Fedora: Security Advisory (FEDORA-2025-c04e5b95f1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2025-24673

Name of the Vulnerable Software and Affected Versions GeoServer versions prior to 2.27.1 GeoServer versions prior to 2.26.3 GeoServer versions prior to 2.25.7 GeoTools versions prior to 33.1 GeoTools versions prior to 32.3 GeoTools versions prior to 31.7 GeoTools versions prior to 28.6.1 GeoNetwo...

PT-2025-24432

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 3.4.4 Discourse version 3.5.0.beta5 and earlier of the beta branch Discourse version 3.5.0.beta6-dev and earlier of the tests-passed branch Description The issue concerns HTML injection in email bodies when the topi...

PT-2025-24482 · WordPress · Flap - Business Wordpress Theme

Name of the Vulnerable Software and Affected Versions: FLAP - Business WordPress Theme versions 1.5 and earlier Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. This can potentially be exploited, although specific details about the estimated...

PT-2025-24438

Name of the Vulnerable Software and Affected Versions FastGPT versions prior to 4.9.11 Description The issue concerns the Sandbox container in FastGPT, which has insufficient isolation and inadequate restrictions on code execution. This allows attackers to escape the intended sandbox boundaries b...

PT-2025-26727

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 140 Firefox ESR versions prior to 128.12 Description: The issue arises when a file download is specified via the Content-Disposition header, but this directive is ignored if the file is included via an or tag. This...

PT-2025-24315

Name of the Vulnerable Software and Affected Versions CoreDNS versions prior to 1.12.2 CoreDNS versions prior to 1.21.2 Description A Denial of Service DoS issue exists in the CoreDNS DNS-over-QUIC DoQ server implementation. The server previously created a new goroutine for every incoming QUIC...

PT-2025-24194 · WordPress · Wp Shopify

Name of the Vulnerable Software and Affected Versions: WP Shopify versions 1.5.3 and earlier Description: The issue is related to improper control of filename for include/require statement in PHP programs, also known as 'PHP Remote File Inclusion'. This allows PHP Local File Inclusion...

PT-2025-24248 · Pickplugins · Pickplugins Job Board Manager

Name of the Vulnerable Software and Affected Versions: PickPlugins Job Board Manager versions 2.1.60 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For...

PT-2025-24192 · Otwthemes · Otwthemes Widgetize Pages Light

Name of the Vulnerable Software and Affected Versions: OTWthemes Widgetize Pages Light versions 3.0 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web...

PT-2025-24224 · Wpforms · Pdf For Wpforms

Name of the Vulnerable Software and Affected Versions: PDF for WPForms versions 5.5.0 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. This can be exploited through the add-ons.or...

PT-2025-24168 · Otwthemes · Otwthemes Post Custom Templates Lite

Name of the Vulnerable Software and Affected Versions: OTWthemes Post Custom Templates Lite versions 1.14 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for Stored Cross-site Scripting XSS. This means that an attacker can...

PT-2025-24126 · Unknown · Bg Orthodox Calendar

Name of the Vulnerable Software and Affected Versions: Bg Orthodox Calendar versions 0.13.10 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web applicatio...

PT-2025-23636

Name of the Vulnerable Software and Affected Versions MailEnable versions prior to 10 Description A Cross Site Scripting XSS issue allows a remote attacker to execute arbitrary code via the "failure.aspx" component. Recommendations For versions prior to 10, update to version 10 or later to resolv...

PT-2025-23482 · Qt Company +3 · Qt +3

Name of the Vulnerable Software and Affected Versions: Qt versions 5.15.18 and earlier, 6.0.0 through 6.5.8, 6.6.0 through 6.8.3, and 6.9.0 Description: An issue was found in the private API function qDecodeDataUrl in QtCore, which is used in QTextDocument and QNetworkReply. If the function is...

PT-2025-23542 · Splunk · Splunk Cloud Platform +1

Name of the Vulnerable Software and Affected Versions: Splunk Enterprise versions prior to 9.4.2 Splunk Enterprise versions prior to 9.3.4 Splunk Enterprise versions prior to 9.2.6 Splunk Cloud Platform versions prior to 9.3.2411.102 Splunk Cloud Platform versions prior to 9.3.2408.111 Splunk Clo...

PT-2025-23376 · WordPress · Offsprout Page Builder

Name of the Vulnerable Software and Affected Versions: The Offsprout Page Builder plugin for WordPress versions 2.2.1 through 2.15.2 Description: The Offsprout Page Builder plugin for WordPress is vulnerable to Privilege Escalation due to improper authorization placed on the permission callback...

PT-2025-23499 · Para · Para

Name of the Vulnerable Software and Affected Versions: Para versions prior to 1.50.8 Description: A vulnerability exists in Para, a multitenant backend server/framework for object persistence and retrieval, which exposes both access and secret keys in logs without redaction. These credentials are...

PT-2025-23190 · Ibm · Ibm Db2

Name of the Vulnerable Software and Affected Versions: IBM Db2 for Linux, UNIX and Windows includes DB2 Connect Server versions 11.1.0 through 11.1.4.7 IBM Db2 for Linux, UNIX and Windows includes DB2 Connect Server versions 11.5.0 through 11.5.9 IBM Db2 for Linux, UNIX and Windows includes DB2...

PT-2025-23169 · Mattermost · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost versions 9.11.x through 9.11.12 Mattermost versions 10.5.x through 10.5.3 Mattermost versions 10.6.x through 10.6.2 Mattermost versions 10.7.x through 10.7.0 Description: The issue is related to the improper validation of permissio...