PT-2025-15635 · Dnn · Dnn

Name of the Vulnerable Software and Affected Versions: DNN formerly DotNetNuke versions prior to 9.13.2 Description: The issue allows uploading files with malicious content by renaming them to have an allowed file extension, such as renaming an executable file to have a .jpg extension. This could...

PT-2025-15324 · Unknown · Vulnerability-Lookup

Name of the Vulnerable Software and Affected Versions: Vulnerability-Lookup versions prior to 2.7.1 Description: The issue allows stored XSS via a user bio in the website/web/views/user.py file. This can potentially lead to malicious script execution when a user views the affected bio...

DSA-5897-1 lemonldap-ng - security update

Bulletin has no description...

PT-2025-15346

Name of the Vulnerable Software and Affected Versions: Galaxy Watch versions prior to SMR Apr-2025 Release 1 Description: The issue is related to inadequate access control, allowing local attackers to access sensitive information on the Galaxy Watch. This could potentially expose confidential dat...

PT-2025-15670 · Haproxy +6 · Haproxy +6

Name of the Vulnerable Software and Affected Versions: HAProxy versions 2.2 through 3.1.6 Description: The issue is related to a heap-based buffer overflow in certain uncommon configurations due to the mishandling of the replacement of multiple short patterns with a longer one. This occurs in the...

PT-2025-15626 · Adobe · Framemaker

Name of the Vulnerable Software and Affected Versions: Adobe Framemaker versions 2020.8 and earlier Adobe Framemaker version 2022.6 Description: The issue is a Stack-based Buffer Overflow that could result in arbitrary code execution in the context of the current user. To exploit this problem, th...

PT-2025-28638 · Git +1 · Tarantool

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. affected versions not specified Description: The software contains a stack-buffer-overflow write issue. The crash state involves the functions snap usedef, lj snap purge, and lj record ins...

Adobe After Effects buffer error vulnerability

Adobe After Effects is a set of visual effects and motion graphics production software from the American company Audobee Adobe. The software is mainly used for 2D and 3D synthesis, animation and visual effects production. An out-of-bounds read vulnerability exists in Adobe After Effects version...

CVE-2025-32033 Apollo Router Operation Limits Vulnerable to Bypass via Integer Overflow

The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. Prior to 1.61.2 and 2.1.1, the operation limits plugin uses unsigned 32-bit integers to track limit counters e.g. for a query's height. If a counter...

CVE-2025-30373 Graylog Authenticated HTTP inputs do ingest message even if Authorization header is missing or has wrong value

Graylog is a free and open log management platform. Starting with 6.1, HTTP Inputs can be configured to check if a specified header is present and has a specified value to authenticate HTTP-based ingestion. Unfortunately, even though in cases of a missing header or a wrong value the correct HTTP...

WordPress Specia Companion plugin <= 6.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Aiden in WordPress Plugin Specia Companion versions = 6.2...

CVE-2025-3360 Glibc: glib prior to 2.82.5 is vulnerable to integer overflow and buffer under-read when parsing a very long invalid iso 8601 timestamp with g_date_time_new_from_iso8601().

A flaw was found in GLib. An integer overflow and buffer under-read occur when parsing a long invalid ISO 8601 timestamp with the gdatetimenewfromiso8601 function...

Denial Of Service (DoS)

@directus/storage-driver-s3 is vulnerable to Denial Of Service DoS. The vulnerability is due to improper handling of malformed transformation requests, which allows an attacker to trigger a state where all assets return 403 errors, leading to asset unavailability across all Directus policies...

OSV-2025-262 UNKNOWN WRITE in _lou_handlePassVariableAction

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=408523839 Crash type: UNKNOWN WRITE Crash state: louhandlePassVariableAction passDoAction translateString...

CVE-2025-28400

An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the postID parameter in the edit method...

📄 WBCE CMS 1.6.3 Remote Code Execution

WBCE CMS version 1.6.3 suffers from an authenticated remote code execution vulnerability. Exploit Title: WBCE CMS " exit 1 fi if -z "$which nc" ; then echo "! Netcat is not installed." exit 1 fi ip=$1 port=$2 rm -rf shellModule.zip rm -rf shellModule mkdir shellModule echo Crafting Payload cat...

YesWiki 4.5.1 - Unauthenticated Path Traversal

Exploit Title: YesWiki 4.5.2 - Unauthenticated Path Traversal Exploit Author: Al Baradi Joy Exploit Date: April 6, 2025 CVE ID: CVE-2025-31131 Vendor Homepage: https://yeswiki.net/ Software Link: https://github.com/YesWiki/yeswiki Affected Version: 4.5.2 Tested On: YesWiki 4.5.1 on Ubuntu 22.04...

CVE-2024-51800

Incorrect Privilege Assignment vulnerability in Favethemes Homey allows Privilege Escalation.This issue affects Homey: from n/a through 2.4.1...

OSV-2025-260 Heap-buffer-overflow in bfd_getb16

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=408254000 Crash type: Heap-buffer-overflow READ 1 Crash state: bfdgetb16 nds32elfdo9pcrelreloc nds32elf9pcrelreloc...

PT-2025-15102 · Unknown · Codeprojects Online Restaurant Management System

Name of the Vulnerable Software and Affected Versions: codeprojects Online Restaurant Management System version 1.0 Description: A critical issue was found in the codeprojects Online Restaurant Management System. This issue affects the /reservation save.php file, where the manipulation of the fir...