CVE-2025-47943

CVE-2025-47943 affects Gogs (self-hosted Git service). The vulnerability is a stored XSS in the PDF rendering path, caused by an outdated pdfjs-1.4.20 component located under public/plugins/. Affected versions are 0.14.0+dev and prior. The issue has been fixed in gogs.io/gogs with version 0.13.3 ...

CVE-2025-52574

SysmonElixir is a system monitor HTTP service in Elixir. Prior to version 1.0.1, the /read endpoint reads any file from the server's /etc/passwd by default. In v1.0.1, a whitelist was added that limits reading to only files under priv/data. This issue has been patched in version 1.0.1...

OpenVPN Buffer Overflow Vulnerability (Jun 2025) - Windows

OpenVPN is prone to a buffer overflow vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:openvpn:openvpn";...

PT-2025-26731

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 140 Description: The exception page for the HTTPS-Only feature, displayed when a website is opened via HTTP, lacked an anti-clickjacking delay, potentially allowing an attacker to trick a user into granting an...

PT-2025-26773 · Control Id · Controlid Idsecure On-Premises

Name of the Vulnerable Software and Affected Versions: ControlID iDSecure On-premises versions 4.7.48.0 and prior Description: The issue is a Server-Side Request Forgery vulnerability that could allow an unauthenticated attacker to retrieve information from other servers. This vulnerability affec...

PT-2025-26725

Name of the Vulnerable Software and Affected Versions: Firefox for Android versions prior to 140 Description: The issue allows an attacker to potentially lead to phishing attacks by following a provided URL in a link querystring parameter instead of the correct URL. This affects Firefox for...

PT-2025-26728

Name of the Vulnerable Software and Affected Versions: Firefox for Android versions prior to 140 Description: The issue allows an attacker to bypass the default prompt that appears when a link can be opened in an external application, potentially exposing the user to security risks or privacy lea...

PT-2025-26733

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 140 Thunderbird versions prior to 140 Description: The issue is related to memory safety bugs that have been identified in Firefox and Thunderbird. These bugs have shown evidence of memory corruption, and it is...

PT-2025-26730

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 140 Description: The issue arises when a user visits a webpage with an invalid TLS certificate and grants an exception. In this scenario, the webpage can provide a WebAuthn challenge that the user is prompted to...

CVE-2025-52558

changedetection.io is a free open source web page change detection, website watcher, restock monitor and notification service. Prior to version 0.50.4, errors in filters from website page change detection watches were not being filtered resulting in a cross-site scripting XSS vulnerability. This...

CVE-2025-52561

The CVE-2025-52561 issue affects HTMLSanitizer.jl (a whitelist-based HTML sanitizer). Before version 0.2.1, adding the style element to the whitelist caused content inside the tag to be unescaped and closing tags injected as content to be interpreted as real HTML, enabling tag injection and JavaS...

CVE-2025-52561 HTMLSanitizer.jl Possible XSS

HTMLSanitizer.jl is a Whitelist-based HTML sanitizer. Prior to version 0.2.1, when adding the style tag to the whitelist, content inside the tag is incorrectly unescaped, and closing tags injected as content are interpreted as real HTML, enabling tag injection and JavaScript execution. This could...

CVE-2025-52558

Changedetection.io prior to version 0.50.4 is affected by a cross-site scripting (XSS) vulnerability caused by errors in filters during page-change detection watches. The issue can allow an attacker to inject malicious scripts into a user’s browser. The vulnerability has been patched in version 0...

CVE-2025-52558 ChangeDetection.io XSS in watch overview

changedetection.io is a free open source web page change detection, website watcher, restock monitor and notification service. Prior to version 0.50.4, errors in filters from website page change detection watches were not being filtered resulting in a cross-site scripting XSS vulnerability. This...

CVE-2025-2828 SSRF Vulnerability in RequestsToolkit in langchain-ai/langchain

A Server-Side Request Forgery SSRF vulnerability exists in the RequestsToolkit component of the langchain-community package specifically, langchaincommunity.agenttoolkits.openapi.toolkit.RequestsToolkit in langchain-ai/langchain version 0.0.27. This vulnerability occurs because the toolkit does n...

PT-2025-26643 · Langchain Ai · Langchain

Name of the Vulnerable Software and Affected Versions: langchain-ai/langchain version 0.0.27 Description: A Server-Side Request Forgery SSRF vulnerability exists in the RequestsToolkit component of the langchain-community package. This vulnerability occurs because the toolkit does not enforce...

PT-2025-26644

Name of the Vulnerable Software and Affected Versions: changedetection.io versions prior to 0.50.4 Description: The issue is related to a cross-site scripting XSS vulnerability due to errors in filters from website page change detection watches not being properly filtered. This vulnerability has...

PT-2025-26599 · Jetbrains · Teamcity

Name of the Vulnerable Software and Affected Versions: JetBrains TeamCity versions prior to 2025.03.3 Description: The issue is related to reflected XSS on the favoriteIcon page. Recommendations: For versions prior to 2025.03.3, update to version 2025.03.3 or later to resolve the issue...

PT-2025-26586

Name of the Vulnerable Software and Affected Versions sslh versions prior to 2.2.2 Description An improper link resolution issue, known as link following, exists in sslh, a protocol multiplexor used to share SSH and HTTPS on the same port. The software fails to properly handle symbolic links when...

Important: javapackages-bootstrap

Issue Overview: Improper Access Control vulnerability in Apache Commons. A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this protection was not...