Important: perl-File-Find-Rule

Issue Overview: File::Find::Rule through 0.34 for Perl is vulnerable to Arbitrary Code Execution when grep encounters a crafted filename. A file handle is opened with the 2 argument form of open allowing an attacker controlled filename to provide the MODE parameter to open, turning the filename...

PT-2025-26607

Name of the Vulnerable Software and Affected Versions: MLflow versions prior to 3.1.0 Description: The issue is related to the gateway proxy handler in MLflow, which lacks gateway path validation. This could potentially lead to exploitation. Recommendations: For versions prior to 3.1.0, update to...

PT-2025-26602 · Jetbrains +1 · Teamcity +1

Name of the Vulnerable Software and Affected Versions: JetBrains TeamCity versions prior to 2025.03.3 Description: The issue concerns reflected XSS in the NPM Registry integration. Recommendations: For versions prior to 2025.03.3, update to version 2025.03.3 or later to resolve the issue...

PT-2025-26587 · Unknown · Pointcloudlibrary

Name of the Vulnerable Software and Affected Versions: PointCloudLibrary PCL versions prior to 1.14.0 Description: The issue is related to a memory corruption vulnerability in the Point Cloud Library PCL, specifically in the CRC32 module, associated with the program files crc32.C. This...

PT-2025-26598 · Jetbrains · Teamcity

Name of the Vulnerable Software and Affected Versions: JetBrains TeamCity versions prior to 2025.03.3 Description: A DOM-based XSS issue was found at the Performance Monitor page. Recommendations: For versions prior to 2025.03.3, update to version 2025.03.3 or later to resolve the issue...

PT-2025-26589 · Unknown · Notepadnext

Name of the Vulnerable Software and Affected Versions: NotepadNext versions through v0.11 Description: The issue is an Out-of-bounds Write vulnerability in dail8859 NotepadNext, affecting the src/lua/src modules, specifically program files ldebug.C and lvm.C. Recommendations: For NotepadNext...

Medium: tomcat10

Issue Overview: Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI servlet. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.6, fr...

Medium: tomcat10

Issue Overview: Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI servlet. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.6, fr...

Medium: tomcat9

Issue Overview: Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI servlet. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.6, fr...

PT-2025-26634

Name of the Vulnerable Software and Affected Versions: pbkdf2 versions 3.0.10 through 3.1.2 Description: The issue is related to an Improper Input Validation vulnerability in pbkdf2, allowing Signature Spoofing by Improper Validation. This vulnerability is associated with program files...

PT-2025-26585 · Dragonfly · Dragonfly

Name of the Vulnerable Software and Affected Versions: dragonfly versions 1.28.18 through 1.30.1 Description: The issue is related to an Integer Overflow or Wraparound vulnerability in the dragonflydb dragonfly, specifically in the src/redis/lua/struct modules, associated with program files lua...

PT-2025-26639

Name of the Vulnerable Software and Affected Versions: pbkdf2 versions =3.1.2 Description: The issue is related to an Improper Input Validation vulnerability in pbkdf2, allowing Signature Spoofing by Improper Validation. Recommendations: For versions =3.1.2, update to a version greater than 3.1.2...

PT-2025-26530 · Yealink · Yealink Ymcs Rps

Name of the Vulnerable Software and Affected Versions: Yealink YMCS RPS versions prior to 2025-05-26 Description: The certificate upload function in Yealink YMCS RPS does not properly validate certificate content, potentially allowing invalid certificates to be uploaded. Recommendations: For...

GHSA-G3QG-6746-3MG9 zkVM Underconstrained Vulnerability

Due to a missing constraint in the rv32im circuit, any 3-register RISC-V instruction including remu and divu in risc0-zkvm 2.0.0, 2.0.1, and 2.0.2 are vulnerable to an attack by a malicious prover. The main idea for the attack is to confuse the RISC-V virtual machine into treating the value of th...

PT-2025-26391 · Unknown · Anant Addons For Elementor

Name of the Vulnerable Software and Affected Versions: Anant Addons for Elementor versions 1.2.0 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS attacks. Recommendations: F...

PT-2025-26399 · Unknown · Atakan Au Automatically Hierarchic Categories In Menu

Name of the Vulnerable Software and Affected Versions: Atakan Au Automatically Hierarchic Categories in Menu versions 2.0.9 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS, which allows Stored XSS...

PT-2025-26383 · Spoki · Spoki

Name of the Vulnerable Software and Affected Versions: Spoki versions through 2.16.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Stored XSS. This enables attackers to inject malicious scripts into w...

PT-2025-26423 · Unknown · Wp Front User Submit +1

Name of the Vulnerable Software and Affected Versions: aharonyan WP Front User Submit / Front Editor versions through 4.9.4 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows Cross Site Request Forgery. Recommendations: For versions through 4.9.4, update to a...

PT-2025-26406 · Boldgrid · Post/Page Builder By Boldgrid

Name of the Vulnerable Software and Affected Versions: Post and Page Builder by BoldGrid – Visual Drag and Drop Editor versions 1.27.8 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions to be performed on behalf of a user...

PT-2025-26396 · Woocommerce · Related Products Manager For Woocommerce

Name of the Vulnerable Software and Affected Versions: Related Products Manager for WooCommerce versions 1.6.2 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows DOM-Based XSS. This means...