RHSA-2025:3260 Red Hat Security Advisory: kernel security update

Bulletin has no description...

PT-2025-13197

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 136.0.4 Mozilla Firefox ESR versions prior to 128.8.1 Mozilla Firefox ESR versions prior to 115.21.1 Description A critical vulnerability exists in Mozilla Firefox on Windows systems, allowing for a sandbox...

PT-2025-13074 · WordPress · Wpdever Cart Tracking For Woocommerce

Name of the Vulnerable Software and Affected Versions: wpdever Cart tracking for WooCommerce versions 1.0.0 through 1.0.16 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection...

PT-2025-13051 · Wppool · Wppool Flexstock

Name of the Vulnerable Software and Affected Versions: WPPOOL FlexStock versions 3.13.1 and earlier Description: The issue is related to an SQL Injection vulnerability, specifically a Blind SQL Injection, due to the improper neutralization of special elements used in an SQL command. This allows f...

PT-2025-13234 · Wedevs · Wedevs Wp Project Manager

Name of the Vulnerable Software and Affected Versions: weDevs WP Project Manager versions through 2.6.22 Description: The issue is related to improper neutralization of input during web page generation, which allows for Stored Cross-site Scripting XSS. This means an attacker can inject malicious...

PT-2025-13071 · Unknown · Eli Ez Sql Reports Shortcode Widget/Db Backup

Name of the Vulnerable Software and Affected Versions: Eli EZ SQL Reports Shortcode Widget and DB Backup versions n/a through 5.25.08 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability that also allows SQL Injection. This means an attacker could potentially force...

Improper Encoding or Escaping of Output

Overview django-tomselect is a Django autocomplete widgets and views using Tom Select Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output in form widget input, including the labelfield parameter. An attacker can hide the contents between tags in code from...

CVE-2025-30164 Icinga Web 2 has open redirect on login page

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 vulnerability allows an attacker to craft a URL that, once visited by an authenticated user or one that is able to authenticate, allows to...

CVE-2025-24808 Discourse has race condition when adding users to a group DM

Discourse is an open-source discussion platform. Prior to versions 3.3.4 on the stable branch and 3.4.0.beta5 on the beta branch, someone who is about to reach the limit of users in a group DM may send requests to add new users in parallel. The requests might all go through ignoring the limit due...

RHSA-2025:3214 Red Hat Security Advisory: kernel-rt security update

Bulletin has no description...

RHSA-2025:3184 Red Hat Security Advisory: podman security update

Bulletin has no description...

RHSA-2025:3175 Red Hat Security Advisory: container-tools:rhel8 security update

Bulletin has no description...

RHSA-2025:3068 Red Hat Security Advisory: OpenShift Container Platform 4.18.6 packages and security update

Bulletin has no description...

BIT-HUBBLE-RELAY-2025-30163 Node based network policies may incorrectly allow workload traffic

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Node based network policies fromNodes and toNodes will incorrectly permit traffic to/from non-node endpoints that share the labels specified in fromNodes and toNodes sections of network policies. Node based...

Security Bulletin: IBM Robotic Process Automation is vulnerable to disclosure of information that could aid in further system attacks. (CVD-2022-38710)

Summary IBM Robotic Process Automation could potentially expose system and software version information which could aid in further system attacks. Vulnerability Details CVEID:CVE-2022-38710 DESCRIPTION: IBM Robotic Process Automation could disclose sensitive version information that could aid in...

JVN#39026557: Multiple vulnerabilities in PowerCMS

PowerCMS provided by Alfasado Inc. contains multiple vulnerabilities listed below. Injection CWE-74 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Base Score 5.3 CVE-2025-29993 The product improperly processes HTTP headers. Dependency on vulnerable third-party component CWE-1395 jQuery Validation...

PT-2025-12999 · Gitlab · Gitlab Ce/Ee

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 17.7 through 17.8.6 GitLab CE/EE versions 17.9 through 17.9.3 GitLab CE/EE versions 17.10 through 17.10.1 Description: An issue has been discovered in GitLab CE/EE affecting all versions from 17.7 before 17.8.6, 17.9...

PT-2025-12998

Name of the Vulnerable Software and Affected Versions Appsmith versions prior to 1.52 Description An issue was discovered in Appsmith where an incorrectly configured PostgreSQL instance in the Appsmith image leads to remote command execution inside the Appsmith Docker container. The attacker must...

PT-2025-13007 · Unknown +1 · Ingress-Nginx +2

Name of the Vulnerable Software and Affected Versions: KNIME Business Hub versions prior to 1.10.4 KNIME Business Hub versions prior to 1.11.4 KNIME Business Hub versions prior to 1.12.4 KNIME Business Hub versions prior to 1.13.3 Description: The issue affects the ingress-nginx component,...

PT-2025-12980 · Devolutions · Devolutions Remote Desktop Manager

Name of the Vulnerable Software and Affected Versions: Devolutions Remote Desktop Manager versions 2024.3.29 and earlier, Devolutions Remote Desktop Manager versions 2025.1.24 through 2025.1.25 Description: The issue is related to improper authorization in the application password policy, allowin...