SMM Memory Corruption Vulnerability in the AMI Aptio's SMM Module Across Multiple Devices

Overview System Management Mode SMM memory corruption vulnerabilities have been identified in UEFI modules present in AMI Aptio UEFI firmware. An attacker could exploit this vulnerability to elevate privileges and execute arbitrary code in the highly privileged SMM environment. Users should apply...

PT-2025-33237 · Suredash · Suredash

Name of the Vulnerable Software and Affected Versions: SureDash versions through 1.1.0 Description: SureDash is susceptible to a flaw that permits the retrieval of embedded sensitive data due to the insertion of sensitive information into sent data. Recommendations: Update SureDash to a version...

PT-2025-33375 · Laborator · Kalium

Name of the Vulnerable Software and Affected Versions: Kalium versions n/a through 3.18.3 Description: A Cross-Site Request Forgery CSRF vulnerability exists in Laborator Kalium, allowing attackers to perform actions on behalf of authenticated users. Recommendations: Update Kalium to a version...

PT-2025-33244 · WordPress · Wp Swings Membership For Woocommerce

Name of the Vulnerable Software and Affected Versions: WP Swings Membership For WooCommerce versions through 2.9.0 Description: The software contains a missing authorization flaw that allows access to functionality not properly constrained by Access Control Lists ACLs. Recommendations: Update WP...

PT-2025-33257 · WordPress · Wpevently

Name of the Vulnerable Software and Affected Versions: WpEvently versions through 4.4.6 Description: The software contains a missing authorization flaw due to incorrectly configured access control security levels. Recommendations: Update WpEvently to a version later than 4.4.6...

PT-2025-33249 · Kadence Wp · Kadence Woocommerce Email Designer

Name of the Vulnerable Software and Affected Versions: Kadence WooCommerce Email Designer versions n/a through 1.5.16 Description: An incorrect privilege assignment issue exists in Kadence WooCommerce Email Designer, potentially allowing privilege escalation. Recommendations: Update Kadence...

PT-2025-33280 · Dell +1 · Dell Poweredge Platform +1

Name of the Vulnerable Software and Affected Versions: Dell PowerEdge Platform versions prior to 1.25.0 Description: Dell PowerEdge Platform versions 14G AMD BIOS contains an Access of Memory Location After End of Buffer issue. A local attacker with low privileges could potentially exploit this,...

PT-2025-33288 · Dell · Dell Supportassist For Business Pcs

Name of the Vulnerable Software and Affected Versions: SupportAssist for Business PCs versions 4.5.3 and prior Description: SupportAssist for Business PCs versions 4.5.3 and prior contain an Incorrect Privilege Assignment issue. A low privileged attacker with local access could potentially exploi...

PT-2025-33367 · WordPress · Wp-Database-Optimizer-Tools

Name of the Vulnerable Software and Affected Versions: WP-Database-Optimizer-Tools versions through 0.2 Description: A Cross-Site Request Forgery CSRF issue exists in WP-Database-Optimizer-Tools, potentially allowing attackers to perform actions on behalf of authenticated users. Recommendations:...

PT-2025-33341 · @Std/Toml · @Std/Toml

Name of the Vulnerable Software and Affected Versions: @std/toml versions prior to 1.0.9 Description: Prior to version 1.0.9, the @std/toml library is susceptible to a Prototype Pollution PP vulnerability in Node.js runtime and Browser environments when parsing untrusted TOML data. This occurs...

Google Chrome Security Update (stable-channel-update-for-desktop_12-2025-08) - Mac OS X

Google Chrome is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:google:chrome"; ifdescription...

PT-2025-33180 · Digitalocean · Digitalocean Spaces Sync

Name of the Vulnerable Software and Affected Versions: DigitalOcean Spaces Sync versions through 2.2.1 Description: The software contains an improper neutralization of input during web page generation, leading to a stored cross-site scripting issue. Recommendations: Update to a version later than...

PT-2025-33256 · WordPress · Easy Addons For Elementor

Name of the Vulnerable Software and Affected Versions: hashthemes Easy Elementor Addons versions through 2.2.6 Description: The software contains a DOM-Based Cross-site Scripting XSS issue due to improper neutralization of input during web page generation. Recommendations: Update hashthemes Easy...

PT-2025-33259 · Unknown · Realmag777 Mdtf

Name of the Vulnerable Software and Affected Versions: RealMag777 MDTF versions through 1.3.3.7 Description: RealMag777 MDTF is susceptible to a SQL Injection issue due to improper neutralization of special elements used in an SQL command. This allows for potential SQL Injection attacks...

PT-2025-33251 · Unknown · Masteriyo - Lms

Name of the Vulnerable Software and Affected Versions: Masteriyo - LMS versions through 1.18.3 Description: The software contains a Stored Cross-Site Scripting XSS flaw due to improper neutralization of input during web page generation. This allows for the injection of malicious scripts into web...

PT-2025-33153 · Stefanoai · Advanced Google Universal Analytics

Name of the Vulnerable Software and Affected Versions: stefanoai Advanced Google Universal Analytics versions through 1.0.3 Description: A missing authorization flaw in stefanoai Advanced Google Universal Analytics allows exploitation of incorrectly configured access control security levels...

SUSE: Security Advisory (SUSE-SU-2025:02758-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2025-33189 · Unknown · Cleverreach® Wp

Name of the Vulnerable Software and Affected Versions: CleverReach® WP versions through 1.5.20 Description: CleverReach® WP is susceptible to a SQL injection flaw due to improper neutralization of special elements within SQL commands. This allows for potential SQL injection attacks...

PT-2025-33221 · Mycred · Mycred

Name of the Vulnerable Software and Affected Versions: myCred versions through 2.9.4.3 Description: A Time-of-check Time-of-use TOCTOU race condition exists in myCred. This issue allows leveraging Time-of-Check and Time-of-Use TOCTOU Race Conditions. Recommendations: Update myCred to a version...

PT-2025-33197 · WordPress · Gravitywp - Merge Tags

Name of the Vulnerable Software and Affected Versions: GravityWP - Merge Tags versions through 1.4.4 Description: A flaw exists in the handling of filenames within the Include/Require statement in PHP programs, specifically in GravityWP - Merge Tags. This issue allows for PHP Local File Inclusion...