PT-2025-29756 · WordPress · Blockswp Theme Builder For Elementor

Name of the Vulnerable Software and Affected Versions: BlocksWP Theme Builder For Elementor versions through 1.2.3 Description: The BlocksWP Theme Builder For Elementor software contains a Cross-Site Request Forgery CSRF issue. This allows for the execution of unintended actions on behalf of an...

PT-2025-29794 · WordPress · Invico

Name of the Vulnerable Software and Affected Versions: designthemes Invico - WordPress Consulting Business Theme versions through 1.9 Description: The software contains a cross-site scripting issue due to improper neutralization of input during web page generation. This allows for reflected...

PT-2025-29758 · Unknown · Webba Booking

Name of the Vulnerable Software and Affected Versions: Webba Booking versions through 5.1.20 Description: A Cross-Site Request Forgery CSRF issue exists in Webba Booking. This allows attackers to potentially perform actions on behalf of authenticated users without their knowledge. Recommendations...

PT-2025-29729 · Elementor +1 · Elementor +1

Name of the Vulnerable Software and Affected Versions: hashthemes Easy Elementor Addons versions through 2.2.5 Description: The software contains a cross-site scripting issue due to improper neutralization of input during web page generation. This allows for stored cross-site scripting attacks...

PT-2025-29733 · Crocoblock · Jettabs

Name of the Vulnerable Software and Affected Versions: Crocoblock JetTabs versions through 2.2.9 Description: Crocoblock JetTabs is susceptible to a cross-site scripting XSS issue due to improper neutralization of input during web page generation. This allows for stored XSS attacks...

PT-2025-29818 · Unknown · Pakkemx Pakke Envíos

Name of the Vulnerable Software and Affected Versions: pakkemx Pakke Envíos versions through 1.0.2 Description: The software contains a SQL Injection issue due to improper neutralization of special elements used in an SQL command. This allows for potential SQL Injection attacks. Recommendations:...

PT-2025-29799 · Unknown · Infility Global

Name of the Vulnerable Software and Affected Versions: Infility Global versions through 2.13.4 Description: Infility Global is susceptible to a Reflected Cross-Site Scripting XSS issue due to improper neutralization of input during web page generation. Recommendations: Update Infility Global to a...

CVE-2024-11584 affecting package cloud-init for versions less than 24.3.1-2

CVE-2024-11584 affecting package cloud-init for versions less than 24.3.1-2. A patched version of the package is available...

RHSA-2025:10925 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.23 Security update

Bulletin has no description...

PT-2025-29531 · Unknown · Time-Line-

Name of the Vulnerable Software and Affected Versions: TIME LINE versions prior to 1.0.5 Description: The TIME LINE website has a flaw where uploaded files instruction/message media lack strict validation for type and size. This allows a user to upload renamed or oversized files, potentially...

go-toolset:ol8 security update

delve 1.24.1-1.0.1 - Disable DWARF compression which has issues Alex Burmashev golang 1.24.4-1 - Update to Go 1.24.4 fips-1 - Resolves: RHEL-85264 go-toolset 1.24.4-1 - Update to Go 1.24.4 fips-1 - Resolves: RHEL-85264...

PT-2025-29580

Name of the Vulnerable Software and Affected Versions JetBrains YouTrack versions prior to 2025.2.86069 JetBrains YouTrack versions prior to 2024.3.85077 JetBrains YouTrack versions prior to 2025.1.86199 Description An issue exists in JetBrains YouTrack that allows for email spoofing through an...

PT-2025-29574 · Dassault Systèmes · Solidworks Desktop +1

Name of the Vulnerable Software and Affected Versions: SOLIDWORKS eDrawings versions prior to SOLIDWORKS Desktop 2025 Description: A use-after-free issue exists in the IPT file reading procedure. This could allow an attacker to execute arbitrary code when opening a specially crafted IPT file...

PT-2025-29546 · Matomo · Matomo

Name of the Vulnerable Software and Affected Versions: Matomo versions prior to 3.0.3 Description: An authenticated remote code execution issue exists in Matomo due to the plugin upload mechanism. An authenticated user with Superuser privileges can upload and activate a malicious plugin ZIP...

PT-2025-29539 · WordPress · Strong Testimonials

Name of the Vulnerable Software and Affected Versions: Strong Testimonials versions prior to 3.2.12 Description: The Strong Testimonials plugin for WordPress is susceptible to Stored Cross-Site Scripting via the Testimonial Custom Fields due to insufficient input sanitization and output escaping...

CVE-2025-53885 Directus doesn't redact sensitive user data when logging via event hooks

Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0 and prior to version 11.9.0, when using Directus Flows to handle CRUD events for users it is possible to log the incoming data to console using the "Log to Console" operation and a template...

CVE-2025-53836 XWiki Rendering is vulnerable to RCE attacks when processing nested macros

XWiki Rendering is a generic rendering system that converts textual input in a given syntax wiki syntax, HTML, etc into another syntax XHTML, etc. Starting in version 4.2-milestone-1 and prior to versions 13.10.11, 14.4.7, and 14.10, the default macro content parser doesn't preserve the restricte...

CVE-2025-53820

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting XSS vulnerability was identified in the index.php endpoint of the WeGIA application prior to version 3.4.5. This vulnerability allows attackers to inject...

CVE-2025-53015

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0, infinite lines occur when writing during a specific XMP file conversion command. Version 7.1.2-0 fixes the issue...

Indico vulnerability allows attackers to bulk dump user details

Impact An endpoint used to display details of users listed in certain fields such as ACLs could be misused to dump basic user details such as name, affiliation and email in bulk. !TIP If your instance allows everyone to create a user account, and you wish to truly restrict access to these user...