PT-2025-29574 · Dassault Systèmes · Solidworks Desktop +1

Name of the Vulnerable Software and Affected Versions: SOLIDWORKS eDrawings versions prior to SOLIDWORKS Desktop 2025 Description: A use-after-free issue exists in the IPT file reading procedure. This could allow an attacker to execute arbitrary code when opening a specially crafted IPT file...

PT-2025-29531 · Unknown · Time-Line-

Name of the Vulnerable Software and Affected Versions: TIME LINE versions prior to 1.0.5 Description: The TIME LINE website has a flaw where uploaded files instruction/message media lack strict validation for type and size. This allows a user to upload renamed or oversized files, potentially...

PT-2025-29546 · Matomo · Matomo

Name of the Vulnerable Software and Affected Versions: Matomo versions prior to 3.0.3 Description: An authenticated remote code execution issue exists in Matomo due to the plugin upload mechanism. An authenticated user with Superuser privileges can upload and activate a malicious plugin ZIP...

go-toolset:rhel8 security update

delve 1.24.1-1.0.1 - Disable DWARF compression which has issues Alex Burmashev golang 1.24.4-1 - Update to Go 1.24.4 fips-1 - Resolves: RHEL-85264 go-toolset 1.24.4-1 - Update to Go 1.24.4 fips-1 - Resolves: RHEL-85264...

PT-2025-29539 · WordPress · Strong Testimonials

Name of the Vulnerable Software and Affected Versions: Strong Testimonials versions prior to 3.2.12 Description: The Strong Testimonials plugin for WordPress is susceptible to Stored Cross-Site Scripting via the Testimonial Custom Fields due to insufficient input sanitization and output escaping...

PT-2025-29580 · Jetbrains · Jetbrains Youtrack

Name of the Vulnerable Software and Affected Versions: JetBrains YouTrack versions prior to 2025.2.86069 JetBrains YouTrack versions prior to 2024.3.85077 JetBrains YouTrack versions prior to 2025.1.86199 Description: An issue exists in JetBrains YouTrack that allows for email spoofing through an...

CVE-2025-53885 Directus doesn't redact sensitive user data when logging via event hooks

Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0 and prior to version 11.9.0, when using Directus Flows to handle CRUD events for users it is possible to log the incoming data to console using the "Log to Console" operation and a template...

CVE-2025-53836 XWiki Rendering is vulnerable to RCE attacks when processing nested macros

XWiki Rendering is a generic rendering system that converts textual input in a given syntax wiki syntax, HTML, etc into another syntax XHTML, etc. Starting in version 4.2-milestone-1 and prior to versions 13.10.11, 14.4.7, and 14.10, the default macro content parser doesn't preserve the restricte...

CVE-2025-53820

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting XSS vulnerability was identified in the index.php endpoint of the WeGIA application prior to version 3.4.5. This vulnerability allows attackers to inject...

CVE-2025-53015

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0, infinite lines occur when writing during a specific XMP file conversion command. Version 7.1.2-0 fixes the issue...

Indico vulnerability allows attackers to bulk dump user details

Impact An endpoint used to display details of users listed in certain fields such as ACLs could be misused to dump basic user details such as name, affiliation and email in bulk. !TIP If your instance allows everyone to create a user account, and you wish to truly restrict access to these user...

PT-2025-29509 · Unknown · Job Iteration Api

Name of the Vulnerable Software and Affected Versions: Job Iteration API versions prior to 1.11.0 Description: The Job Iteration API, an extension for ActiveJob, has an arbitrary code execution issue in the CsvEnumerator class. Exploitation of this issue can lead to unauthorized access, data...

PT-2025-29520 · Dokploy · Dokploy

Name of the Vulnerable Software and Affected Versions: Dokploy versions prior to 0.24.3 Description: Dokploy is a free, self-hostable Platform as a Service PaaS. A vulnerability in the preview deployment feature allows any user to execute arbitrary code and access sensitive environment variables ...

PT-2025-29518 · Wegia · Wegia

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.4.5 Description: WeGIA is an open source web manager designed for the Portuguese language and charitable institutions. A SQL Injection vulnerability exists that allows the execution of arbitrary SQL commands,...

PT-2025-29914 · Wegia · Wegia

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.4.5 Description: WeGIA is an open source web manager. A SQL Injection vulnerability exists due to manipulation of SQL queries through the id funcionario parameter of the /html/saude/profile paciente.php endpoint,...

PT-2025-29321 · WordPress · Modern Events Calendar Lite

Name of the Vulnerable Software and Affected Versions: Modern Events Calendar Lite plugin for WordPress versions prior to 6.4.0 Description: The Modern Events Calendar Lite plugin for WordPress is susceptible to SQL Injection via the id parameter of the /wp ajax mec load single page API endpoint...

PT-2025-29294 · WordPress · Wpbookit

Name of the Vulnerable Software and Affected Versions: WPBookit versions up to and including 1.0.4 Description: The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the image upload handle function, which is triggered via the '/add booki...

PT-2025-29296 · WordPress · The Nokri – Job Board Wordpress Theme

Name of the Vulnerable Software and Affected Versions: Nokri - Job Board WordPress Theme versions prior to 1.6.4 Description: The Nokri - Job Board WordPress Theme is susceptible to privilege escalation, potentially leading to account takeover. The issue stems from insufficient validation of a...

PT-2025-29292 · Ivanti · Ivanti Dsm

Name of the Vulnerable Software and Affected Versions: Ivanti DSM versions prior to 2024.2 Description: A hardcoded secret within the software allows an authenticated attacker on an adjacent network to decrypt sensitive data, including user credentials. Recommendations: Update Ivanti DSM to versi...

PT-2025-29515 · Wegia · Wegia

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.4.5 Description: WeGIA is an open source web manager designed for the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting XSS vulnerability exists in the index.php endpoint. Attackers ca...