CVE-2025-32996

In http-proxy-middleware before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because "else if" is not used...

PT-2025-29262 · Unknown · Software Smi Handler

Name of the Vulnerable Software and Affected Versions: Software SMI Handler affected versions not specified Description: A vulnerability in the Software SMI handler SwSmiInputValue 0x20 allows a local attacker to supply a crafted pointer FuncBlock through RBX and RCX register values. This pointer...

PT-2025-16524 · Unknown · Covertnine C9 Blocks

Name of the Vulnerable Software and Affected Versions: covertnine C9 Blocks versions 1.7.7 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for DOM-Based XSS. This is a type of Cross-site Scripting attack that occurs in the...

PT-2025-16312 · Aweos Gmbh · Aweos Gmbh Email Notifications For Updates

Name of the Vulnerable Software and Affected Versions: AWEOS GmbH Email Notifications for Updates versions 1.1.6 and earlier Description: The issue is related to a Missing Authorization vulnerability that allows Privilege Escalation in AWEOS GmbH Email Notifications for Updates. Recommendations:...

PT-2025-16368 · Rockwell Automation · Rockwell Automation Thinmanager

Name of the Vulnerable Software and Affected Versions: Rockwell Automation ThinManager affected versions not specified Description: A privilege escalation issue exists in the Rockwell Automation ThinManager. When the software starts up, files are deleted in the temporary folder, causing the Acces...

ALSA-2025:3913 Moderate: expat security update

Expat is a C library for parsing XML documents. Security Fixes: libexpat: expat: Improper Restriction of XML Entity Expansion Depth in libexpat CVE-2024-8176 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related information, refer to th...

CVE-2025-32996

In http-proxy-middleware before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because "else if" is not used...

PT-2025-16325 · Unknown · Royal Elementor Addons

Name of the Vulnerable Software and Affected Versions: Royal Elementor Addons versions 1.7.1006 and earlier Description: A Server-Side Request Forgery SSRF issue affects the software, allowing for Server Side Request Forgery. Recommendations: For Royal Elementor Addons versions 1.7.1006 and...

PT-2025-16382 · Unknown · Erick Xmall

Name of the Vulnerable Software and Affected Versions: Erick xmall versions 1.1 and earlier Description: An issue in Erick xmall allows a remote attacker to escalate privileges via the updateAddress method of the Address Controller class. Recommendations: For Erick xmall versions 1.1 and earlier,...

CVE-2023-27272

CVE-2023-27272 – IBM Aspera Console affected: IBM Aspera Console 3.4.0–3.4.4. Issue: passwords can be reused when a new user logs in, as described in multiple sources including the IBM Security Bulletin and NVD entry. Root cause details are not explicitly stated beyond the password reuse behavior...

GHSA-WWHJ-PW6H-F8HW Mattermost Incorrect Authorization vulnerability

Mattermost versions 10.5.x = 10.5.1, 9.11.x = 9.11.9 fail to check if a file has been deleted when creating a bookmark which allows an attacker who knows the IDs of deleted files to obtain metadata of the files via bookmark creation...

CVE-2024-49825

CVE-2024-49825 affects IBM Robotic Process Automation and IBM RPA for Cloud Pak, versions 21.0.0–21.0.7.20 and 23.0.0–23.0.20. Root cause: sessions are not invalidated after logout, enabling an authenticated user to impersonate another user. IBM’s bulletin cites CWE-613 and CVSS v3.1 base score 6...

BIT-GITLAB-2025-25291 ruby-saml vulnerable to SAML authentication bypass due to DOCTYPE handling (parser differential)

ruby-saml provides security assertion markup language SAML single sign-on SSO for Ruby. An authentication bypass vulnerability was found in ruby-saml prior to versions 1.12.4 and 1.18.0 due to a parser differential. ReXML and Nokogiri parse XML differently; the parsers can generate entirely...

BIT-PHP-MIN-2025-1736 Stream HTTP wrapper header check might omit basic auth header

In PHP from 8.1. before 8.1.32, from 8.2. before 8.2.28, from 8.3. before 8.3.19, from 8.4. before 8.4.5, when user-supplied headers are sent, the insufficient validation of the end-of-line characters may prevent certain headers from being sent or lead to certain headers be misinterpreted...

BIT-RAILS-2024-54133 Possible Content Security Policy bypass in Action Dispatch

Action Pack is a framework for handling and responding to web requests. There is a possible Cross Site Scripting XSS vulnerability in the contentsecuritypolicy helper starting in version 5.2.0 of Action Pack and prior to versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1. Applications which set...

BIT-APPSMITH-2024-55604 Appsmith's Broken Access Control Allows Viewer Role User to Query Datasources

Appsmith is a platform to build admin panels, internal tools, and dashboards. Users invited as "App Viewer" should not have access to development information of a workspace. Datasources are such a component in a workspace. Yet, in versions of Appsmith prior to 1.51, app viewers are able to get a...

Remote Code Execution (RCE)

BentoML is vulnerable to Remote Code Execution RCE. The vulnerability is due to insecure deserialization due to an unsafe code segment in serde.py that allows arbitrary code execution by unauthenticated users...

Security Bulletin: IBM Maximo Application Suite - Predict Component vulnerable to Microsoft LightGBM could allow a remote attacker to execute arbitrary code on the system.

Summary Security Bulletin: IBM Maximo Application Suite - Predict Component vulnerable to Microsoft LightGBM could allow a remote attacker to execute arbitrary code on the system.. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details...

Mattermost Fails to Restrict Certain Operations on System Admins

Mattermost versions 10.5.x = 10.5.1, 10.4.x = 10.4.3, 9.11.x = 9.11.9 fail to restrict certain operations on system admins to only other system admins, which allows delegated granular administration users with the "Edit Other Users" permission to perform unauthorized modifications to system...

PT-2025-16379

Name of the Vulnerable Software and Affected Versions gorilla/csrf versions prior to 1.7.2 Description The issue concerns a Cross Site Request Forgery CSRF prevention middleware for Go web applications and services. It does not validate the Origin header against an allowlist prior to version 1.7....