PT-2025-27644 · Poppler +3 · Poppler +3

Name of the Vulnerable Software and Affected Versions: Poppler versions prior to 25.06.0 Description: The issue is related to the use of std::atomic int for reference counting in the Poppler PDF rendering library. Since std::atomic int is only 32 bits, it is possible to overflow the reference...

PT-2025-27620 · WordPress · Vikinger +1

Name of the Vulnerable Software and Affected Versions: Vikinger theme for WordPress versions up to, and including, 1.9.32 Description: The issue is related to insufficient file path validation in the vikinger delete activity media ajax function. This allows authenticated attackers with...

PT-2025-27641 · Mediawiki +1 · Mediawiki +1

Name of the Vulnerable Software and Affected Versions: Mediawiki - TwoColConflict Extension versions 1.39.X through 1.39.12 Mediawiki - TwoColConflict Extension versions 1.42.X through 1.42.6 Mediawiki - TwoColConflict Extension versions 1.43.X through 1.43.1 Description: The issue is related to...

PT-2025-27550 · Onelogin · Onelogin Ad Connector

Name of the Vulnerable Software and Affected Versions: OneLogin AD Connector versions prior to 6.1.5 Description: An information disclosure issue exists via the "/api/adc/v4/configuration" endpoint. An attacker with access to a valid directory token can retrieve a plaintext response disclosing...

PT-2025-27500 · Sunshine · Sunshine

Name of the Vulnerable Software and Affected Versions: Sunshine versions prior to 2025.628.4510 Description: The issue is related to a lack of protection against Cross-Site Request Forgery CSRF attacks in the web UI of Sunshine. This allows an attacker to create a malicious web page that can...

PT-2025-27616

Name of the Vulnerable Software and Affected Versions Model Context Protocol Servers Filesystem versions prior to 0.6.4 Model Context Protocol Servers Filesystem versions prior to 2025.7.01 Description An issue exists in the server-filesystem implementation of the Model Context Protocol MCP due t...

PT-2025-27491 · Electron · Electron

Name of the Vulnerable Software and Affected Versions: Electron versions 30.0.0-alpha.1 through 30.0.5 Electron versions 31.0.0-alpha.1 through 31.0.0-beta.1 Description: The issue is an ASAR Integrity bypass, which only impacts applications that have the embeddedAsarIntegrityValidation and...

PT-2025-27464 · Electron · Electron

Name of the Vulnerable Software and Affected Versions: Electron versions prior to 28.3.2 Electron versions prior to 29.3.3 Electron versions prior to 30.0.3 Description: The issue is related to heap buffer overflows in Electron's API, specifically affecting the nativeImage.createFromPath and...

PT-2025-27413 · WordPress · Contact-Form-Plugin

Name of the Vulnerable Software and Affected Versions: Contact Form Plugin WordPress plugin versions prior to 1.1.29 Description: The issue concerns the Contact Form Plugin WordPress plugin, where some settings are not properly sanitized and escaped, potentially allowing high-privilege users, suc...

PT-2025-27465

Name of the Vulnerable Software and Affected Versions: Sudo versions 1.8.8 through 1.9.17 Description: Sudo, a program designed to provide limited super user privileges, contains a vulnerability due to incorrect handling of the host -h or --host option. This flaw allows a local user to potentiall...

PT-2025-27222 · Unknown · Społecznościowa 6 Pl 2013

Name of the Vulnerable Software and Affected Versions: Społecznościowa 6 PL 2013 versions n/a through 2.0.6 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web...

PT-2025-27259

Name of the Vulnerable Software and Affected Versions: Roo Code versions prior to 3.20.3 Description: The issue concerns the Roo Code agent's search files tool, which did not respect the setting to disable reads outside of the VS Code workspace. This allowed an attacker who could inject a prompt...

PT-2025-27064 · Unknown · Pandora Fms

Name of the Vulnerable Software and Affected Versions: Pandora FMS versions 774 through 778 Description: The issue is related to the improper neutralization of special elements in the Netflow directory field, which may allow OS command injection. This could potentially lead to the execution of...

PT-2025-27168 · WordPress · Wp Youtube Live

Name of the Vulnerable Software and Affected Versions: WP YouTube Live versions 1.10.0 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized requests. Recommendations: For WP YouTube Live versions 1.10.0 and earlier, update to a version that...

PT-2025-27171 · Unknown · Onet Regenerate Thumbnails

Name of the Vulnerable Software and Affected Versions: ONet Regenerate Thumbnails versions 1.5 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This can be achieved by tricking the...

PT-2025-27053 · WordPress · Wp Map Block

Name of the Vulnerable Software and Affected Versions: WP Map Block versions prior to 2.0.3 Description: The issue concerns the WP Map Block WordPress plugin, which does not validate and escape some of its block options before outputting them back in a page or post where the block is embedded. Th...

PT-2025-26972

Name of the Vulnerable Software and Affected Versions: MongoDB Server versions prior to 5.0.31 MongoDB Server versions prior to 6.0.24 MongoDB Server versions prior to 7.0.21 MongoDB Server versions prior to 8.0.5 Description: The issue allows an authenticated user request to execute with stale...

PT-2025-26960 · Drupal · Glightbox

Name of the Vulnerable Software and Affected Versions: GLightbox versions 0.0.0 through 1.0.15 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS, in Drupal GLightbox. This allows for Cross-Site Scripting XSS...

PT-2025-30923 · Salesforce · Tableau Server

Name of the Vulnerable Software and Affected Versions: Tableau Server versions prior to 2025.1.3 Tableau Server versions prior to 2024.2.12 Tableau Server versions prior to 2023.3.19 Description: An authorization bypass issue exists in Salesforce Tableau Server on Windows and Linux due to a...

PT-2025-26943 · Puppet · Puppet Enterprise

Name of the Vulnerable Software and Affected Versions: Puppet Enterprise versions 2018.1.8 through 2023.8.3 Puppet Enterprise version 2025.3 Description: A user with specific node group editing permissions and a specially crafted class parameter could execute commands as root on the primary host...