CVE-2024-53698 QTS, QuTS hero

A double free vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to modify memory. We have already fixed the vulnerability in the following versions: QTS 5.2.3.3006 bui...

PT-2025-9085 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab-EE versions 16.2 through 17.7.5 GitLab-EE versions 17.8 through 17.8.3 GitLab-EE versions 17.9 through 17.9.0 Description: A vulnerability in GitLab-EE allows a Guest user to read Security policy YAML. Recommendations: For GitLab-EE...

PT-2025-17932

Name of the Vulnerable Software and Affected Versions Commvault Web Server versions prior to 11.36.46 Commvault Web Server versions prior to 11.32.89 Commvault Web Server versions prior to 11.28.141 Commvault Web Server versions prior to 11.20.217 Description An unspecified vulnerability in the...

Multiple cross-site scripting vulnerabilities in Movable Type

Overview Movable Type provided by Six Apart Ltd. contains multiple cross-site scripting vulnerabilities listed below. Stored cross-site scripting vulnerability in the custom block edit page of MT Block Editor CWE-79 - CVE-2025-22888 Stored cross-site scripting vulnerability in the HTML edit mode ...

PT-2025-5607

Name of the Vulnerable Software and Affected Versions: Vitest versions prior to 2.1.9 Vitest versions prior to 3.0.4 Description: The screenshot-error handler on the browser mode HTTP server responds to any file on the file system. If the server is exposed on the network by browser.api.host: true...

Security update for containerized-data-importer

This update for containerized-data-importer fixes the following issues: Update to version 1.60.1 Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.60.1 Add registry path for SLE15 SP7 Bump to the latest tag 1.60.1-150600.3.9.1 Use the images based on SLE15 SP6...

PT-2025-1799 · WordPress · Canvasflow

Name of the Vulnerable Software and Affected Versions: Canvasflow for WordPress plugin versions 1.5.5 and earlier Description: The issue is related to a Reflected Cross-Site Scripting problem, where a parameter is not properly sanitised and escaped before being outputted back in the page. This...

PT-2025-4268 · Oracle +8 · Mysql Server +7

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 8.0.40 and prior MySQL Server versions 8.4.3 and prior MySQL Server versions 9.1.0 and prior Description: The issue allows a high-privileged attacker with network access via multiple protocols to compromise MySQL Server...

PT-2025-4262 · Oracle +8 · Mysql Server +7

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 8.0.40 and prior MySQL Server versions 8.4.3 and prior MySQL Server versions 9.1.0 and prior Description: A vulnerability in the MySQL Server product of Oracle MySQL allows a low-privileged attacker with network access v...

CVE-2024-55921

TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery CSRF. Additionally, state-changing actions in downstrea...

CVE-2024-55894

TYPO3 BEUSER CSRF issue (CVE-2024-55894) affects the Backend User Module. The root cause is CSRF combined with improper handling of state-changing actions via HTTP GET, exposed when security.backend.enforceReferrer is disabled and BE/cookieSameSite is lax/none. Exploitation requires an active bac...

PT-2025-15666 · Unknown +1 · Nats Server +1

Name of the Vulnerable Software and Affected Versions: NATS-Server versions 2.2.0 through 2.10.27 NATS-Server versions prior to 2.11.1 Description: The issue is related to the absence of access controls for the JetStream API in NATS-Server, allowing any user with JS management permissions in any...

PT-2024-10260 · Oracle · Primavera P6 Enterprise Project Portfolio Management

Name of the Vulnerable Software and Affected Versions: Primavera P6 Enterprise Project Portfolio Management versions 20.12.1.0 through 20.12.21.5 Primavera P6 Enterprise Project Portfolio Management versions 21.12.1.0 through 21.12.20.0 Primavera P6 Enterprise Project Portfolio Management version...

PT-2024-10249 · Oracle +8 · Mysql Server +7

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 8.0.40 and prior MySQL Server versions 8.4.3 and prior MySQL Server versions 9.1.0 and prior Description: The vulnerability in the MySQL Server product of Oracle MySQL, specifically in the Server: Parser component, is...

PT-2024-10243 · Oracle +8 · Mysql Server +7

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 8.0.40 and prior MySQL Server versions 8.4.3 and prior MySQL Server versions 9.1.0 and prior Description: The issue is related to the InnoDB component of Oracle MySQL Server and is caused by inadequate authorization...

PT-2024-10393 · Microsoft +5 · Edge +5

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 132.0.6834.159 Microsoft Edge versions prior to 132.0.2957.140 Description: The issue is related to a use-after-free vulnerability in the DevTools of Google Chrome and Microsoft Edge, which could allow a remote...

PT-2024-33250 · Unknown · Qulog Center

Name of the Vulnerable Software and Affected Versions: QuLog Center versions prior to 1.7.0.831 QuLog Center versions prior to 1.8.0.888 Description: A link following vulnerability has been reported to affect QuLog Center, allowing remote attackers to traverse the file system to unintended...

PT-2024-32865

Name of the Vulnerable Software and Affected Versions PhpSpreadsheet versions prior to 1.9.4, 2.1.3, 2.3.2, and 3.4.0 Description The XmlScanner class in PhpSpreadsheet has a scan method that is intended to prevent XXE attacks. However, the regexes used in the scan method and the findCharSet meth...

PT-2024-27294 · Popup Box · Popup Box

Name of the Vulnerable Software and Affected Versions: Popup box versions n/a through 4.5.1 Description: The issue is related to a Missing Authorization vulnerability in Popup Box Team Popup, which allows exploiting incorrectly configured access control security levels. Recommendations: For...

app.valuationcontrol:library (>=0.5.2 <=0.5.5), app.valuationcontrol:webservice (>=0.5.0 <=0.5.1) +1837 more potentially affected by CVE-2024-38821 via org.springframework.security:spring-security-web (>=6.2.0 <=6.2.6)

org.springframework.security:spring-security-web MAVEN version =6.2.0, =0.5.2, =0.5.0, =7.0.0, =1.0.0, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.6, =1.0.1, =1.0.31 and more Source cves: CVE-2024-38821 Source advisory: OSV:GHSA-C4Q5-6C82-3QPW...