PT-2025-3925 · Rockwell Automation · Factorytalk Assetcentre

Name of the Vulnerable Software and Affected Versions: Rockwell Automation FactoryTalk AssetCentre versions prior to V15.00.001 Description: A data exposure issue exists due to insecure storage of FactoryTalk Security user tokens, which could allow a threat actor to steal a token and impersonate...

Buffer Over-read

Overview Affected versions of this package are vulnerable to Buffer Over-read through the loading of a specially crafted file. Remediation Upgrade Microsoft.NETCore.App.Runtime.win-arm to version 8.0.12, 9.0.1 or higher. References - GitHub Issue - GitHub Issue - Security Advisory...

Heap-based Buffer Overflow

Overview Affected versions of this package are vulnerable to Heap-based Buffer Overflow through the loading of a specially crafted file. Remediation Upgrade Microsoft.NETCore.App.Runtime.linux-musl-arm64 to version 8.0.12, 9.0.1 or higher. References - GitHub Issue...

Heap-based Buffer Overflow

Overview Affected versions of this package are vulnerable to Heap-based Buffer Overflow. An attacker can execute arbitrary code by sending malicious requests designed to exploit the vulnerability. Remediation Upgrade Microsoft.NETCore.App.Runtime.win-arm64 to version 9.0.1 or higher. References -...

Improper Input Validation

Overview UmbracoForms is a tool that makes creating contact forms, entry forms and questionnaires just as easy as using Word. Affected versions of this package are vulnerable to Improper Input Validation due to the lack of server-side validation for character limits in short and long answer field...

CVE-2025-23033

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting XSS vulnerability was identified in the adicionarsituacao.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts...

CVE-2025-23031 Cross-Site Scripting (XSS) Stored endpoint 'adicionar_alergia.php' parameter 'nome' in WeGIA

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting XSS vulnerability was identified in the adicionaralergia.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in...

CVE-2025-23034 Cross-Site Scripting (XSS) Reflected endpoint 'tags.php' parameter 'msg_e' in WeGIA

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting XSS vulnerability was identified in the tags.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the msge...

CVE-2025-23026 HTML templates containing Javascript template strings are subject to XSS in jte

jte Java Template Engine is a secure and lightweight template engine for Java and Kotlin. In affected versions Jte HTML templates with script tags or script attributes that include a Javascript template string backticks are subject to XSS. The javaScriptBlock and javaScriptAttribute methods in th...

PT-2025-4778 · Wegia · Wegia

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.2.6 Description: A Stored Cross-Site Scripting XSS vulnerability was identified in the adicionar escala.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into the...

PT-2025-1465 · Selesta · Selesta Visual Access Manager

Name of the Vulnerable Software and Affected Versions: Selesta Visual Access Manager VAM versions prior to 4.42.2 Description: An issue was discovered in Selesta Visual Access Manager VAM where an authenticated attacker can perform SQL Injection in multiple POST parameters of the "/vam/vam ep.php...

PT-2025-3196 · Unknown +1 · Notation-Go +1

Name of the Vulnerable Software and Affected Versions: notation-go versions prior to 1.3.0-rc.2 Description: The issue arises from the failure to verify the revocation status of the certificates used to generate the timestamp signature during timestamp signature generation. This oversight creates...

PT-2025-4835 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.74 Description: The issue concerns bugs and vulnerabilities in the Linux kernel. The estimated number of potentially affected devices and details about real-world incidents are not specified. Technical detai...

PT-2025-3861 · Guangzhou Huayi Intelligent Technology · Jeewms

Name of the Vulnerable Software and Affected Versions: Guangzhou Huayi Intelligent Technology Jeewms versions up to 20241229 Description: A critical issue was found in the software, affecting the file /wmOmNoticeHController.do, which allows for path traversal using '../filedir'. This can be...

Race Condition

Overview pgadmin4 is a PostgreSQL Tools Affected versions of this package are vulnerable to Race Condition during the LDAP authentication process. An attacker can hijack another user's session by initiating multiple simultaneous login attempts. Remediation Upgrade pgadmin4 to version 7.0 or highe...

CVE-2024-45033 Apache Airflow Fab Provider: Application does not invalidate session after password change via Airflow cli

Insufficient Session Expiration vulnerability in Apache Airflow Fab Provider. This issue affects Apache Airflow Fab Provider: before 1.5.2. When user password has been changed with admin CLI, the sessions for that user have not been cleared, leading to insufficient session expiration, thus logged...

PT-2025-1065 · Dell · Dell Vxrail

Name of the Vulnerable Software and Affected Versions: Dell VxRail versions 8.0.000 through 8.0.311 Description: The issue is related to the storage of critical information in plaintext, which could allow an attacker to expose protected information. A high-privileged attacker with local access...

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Overview Affected versions of this package are vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator PRNG via the generateNonce function due to the insecure nonce generation process. An attacker can exploit this vulnerability to perform replay attacks when TLS is not used by...

AZL-55063 CVE-2025-21614 affecting package packer for versions less than 1.9.5-5

go-git is a highly extensible git implementation library written in pure Go. A denial of service DoS vulnerability was discovered in go-git versions prior to v5.13. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git serve...

PT-2025-1899 · Microsoft · Dynamics 365 Integration Plugin For Wordpress

Name of the Vulnerable Software and Affected Versions: Dynamics 365 Integration plugin for WordPress version 1.3.23 and earlier Description: The issue is related to Remote Code Execution and Arbitrary File Read due to missing input validation and sanitization on the render function, allowing...