PT-2025-25423 · Unknown · Cookies Consent Management

Name of the Vulnerable Software and Affected Versions: COOKiES Consent Management versions 0.0.0 through 1.2.14 Description: The issue affects the COOKiES Consent Management module, allowing for Cross-Site Scripting XSS due to improper neutralization of input during web page generation...

CVE-2025-49143

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to v2.4.10 and v1.6.32 , files uploaded by users to Nautobot's MEDIAROOT directory, including DeviceType image attachments as well as images attached to a Location, Device, or Rack, are served to users via a URL endpoint...

CVE-2024-37396

A stored cross-site scripting XSS vulnerability in the Calendar function of REDCap 13.1.9 allows authenticated users to execute arbitrary web script or HTML by injecting a crafted payload into the 'Notes' field of a calendar event. This could lead to the execution of malicious scripts when the...

CVE-2024-37394

A stored cross-site scripting XSS vulnerability in the Project Dashboards of REDCap 13.1.9 allows authenticated users to execute arbitrary web script or HTML by injecting a crafted payload into the 'Dashboard title' and 'Dashboard content' text boxes. This can lead to the execution of malicious...

PT-2025-25350 · Aveva · Aveva Pi Connector For Cygnet

Name of the Vulnerable Software and Affected Versions: AVEVA PI Connector for CygNet versions 1.6.14 and prior Description: A cross-site scripting issue exists that could allow an administrator with local access to the connector admin portal to persist arbitrary JavaScript code, which will be...

PT-2025-25343 · Vantage6 · Vantage6

Name of the Vulnerable Software and Affected Versions: vantage6 versions prior to 4.11.0 Description: The vantage6 server has a predictable JWT secret key generation issue. The auto-generated key is a UUID1, which is not cryptographically secure as it is predictable to some extent. This issue...

PT-2025-25348 · Mediawiki +1 · Mediawiki +1

Name of the Vulnerable Software and Affected Versions: Citizen versions prior to 3.3.1 Description: The issue affects the Citizen MediaWiki skin, where system messages in menu headings using the Menu.mustache template are inserted as raw HTML. This allows users with the editinterface right to...

PT-2025-25285 · WordPress · Wordpress Single Sign-On (Sso) Plugin

Name of the Vulnerable Software and Affected Versions: WordPress Single Sign-On SSO plugin for WordPress versions prior to 5.3 Description: The issue is related to a misconfigured capability check on a function, allowing unauthorized access. This enables unauthenticated attackers to extract...

Important: python-setuptools

Issue Overview: setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in PackageIndex is present in setuptools prior to version 78.1.1. An attacker would be allowed to write files to arbitrary locations on the...

PT-2025-25346 · Mediawiki · Mediawiki Citizen Skin

Name of the Vulnerable Software and Affected Versions: MediaWiki Citizen Skin versions prior to 3.3.1 Description: The issue concerns the Citizen MediaWiki skin, which allows extensions to be part of a cohesive experience. Specifically, the citizen-search-noresults-title and...

[SECURITY] [DLA 4214-1] node-tar-fs security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4214-1 [email protected] https://www.debian.org/lts/security/ Adrian Bunk June 11, 2025 https://wiki.debian.org/LTS -...

PT-2025-25291 · Gitlab · Gitlab Ce/Ee

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 17.9 through 17.10.6 GitLab CE/EE versions 17.11 through 17.11.2 GitLab CE/EE versions 18.0 through 18.0.0 Description: An issue has been discovered in GitLab CE/EE, allowing authenticated users to access arbitrary...

PT-2025-25222 · Drupal · Drupal Lightgallery

Name of the Vulnerable Software and Affected Versions: Drupal Lightgallery versions 0.0.0 through 1.6.0 Description: The issue affects Drupal Lightgallery, allowing Cross-Site Scripting XSS due to improper neutralization of input during web page generation. Recommendations: For versions 0.0.0...

PT-2025-25287 · Gitlab · Gitlab Ce/Ee

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 8.7 through 17.10.8 GitLab CE/EE versions 17.11 through 17.11.4 GitLab CE/EE versions 18.0 through 18.0.2 Description: An issue has been discovered in GitLab CE/EE affecting all versions from 8.7 before 17.10.8, 17.11...

PT-2025-25290 · Gitlab · Gitlab Ce/Ee

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 2.1.0 through 17.10.7 GitLab CE/EE versions 17.11 through 17.11.3 GitLab CE/EE versions 18.0 through 18.0.1 Description: An issue has been discovered in GitLab CE/EE, where a lack of input validation in HTTP responses...

PT-2025-25221 · Drupal · Drupal Commerce Alphabank Redirect

Name of the Vulnerable Software and Affected Versions: Drupal Commerce Alphabank Redirect versions 0.0.0 through 1.0.2 Description: The issue is related to an Incorrect Authorization vulnerability in Drupal Commerce Alphabank Redirect, allowing functionality misuse. Recommendations: For versions...

CVE-2024-37395

A stored cross-site scripting XSS vulnerability in the Public Survey function of REDCap 13.1.9 allows authenticated users to execute arbitrary web script or HTML by injecting a crafted payload into the 'Survey Title' and 'Survey Instructions' fields. This vulnerability could be exploited by...

CVE-2024-37394

A stored cross-site scripting XSS vulnerability in the Project Dashboards of REDCap 13.1.9 allows authenticated users to execute arbitrary web script or HTML by injecting a crafted payload into the 'Dashboard title' and 'Dashboard content' text boxes. This can lead to the execution of malicious...

CVE-2024-37394

A stored cross-site scripting XSS vulnerability in the Project Dashboards of REDCap 13.1.9 allows authenticated users to execute arbitrary web script or HTML by injecting a crafted payload into the 'Dashboard title' and 'Dashboard content' text boxes. This can lead to the execution of malicious...

PT-2025-26870 · Adobe · Commerce

Name of the Vulnerable Software and Affected Versions: Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier Description: The issue is related to an Incorrect Authorization vulnerability that could result in a Security feature bypass. A high-privileged attacker coul...