PT-2025-16171 · WordPress · The Royal Elementor Addons/Templates

Name of the Vulnerable Software and Affected Versions: The Royal Elementor Addons and Templates plugin for WordPress versions up to, and including, 1.7.1012 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping in the widgetGri...

Advisory ROSA-SA-2025-2829

Software: postgresql-jdbc 42.2.28 OS: ROSA Virtualization 3.0 packageevrstring: postgresql-jdbc-42.2.28-1.0.1.rv30 CVE-ID: CVE-2024-1597 BDU-ID: 2024-01541 CVE-Crit: CRITICAL. CVE-DESC.: A vulnerability in the JDBC driver pgjdbc for connecting Java programs to a PostgreSQL database is related to...

PT-2025-16054 · Scand · Scand Multimailer

Name of the Vulnerable Software and Affected Versions: SCAND MultiMailer versions 1.0.3 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for Reflected Cross-site Scripting XSS. This enables attackers to inject malicious...

PT-2025-16113 · Debian +1 · Debian +1

Name of the Vulnerable Software and Affected Versions: Taegis Endpoint Agent Linux versions prior to 1.3.10 Description: A code injection issue in the Debian package component allows local users to execute arbitrary code as root. This issue does not affect Redhat-based systems that use RPM...

PT-2025-16071 · WordPress · Empikplace For Woocommerce

Name of the Vulnerable Software and Affected Versions: EmpikPlace for Woocommerce versions 1.4.2 and earlier Description: The issue is related to the deserialization of untrusted data, which allows object injection. This is a problem where an attacker could potentially inject malicious objects in...

PT-2025-16047 · Unknown · Insert Html Here

Name of the Vulnerable Software and Affected Versions: Insert HTML Here versions prior to 1.0 Description: The issue is related to improper neutralization of input during web page generation, which allows for Cross-site Scripting XSS. Specifically, it enables Reflected XSS. Recommendations: For...

Fedora 40 : thunderbird (2025-4841d72caf)

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-4841d72caf advisory. Update to 128.9.0 https://www.thunderbird.net/en-US/thunderbird/128.9.0esr/releasenotes/...

PT-2025-15946 · Flo Forms · Flo Forms

Name of the Vulnerable Software and Affected Versions: Flo Forms versions 1.0.43 and earlier Description: The issue is related to a Missing Authorization vulnerability, allowing the exploitation of incorrectly configured access control security levels. This enables unauthorized access control...

PT-2025-15958 · Unknown · Quantumcloud Seo Help

Name of the Vulnerable Software and Affected Versions: QuantumCloud SEO Help versions n/d through 6.6.1 Description: The issue is related to a lack of authorization in QuantumCloud SEO Help, which allows the exploitation of incorrectly configured access control security levels. Recommendations: F...

PT-2025-15812 · Unknown · Hiren Patel Custom Posts Order

Name of the Vulnerable Software and Affected Versions: Hiren Patel Custom Posts Order versions through 4.4 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. Recommendations: For versions through 4.4, update to a version that includes a fix for this...

PT-2025-15863 · Juniper Networks · Junos

Name of the Vulnerable Software and Affected Versions: Junos OS versions prior to 21.2R3-S9 Junos OS versions 21.4 prior to 21.4R3-S10 Junos OS versions 22.2 prior to 22.2R3-S6 Junos OS versions 22.4 prior to 22.4R3-S5 Junos OS versions 23.2 prior to 23.2R2-S3 Junos OS versions 23.4 prior to...

PT-2025-15702 · Microsoft · Microsoft.Identity.Abstractions +1

Name of the Vulnerable Software and Affected Versions: Microsoft Identity Web versions prior to 3.8.2 Microsoft Identity Web versions prior to 3.8.2 is equivalent to Microsoft.Identity.Abstractions versions prior to 9.0.0, however the correct representation is: Microsoft Identity Web versions pri...

PT-2025-15745 · Unknown · Script Compressor

Name of the Vulnerable Software and Affected Versions: Script Compressor versions 1.7.1 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS in the regen Script Compressor. Recommendations: For versions 1.7.1 and earlier, update to a version...

PT-2025-15757 · Xgrammar · Xgrammar

Name of the Vulnerable Software and Affected Versions: XGrammar versions prior to 0.1.18 Description: The issue concerns an unbounded cache for compiled grammars in memory, which can be exploited to cause a denial of service by filling up a host's memory. This can occur when a system using XGramm...

PT-2025-15750 · Chandan Garg · Cg Scroll To Top

Name of the Vulnerable Software and Affected Versions: Chandan Garg CG Scroll To Top versions n/a through 3.5 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web...

PT-2025-15773 · Unknown · Bozdoz Recaptcha Jetpack

Name of the Vulnerable Software and Affected Versions: bozdoz reCAPTCHA Jetpack versions 0.2.2 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This is a type of attack where an...

CVE-2025-30151

Shopware is an open commerce platform. It's possible to pass long passwords that leads to Denial Of Service via forms in Storefront forms or Store-API. This vulnerability is fixed in 6.6.10.3 or 6.5.8.17. For older versions of 6.4, corresponding security measures are also available via a plugin...

CVE-2025-30150 Shopware 6 allows attackers to check for registered accounts through the store-api

Shopware 6 is an open commerce platform based on Symfony Framework and Vue. Through the store-api it is possible as a attacker to check if a specific e-mail address has an account in the shop. Using the store-api endpoint /store-api/account/recovery-password you get the response, which indicates...

CVE-2025-30151 Shopware allows Denial Of Service via password length

Shopware is an open commerce platform. It's possible to pass long passwords that leads to Denial Of Service via forms in Storefront forms or Store-API. This vulnerability is fixed in 6.6.10.3 or 6.5.8.17. For older versions of 6.4, corresponding security measures are also available via a plugin...

CVE-2025-30151 Shopware allows Denial Of Service via password length

Shopware is an open commerce platform. It's possible to pass long passwords that leads to Denial Of Service via forms in Storefront forms or Store-API. This vulnerability is fixed in 6.6.10.3 or 6.5.8.17. For older versions of 6.4, corresponding security measures are also available via a plugin...