PT-2025-17503 · Unknown · Rbaer List Last Changes

Name of the Vulnerable Software and Affected Versions: rbaer List Last Changes versions n/a through 1.2.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can...

PT-2025-17514 · Vform · Vform

Name of the Vulnerable Software and Affected Versions: VForm versions 3.1.14 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject malicious...

PT-2025-17597 · Git +1 · 3X-Ui

Name of the Vulnerable Software and Affected Versions: 3X-UI versions prior to 2.5.3 Description: The issue allows a remote attacker to execute arbitrary code via the management script. This is possible because the x-ui passes the no check certificate option to wget when downloading updates, whic...

PT-2025-17524 · Minio · Minio Operator

Name of the Vulnerable Software and Affected Versions: MinIO Operator versions prior to 7.1.0 Description: The issue concerns the MinIO Operator STS, a native IAM Authentication for Kubernetes. Without proper scoping, authentication can be replayed to other internal systems that may unintentional...

PT-2025-17463 · Docker +1 · Docker +1

Name of the Vulnerable Software and Affected Versions: Harden-Runner versions 0.12.0 through 2.12.0 Description: Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. The disable-sudo policy option is intended to prevent the GitHub Actions runner user from usi...

PT-2025-17424 · Gobgp +4 · Gobgp +4

Name of the Vulnerable Software and Affected Versions: GoBGP versions prior to 3.35.0 Description: The issue arises from improper input length checking in the pkg/packet/mrt/mrt.go file, specifically failing to ensure the presence of 12 bytes or 36 bytes depending on the address family...

PT-2025-17422 · Libheif +1 · Libheif +1

Name of the Vulnerable Software and Affected Versions: libheif versions prior to 1.19.6 Description: The issue is related to a NULL pointer dereference in the ImageItem iden function, located in image-items/iden.cc. This problem can lead to potential crashes or other unintended behavior when the...

PT-2025-17426 · Gobgp +4 · Gobgp +4

Name of the Vulnerable Software and Affected Versions: GoBGP versions prior to 3.35.0 Description: An issue was discovered that allows an attacker to cause a crash in the pkg/packet/bgp/bgp.go flowspec parser by sending fewer than 20 bytes in a certain context. Recommendations: For versions prior...

PT-2025-08: Deserialization of untrusted data in TCPDF

This library has a class containing a POP Property Oriented Programming chain. When deserializing this class with certain values ​​of some fields, an attacker can delete an arbitrary file from the system. Vulnerability status: Confirmed by vendor Date of vulnerability remediation: 20.04.2025...

PT-2025-17413 · Unknown · Wing Ftp Server

Name of the Vulnerable Software and Affected Versions: Wing FTP Server versions prior to 7.4.4 Description: Wing FTP Server does not properly validate and sanitize the url parameter of the /downloadpass.html API endpoint, allowing injection of an arbitrary link. If a user clicks a crafted link,...

PT-2025-17392 · 7 Zip +3 · 7-Zip +2

Name of the Vulnerable Software and Affected Versions: 7-Zip versions 22.01 through 24.09 Description: The issue involves 7-Zip not reporting an error for certain invalid xz files, specifically those with issues related to block flags and reserved bits. Recommendations: For versions 22.01 through...

PT-2025-17370 · WordPress · Download Manager

Name of the Vulnerable Software and Affected Versions: Download Manager plugin for WordPress versions up to, and including, 3.3.12 Description: The Download Manager plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the savePackage function...

[SECURITY] [DLA 4130-1] shadow security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4130-1 [email protected] https://www.debian.org/lts/security/ Sylvain Beucler April 18, 2025 https://wiki.debian.org/LTS -...

PT-2025-17309 · Unknown · Namelessmc

Name of the Vulnerable Software and Affected Versions: NamelessMC versions 2.1.4 and prior Description: The issue allows an authenticated attacker to perform a UI-based denial of service DoS by injecting oversized iframes that block the forum UI and disrupt normal user interactions. This is...

PT-2025-17318 · Dify · Dify

Name of the Vulnerable Software and Affected Versions: Dify versions prior to 0.6.12 Description: A vulnerability was identified in Dify, an open-source LLM app development platform, where normal users can enable or disable apps through the API, despite not being permitted to make such changes...

PT-2025-17317 · Dify · Dify

Name of the Vulnerable Software and Affected Versions: Dify versions prior to 0.6.12 Description: A security issue was identified in Dify, an open-source LLM app development platform, where normal users are improperly granted permissions to edit app names, descriptions, and icons. This access...

PT-2025-17342

Name of the Vulnerable Software and Affected Versions Crawl4AI versions 0.4.247 and earlier Description The issue concerns a Server-Side Request Forgery SSRF vulnerability. It is located in the /crawl4ai/async dispatcher.py file. Recommendations For versions 0.4.247 and earlier, update to a versi...

PT-2025-22460 · Google +3 · Google Chrome +3

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 137.0.7151.55 Description: The issue is related to a use after free in Compositing, which could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. The estimated severity of...

PT-2025-17251 · WordPress · Avatar

Name of the Vulnerable Software and Affected Versions: Avatar plugin for WordPress versions up to, and including, 0.1.4 Description: The Avatar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in a function. This makes it possible for...

PT-2025-17308 · Unknown · Namelessmc

Name of the Vulnerable Software and Affected Versions: NamelessMC versions 2.1.4 and prior Description: The issue concerns a lack of length validation for the s parameter in GET requests for the forum search functionality, allowing attackers to submit excessively long search queries. This can lea...