aiohttp < 3.12.14 HTTP Request Smuggling Vulnerability - Windows

aiohttp is prone to an HTTP request smuggling vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Node.js 20.x < 20.19.4, 21.x < 22.17.1, 23.x < 24.4.1 Path Traversal Protection Bypass Vulnerability - Windows

Node.js is prone to a path traversal bypass vulnerability in path.normalize. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

PT-2025-29911 · Maxkb · Maxkb

Name of the Vulnerable Software and Affected Versions: MaxKB versions prior to 2.0.0 Description: MaxKB is an open-source AI assistant for enterprise. Prior to version 2.0.0, the sandbox design rules can be bypassed because the software only restricts the execution permissions of files in a...

PT-2025-29907 · Blubird · Bluebird Barcode Scanner

Name of the Vulnerable Software and Affected Versions: Bluebird barcode scanner application versions prior to 1.3.3 Description: The barcode scanner application on Bluebird devices exposes an unsecured broadcast receiver, kr.co.bluebird.android.bbsettings.BootReceiver. A local attacker can exploi...

KLA85940 ACE vulnerability in Opera

ACE vulnerability was found in Opera. Malicious users can exploit this vulnerability to execute arbitrary code. Original advisories Opera 120 Exploitation Public exploits exist for this vulnerability. Malware exists for this vulnerability. Usually such malware is classified as Exploit. More...

Debian: Security Advisory (DSA-5962-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Slackware: Security Advisory (SSA:2025-197-01)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

WordPress Youtube Vimeo Video Player and Slider <= 3.8 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Plugin Youtube Vimeo Video Player and Slider versions = 3.8...

Oracle MySQL Server 8.0.0 - 8.0.41, 8.4.0 - 8.4.4, 9.0.0 - 9.2.0 Security Update (cpujul2025) - Windows

Oracle MySQL Server is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Oracle MySQL Server 8.0.0 - 8.0.42 Security Update (cpujul2025) - Linux

Oracle MySQL Server is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Oracle MySQL Server 9.0.0 - 9.1.0 Security Update (cpujul2025) - Windows

Oracle MySQL Server is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:oracle:mysql"; if...

PT-2025-29759 · Blazethemes · News Kit Elementor Addons

Name of the Vulnerable Software and Affected Versions: blazethemes News Kit Elementor Addons versions through 1.3.4 Description: The software contains a missing authorization issue, allowing exploitation of incorrectly configured access control security levels. Recommendations: Update blazethemes...

PT-2025-29711 · Zyxel · Zyxel Vmg8825-T50K

Name of the Vulnerable Software and Affected Versions: Zyxel VMG8825-T50K firmware versions prior to V5.50ABOM.5C0 Description: A buffer overflow exists in the URL parser of the zhttpd web server. This issue could allow an unauthenticated attacker to cause denial-of-service DoS conditions and...

PT-2025-29812 · Unknown · Cmsminds Pay With Contact Form 7

Name of the Vulnerable Software and Affected Versions: cmsMinds Pay with Contact Form 7 versions through 1.0.4 Description: The software contains a Reflected Cross-site Scripting XSS issue due to improper neutralization of input during web page generation. This allows for the injection of malicio...

PT-2025-29796 · WordPress · Valvepress Wordpress Auto Spinner

Name of the Vulnerable Software and Affected Versions: ValvePress Wordpress Auto Spinner versions through 3.25.0 Description: The software contains a Reflected Cross-site Scripting XSS issue due to improper neutralization of input during web page generation. Recommendations: Update ValvePress...

PT-2025-29748 · Unknown · Kyle Gilman Videopack

Name of the Vulnerable Software and Affected Versions: Kyle Gilman Videopack versions through 4.10.3 Description: The software contains a DOM-Based Cross-site Scripting issue due to improper neutralization of input during web page generation. Recommendations: Update to a version later than 4.10.3...

Ubuntu: Security Advisory (USN-7635-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory (FEDORA-2025-e286662e59)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2025-30903 · Rubygems · Measured

Impact A path traversal vulnerability exists where an attacker with access to manipulate inputs when initializing the Measured::Cache::Json class would be able to instruct the library to read arbitrary files. Patches Users should update to the latest version...

PT-2025-29542 · WordPress · Restrict File Access

Name of the Vulnerable Software and Affected Versions: Restrict File Access plugin for WordPress versions up to and including 1.1.2 Description: The Restrict File Access plugin for WordPress is susceptible to Cross-Site Request Forgery due to missing or incorrect nonce validation on the...