PT-2025-29210 · WordPress · Wp Register Profile With Shortcode

Name of the Vulnerable Software and Affected Versions: WP Register Profile With Shortcode versions up to and including 3.6.2 Description: The WP Register Profile With Shortcode plugin for WordPress is susceptible to sensitive information exposure via the rp user data shortcode. Authenticated...

PT-2025-29214 · WordPress · Foogallery

Name of the Vulnerable Software and Affected Versions: FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel plugin for WordPress versions through 2.4.31 Description: The FooGallery plugin for WordPress is susceptible to Stored Cross-Site Scripting due to insufficient...

PT-2025-29217 · WordPress · Wpgym - Wordpress Gym Management System

Name of the Vulnerable Software and Affected Versions: WPGYM - Wordpress Gym Management System plugin versions prior to 67.8.0 Description: The WPGYM - Wordpress Gym Management System plugin for WordPress is susceptible to SQL Injection due to insufficient input validation and query preparation...

Huawei EulerOS: Security Advisory for xorg-x11-server (EulerOS-SA-2025-1813)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2025-3947 Integer underflow during processing of short network packets in CDA FTEB responder

The Honeywell Experion PKS contains an Integer Underflow vulnerability in the component Control Data Access CDA. An attacker could potentially exploit this vulnerability, leading to Input Data Manipulation, which could result in improper integer data value checking during subtraction leading to a...

CVE-2025-2520 Dereferencing of an uninitialized pointer leads to denial of service.

The Honeywell Experion PKS contains an Uninitialized Variable in the common Epic Platform Analyzer EPA communications. An attacker could potentially exploit this vulnerability, leading to a Communication Channel Manipulation, which results in a dereferencing of an uninitialized pointer leading to...

PT-2025-29091

Name of the Vulnerable Software and Affected Versions: llama index versions up to 0.12.28 Description: A vulnerability exists in the DocugamiReader class of the llama index repository. The use of MD5 hashing to generate IDs for document chunks can lead to hash collisions when structurally distinc...

PT-2025-29173 · Apple · App Store Connect

Name of the Vulnerable Software and Affected Versions: App Store Connect versions prior to 3.0 Description: An authentication issue existed due to improved state management. An attacker with physical access to an unlocked device may be able to view sensitive user information. Recommendations:...

PT-2025-28975 · Dradis · Dradis

Name of the Vulnerable Software and Affected Versions: Dradis versions prior to 4.11.0 Description: The Dradis Output Console displays a job queue that may reveal information pertaining to jobs belonging to other users. Recommendations: Update to version 4.11.0 or later...

PT-2025-28984 · WordPress · Hostel Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Hostel WordPress plugin versions prior to 1.1.5.9 Description: The Hostel WordPress plugin does not properly sanitize and escape certain settings. This could allow users with high privileges, such as administrators, to perform Stored Cross-Si...

PT-2025-29123 · WordPress +1 · Discordnotifications +1

Name of the Vulnerable Software and Affected Versions: DiscordNotifications extension for MediaWiki affected versions not specified Description: The DiscordNotifications extension for MediaWiki allows sending requests to arbitrary URLs set via configuration variables $wgDiscordIncomingWebhookUrl...

PT-2025-28983 · WordPress · Hostel Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Hostel WordPress plugin versions prior to 1.1.5.8 Description: The Hostel WordPress plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting issue. This could be used...

PT-2025-29150 · Unknown +1 · Cpp-Httplib +1

Name of the Vulnerable Software and Affected Versions: cpp-httplib versions prior to 0.20.1 Description: cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Versions prior to 0.20.1 do not have a limit for a unique line, which allows an attacker to allocate memory...

PT-2025-29154 · Unknown · Callmanager

Name of the Vulnerable Software and Affected Versions: Chall-Manager versions prior to 0.1.4 Description: Chall-Manager is susceptible to a zip bomb decompression issue when decoding scenario zip archives. The vulnerability does not require authentication or authorization for exploitation...

PT-2025-29169 · Unknown · Meshtastic

Name of the Vulnerable Software and Affected Versions: Meshtastic versions 1.2.1 through 2.6.2 Description: Meshtastic is an open source mesh networking solution. A packet sent to the routing module with want response set to true causes a crash. This can lead to a degradation of service for nodes...

PT-2025-29133 · Pdfme · Pdfme

Name of the Vulnerable Software and Affected Versions: pdfme versions 5.2.0 through 5.4.0 Description: The expression evaluation feature in pdfme contains critical vulnerabilities allowing sandbox escape, leading to Cross-Site Scripting XSS and prototype pollution attacks. Attackers can bypass th...

PT-2025-29115

Name of the Vulnerable Software and Affected Versions: Apache HTTP Server versions 2.4.0 through 2.4.63 Description: A Server-Side Request Forgery SSRF issue exists in Apache HTTP Server on Windows. This issue potentially allows the leakage of NTLM hashes to a malicious server via mod rewrite or...

PT-2025-28971 · WordPress · Gwolle Guestbook

Name of the Vulnerable Software and Affected Versions: Gwolle Guestbook versions prior to 4.9.3 Description: The Gwolle Guestbook plugin for WordPress is vulnerable to Stored Cross-Site Scripting through the gwolle gb content parameter. Insufficient input sanitization and output escaping allow...

PT-2025-28927 · Jenkins · Jenkins Warrior Framework Plugin

Name of the Vulnerable Software and Affected Versions: Jenkins Warrior Framework Plugin versions 1.2 and earlier Description: The Jenkins Warrior Framework Plugin stores passwords unencrypted in job config.xml files on the Jenkins controller. This allows users with Item/Extended Read permission o...

PT-2025-28862 · Unknown · Datasync Center

Name of the Vulnerable Software and Affected Versions: DataSync Center versions 1.1.0 through 1.1.0.r207 DataSync Center versions 1.2.0 through 1.2.0.r206 Description: A security bypass issue allows exploitation via Reverse Tabnabbing, a type of phishing attack where attackers can manipulate the...