Fedora 41 : chromium (2025-98dd4c4639)

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-98dd4c4639 advisory. Update to 135.0.7049.52 High CVE-2025-3066: Use after free in Navigations Medium CVE-2025-3067: Inappropriate implementation in Custom Tabs Medium...

Fedora 40 : chromium (2025-609ed3aaa7)

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-609ed3aaa7 advisory. Update to 135.0.7049.52 High CVE-2025-3066: Use after free in Navigations Medium CVE-2025-3067: Inappropriate implementation in Custom Tabs Medium...

CVE-2025-31480 aiven-extras allows PostgreSQL Privilege Escalation through format function

aiven-extras is a PostgreSQL extension. This is a privilege escalation vulnerability, allowing elevation to superuser inside PostgreSQL databases that use the aiven-extras package. The vulnerability leverages the format function not being schema-prefixed. Affected users should install 1.1.16 and...

PT-2025-14970 · Unknown · Illid Advanced Woo Labels

Name of the Vulnerable Software and Affected Versions: ILLID Advanced Woo Labels versions n/a through 2.14 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can...

PT-2025-14984 · Woocommerce · Ni Woocommerce Cost Of Goods

Name of the Vulnerable Software and Affected Versions: Anzar Ahmed Ni WooCommerce Cost Of Goods versions 3.2.8 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for Stored XSS attacks. This means that an attacker can inject...

PT-2025-14989 · Unknown · Privyr Crm

Name of the Vulnerable Software and Affected Versions: Privyr CRM versions 1.0.1 and earlier Description: The issue is related to a Missing Authorization vulnerability, allowing the exploitation of incorrectly configured access control security levels. Recommendations: For Privyr CRM versions 1.0...

PT-2025-14839 · Unknown · Spatie/Browsershot

Name of the Vulnerable Software and Affected Versions: spatie/browsershot versions 0.0.0 through 3.1 Description: The issue is related to Server-side Request Forgery SSRF in the setUrl function due to a missing restriction on user input. This enables attackers to access localhost and list all of...

PT-2025-14975 · Wpminds · Wpminds Simple Wp Events

Name of the Vulnerable Software and Affected Versions: WPMinds Simple WP Events versions 1.8.17 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting', which allows Stored XSS. This means that an attacker...

PT-2025-14902

Name of the Vulnerable Software and Affected Versions BentoML versions 1.3.8 through 1.4.2 Description A Remote Code Execution RCE vulnerability caused by insecure deserialization has been identified in BentoML. It allows any unauthenticated user to execute arbitrary code on the server. The...

PT-2025-14913 · WordPress · Erick Danzer Easy Query – Wp Query Builder

Name of the Vulnerable Software and Affected Versions: Erick Danzer Easy Query – WP Query Builder versions 2.0.4 and earlier Description: The issue is related to an SQL Injection vulnerability, specifically an Improper Neutralization of Special Elements used in an SQL Command. This allows for Bli...

Debian: Security Advisory (DLA-4112-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Django 5.0.x < 5.0.14, 5.1.x < 5.1.8 DoS Vulnerability - Windows

Django is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:djangoproject:django"; ...

PT-2025-14924 · Unknown · Secure Copy Content Protection/Content Locking

Name of the Vulnerable Software and Affected Versions: Ays Pro Secure Copy Content Protection and Content Locking versions n/a through 4.5.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XS...

PT-2025-15011 · Era404 · Era404 Stafflist

Name of the Vulnerable Software and Affected Versions: ERA404 StaffList versions 3.2.6 and earlier Description: The issue allows exposure of sensitive system information to an unauthorized control sphere, enabling the retrieval of embedded sensitive data. Recommendations: For ERA404 StaffList...

PT-2025-15013

Name of the Vulnerable Software and Affected Versions 1 Click WordPress Migration versions n/a through 2.2 Description The issue is related to the exposure of sensitive system information due to uncleared debug information in 1 Click WordPress Migration, allowing the retrieval of embedded sensiti...

PT-2025-14864 · WordPress · Vehica Core

Name of the Vulnerable Software and Affected Versions: Vehica Core plugin for WordPress versions up to and including 1.0.97 Description: The issue arises from the plugin not properly validating user meta fields before updating them in the database. This allows authenticated attackers with...

PT-2025-14981 · Unknown · Xpro Theme Builder

Name of the Vulnerable Software and Affected Versions: Xpro Theme Builder versions 1.2.8.3 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For Xpro Theme Builder...

PT-2025-14923 · Unknown · Funnelcockpit

Name of the Vulnerable Software and Affected Versions: FunnelCockpit versions 1.4.2 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS in FunnelCockpit. Recommendations: For...

PT-2025-14897 · Hutsixdigital · Hutsixdigital Tiger

Name of the Vulnerable Software and Affected Versions: hutsixdigital Tiger versions n/a through 2.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject...

PT-2025-14713 · WordPress · Blubrry Powerpress Podcasting Plugin

Name of the Vulnerable Software and Affected Versions: Blubrry PowerPress Podcasting plugin MultiSite add-on versions 0.1.1 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Reflected X...