snowflake-connector-python vulnerable to SQL Injection in write_pandas

Issue Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. A function from the snowflake.connector.pandastools module is vulnerable to SQL injection. This vulnerability affects versions 2.2.5 through 3.13.0. Snowflake fixed the issue in version 3.13.1...

PT-2025-8992

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.13.0-rc7-next-20250116-arm64-renesas-00002-g35245dfdc62c Description A vulnerability in the Linux kernel has been resolved, specifically in the ravb driver. The issue was related to missing rtnl lock in the...

SUSE: Security Advisory (SUSE-SU-2025:0281-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Advisory ROSA-SA-2025-2643

software: dcmtk 3.6.6 OS: ROSA-CHROME packageevrstring: dcmtk-3.6.6 CVE-ID: CVE-2022-2119 BDU-ID: 2023-03840 CVE-Crit: CRITICAL. CVE-DESC.: A vulnerability in the DICOM DCMTK format library is related to flaws in the directory path name restriction. Exploitation of the vulnerability allows an...

PT-2025-7047

Name of the Vulnerable Software and Affected Versions libxml2 versions 2.12.10 and earlier, 2.13.x versions prior to 2.13.6 Description The issue is a stack-based buffer overflow in the xmlSnprintfElements function in valid.c. To exploit this, DTD validation must occur for an untrusted document o...

PT-2025-5429 · Unknown · Edwiser Bridge

Name of the Vulnerable Software and Affected Versions: Edwiser Bridge versions 3.0.8 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows Reflected XSS. This means that an attacker can inject malicious scripts into the website,...

PT-2025-1299

Name of the Vulnerable Software and Affected Versions Cacti versions prior to 1.2.29 Cacti versions prior to 1.2.24+ds1-1+deb12u5 Cacti versions prior to 1.2.16+ds1-2+deb11u5 Description Cacti, a web interface for graphing of monitoring systems, contains a flaw in its multi-line SNMP result parse...

PT-2025-2195 · WordPress · Survey Maker

Name of the Vulnerable Software and Affected Versions: Survey Maker plugin for WordPress versions up to, and including, 5.1.3.3 Description: The issue is related to Stored Cross-Site Scripting via the ays sections5questions8title parameter due to insufficient input sanitization and output escapin...

PT-2025-5539 · Unknown · Thim Elementor Kit

Name of the Vulnerable Software and Affected Versions: Thim Elementor Kit versions 1.2.8 and earlier Description: The issue is related to a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. Recommendations: For Thim Elementor Kit...

PT-2025-5510 · Unknown · Yehi Advanced Notifications

Name of the Vulnerable Software and Affected Versions: Yehi Advanced Notifications versions 1.2.7 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For Yehi Advanc...

PT-2025-2424

Name of the Vulnerable Software and Affected Versions: WSO2 versions prior to the latest version Description: A stored XSS issue in the Management Console's registry has been identified. The estimated number of potentially affected devices worldwide is not specified. There is no information about...

PT-2025-5562 · Kadence Blocks · Kadence Wp Gutenberg Blocks

Name of the Vulnerable Software and Affected Versions: Kadence WP Gutenberg Blocks by Kadence Blocks versions 3.3.1 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendation...

PT-2025-5341

Name of the Vulnerable Software and Affected Versions asteval versions prior to 1.0.6 Description The issue is rooted in how asteval performs handling of FormattedValue AST nodes, specifically the on formattedvalue value using the dangerous format method of the str class. This allows an attacker ...

PT-2025-5413 · WordPress · Epsiloncool Wp Fast Total Search

Name of the Vulnerable Software and Affected Versions: Epsiloncool WP Fast Total Search versions 1.78.258 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This can be achieved by...

PT-2025-1871 · WordPress · Broadcast Live Video – Live Streaming

Name of the Vulnerable Software and Affected Versions: Broadcast Live Video – Live Streaming : HTML5, WebRTC, HLS, RTSP, RTMP plugin for WordPress versions up to, and including, 6.1.9 Description: The issue is related to Stored Cross-Site Scripting via the plugin's videowhisper hls shortcode due ...

PT-2025-6475 · Microsoft +4 · Edge +4

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 133.0.6943.98 Microsoft Edge affected versions not specified Description: The issue is related to an inappropriate implementation in the Browser UI, allowing a remote attacker to spoof the contents of the Omnib...

PT-2025-5098 · Unknown +1 · Buddypress +1

Name of the Vulnerable Software and Affected Versions: Eliott Robson Mass Messaging in BuddyPress versions n/a through 2.2.1 Description: The issue is related to improper neutralization of input during web page generation, which allows for Reflected Cross-site Scripting XSS. This means an attacke...

PT-2025-4292 · Oracle +1 · Virtualbox +1

Name of the Vulnerable Software and Affected Versions: Oracle VM VirtualBox versions prior to 7.0.24 Oracle VM VirtualBox versions prior to 7.1.6 Description: The issue allows a high-privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM...

PT-2025-4266 · Oracle · Oracle Communications Order/Service Management

Name of the Vulnerable Software and Affected Versions: Oracle Communications Order and Service Management versions 7.4.0 through 7.5.0 Description: The issue is related to improper permission storage in the Oracle Communications Order and Service Management product, allowing a low-privileged...

PT-2025-4274 · Oracle · Jd Edwards Enterpriseone Orchestrator

Name of the Vulnerable Software and Affected Versions: JD Edwards EnterpriseOne Orchestrator versions prior to 9.2.9.2 Description: The issue is related to insufficient input validation in the E1 IOT Orchestrator Security component. It can be easily exploited by a low-privileged attacker with...