2025-27339 · Unknown · Position Department Service Quality Evaluation System

Name of the Vulnerable Software and Affected Versions: Conjure Position Department Service Quality Evaluation System versions up to 1.0.11 Description: A critical vulnerability has been found in the Conjure Position Department Service Quality Evaluation System. The issue affects the eval function...

Security Bulletin: IBM MQ Client can send data resulting in SIGSEGV and amqrmppa process ending

Summary IBM MQ has addressed a denial of service vulnerability CVE-2025-3631 Vulnerability Details CVEID:CVE-2025-3631 DESCRIPTION: An IBM MQ Client connecting to an MQ Queue Manager can cause a SIGSEGV in the AMQRMPPA channel process terminating it. CWE:CWE-416: Use After Free CVSS Source: IBM...

PT-2025-27327 · Code Projects · Payroll Management System

Name of the Vulnerable Software and Affected Versions: code-projects Payroll Management System version 1.0 Description: A critical issue has been found in the Payroll Management System, affecting some unknown functionality of the file /Payroll Management System/ajax.php?action=save department. Th...

Security Bulletin: IBM Storage Ceph is vulnerable to Race Condition in the RHEL UBI (CVE-2023-3758)

Summary RHEL UBI is used by IBM Storage Ceph as the base operating system. CVE-2023-3758 This bulletin identifies the steps to take to address the vulnerability in the RHEL UBI. Vulnerability Details CVEID:CVE-2023-3758 DESCRIPTION: A race condition flaw was found in sssd where the GPO policy is...