Security Bulletin: IBM Guardium Data Protection is affected by a Privilege Escalation vulnerability (CVE-2025-3473)

Summary IBM Guardium Data Protection has addressed this vulnerability in an update. Vulnerability Details CVEID:CVE-2025-3473 DESCRIPTION: IBM Security Guardium could allow a local privileged user to escalate their privileges to root due to insecure inherited permissions created by the program...

PT-2025-33505 · Unknown · Govulncheck-Vulndb

Name of the Vulnerable Software and Affected Versions: govulncheck-vulndb versions prior to 0.0.20250730T213748 Description: This update addresses multiple issues. Recommendations: Update to version 0.0.20250730T213748 or later to resolve the issues...

PT-2025-31738 · WordPress · Brave Conversion Engine

Name of the Vulnerable Software and Affected Versions: Brave Conversion Engine PRO plugin for WordPress versions through 0.7.7 Description: The Brave Conversion Engine PRO plugin for WordPress is susceptible to authentication bypass due to improper restriction of a claimed identity during Faceboo...

Important: djvulibre

Issue Overview: DjVuLibre is a GPL implementation of DjVu, a web-centric format for distributing documents and images. Prior to version 3.5.29, the MMRDecoder::scanruns method is affected by an OOB-write vulnerability, because it does not check that the xr pointer stays within the bounds of the...

PT-2025-31266 · National Instruments · Ni Labview

Name of the Vulnerable Software and Affected Versions: NI LabVIEW versions 2025 Q1 and prior Description: A memory corruption issue exists due to improper input validation in the lvpict.cpp file. Successful exploitation requires a user to open a specially crafted VI, potentially leading to...

PT-2025-31337 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 15.6 Description: A permissions issue was addressed with additional sandbox restrictions. A sandboxed process may be able to circumvent sandbox restrictions. Recommendations: Update to macOS version 15.6...

PT-2025-31321 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 15.6 macOS versions prior to 14.7.7 Description: An application may be able to access sensitive user data due to insufficient checks. This issue was addressed with improved checks. Recommendations: Update to macOS...

PT-2025-31265 · National Instruments · Ni Labview

Name of the Vulnerable Software and Affected Versions: NI LabVIEW versions 2025 Q1 and prior 32-bit Description: A code injection vulnerability exists in NI LabVIEW due to an improper initialization check, potentially leading to arbitrary code execution. Exploitation requires a user to open a...

PT-2025-31161 · WordPress · Streamweasels Twitch Integration

Name of the Vulnerable Software and Affected Versions: StreamWeasels Twitch Integration plugin for WordPress versions through 1.9.3 Description: The StreamWeasels Twitch Integration plugin for WordPress is susceptible to Stored Cross-Site Scripting via the plugin's data-uuid attribute due to...

PT-2025-31125 · Jetbrains · Teamcity

Name of the Vulnerable Software and Affected Versions: TeamCity versions prior to 2025.07 Description: Password reset and email verification tokens utilized weak hashing algorithms. Recommendations: Update to version 2025.07 or later...

PT-2025-30990

Name of the Vulnerable Software and Affected Versions Heimdall versions prior to 2.7.3 Description Heimdall is susceptible to a cross-site scripting XSS issue via the q parameter. Recommendations Update Heimdall to version 2.7.3 or later...

PT-2025-30744

Name of the Vulnerable Software and Affected Versions Kron PAM versions prior to 3.7 Description Kron PAM is susceptible to a Stored Cross-site Scripting XSS issue due to improper neutralization of input during web page generation. This allows for the injection of malicious scripts. Recommendatio...

PT-2025-30734 · WordPress · Droip

Name of the Vulnerable Software and Affected Versions: Droip plugin for WordPress versions up to 2.2.0 Description: The Droip plugin for WordPress is susceptible to unauthorized modification and access of data due to a missing capability check on the droip post apis function. Authenticated...

PT-2025-30642 · Unknown +1 · Beaver Builder +1

Name of the Vulnerable Software and Affected Versions: Supreme Addons for Beaver Builder plugin for WordPress versions up to and including 1.0.9 Description: The Supreme Addons for Beaver Builder plugin for WordPress is susceptible to Stored Cross-Site Scripting through the auto qrcodesabb...

PT-2025-30970 · Tenda +1 · Tenda Ac18 +1

Name of the Vulnerable Software and Affected Versions: Tenda AC18 version 15.03.05.19 Description: A vulnerability exists in the Tenda AC18 device due to weak password requirements. The issue affects unknown code within the /etc ro/smb.conf file of the Samba component and can be exploited remotel...

PT-2025-30651 · WordPress · Voltax Video Player

Name of the Vulnerable Software and Affected Versions: Voltax Video Player versions prior to 1.6.6 Description: The Voltax Video Player plugin for WordPress is susceptible to Stored Cross-Site Scripting through the id parameter. Insufficient input sanitization and output escaping allow...

PT-2025-30644 · WordPress · Post Grid Master

Name of the Vulnerable Software and Affected Versions: Post Grid Master versions prior to 3.4.14 Description: The Post Grid Master plugin for WordPress is susceptible to Reflected Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows unauthenticated attacker...

PT-2025-30650 · WordPress · Webinarignition

Name of the Vulnerable Software and Affected Versions: WebinarIgnition plugin for WordPress versions up to and including 4.03.31 Description: The WebinarIgnition plugin for WordPress is susceptible to unauthenticated login token generation due to a missing capability check on the webinarignition...

PT-2025-30516 · WordPress · Fleetwire Fleet Management

Name of the Vulnerable Software and Affected Versions: Fleetwire Fleet Management versions prior to 1.0.20 Description: The Fleetwire Fleet Management plugin for WordPress is susceptible to stored cross-site scripting through the fleetwire list shortcode due to insufficient input sanitization and...

PT-2025-30529 · Samsung · Magicinfo 9 Server

Name of the Vulnerable Software and Affected Versions: MagicINFO 9 Server versions prior to 21.1080.0 Description: An unrestricted file upload of dangerous file types in Samsung Electronics MagicINFO 9 Server allows for code injection. Recommendations: MagicINFO 9 Server versions prior to...