TencentOS Server 4: python-authlib (TSSA-2024:1134)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2024:1134 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

Fedora 42 : ntpd-rs (2025-c480cf7e5e)

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-c480cf7e5e advisory. Update to version 1.5.0 for now, without PPS feature enabled due to potential correctness issues in the code. Release notes:...

PT-2025-25474 · WordPress · Click To Chat

Name of the Vulnerable Software and Affected Versions: Click to Chat plugin for WordPress versions up to, and including, 4.22 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows authenticated attackers with...

PT-2025-25485 · WordPress · Yith Woocommerce Wishlist

Name of the Vulnerable Software and Affected Versions: YITH WooCommerce Wishlist plugin for WordPress versions up to, and including, 4.5.0 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows authenticated attacke...

PT-2025-25478 · WordPress · Kk Youtube Video

Name of the Vulnerable Software and Affected Versions: kk Youtube Video plugin for WordPress versions up to, and including, 0.2 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'kkytv' shortcode due to insufficient input sanitization and output escaping on...

CVE-2025-49596

The MCP inspector is a developer tool for testing and debugging MCP servers. Versions of MCP Inspector below 0.14.1 are vulnerable to remote code execution due to lack of authentication between the Inspector client and proxy, allowing unauthenticated requests to launch MCP commands over stdio...

CVE-2025-49596

Summary: CVE-2025-49596 affects MCP Inspector deployments prior to 0.14.1. An unauthenticated bridge between the Inspector client and proxy allows remote code execution by sending MCP commands via stdio. This can enable arbitrary command execution with high impact (confidentiality, integrity, and...

Security Bulletin: A vulnerability in Babel affects IBM Robotic Process Automation and could result in inefficient regular expression complexity (CVE-2025-27789).

Summary A vulnerability in Babel affects IBM Robotic Process Automation and could result in inefficient regular expression complexity CVE-2025-27789. Babel is used by IBM Robotic Process Automation as part of it's UI framework. This security bulletin identifies the fixes required to resolve the...

PT-2025-25399 · WordPress · Auto Attachments

Name of the Vulnerable Software and Affected Versions: Auto Attachments plugin for WordPress versions up to, and including, 1.8.5 Description: The issue is related to Stored Cross-Site Scripting via admin settings due to insufficient input sanitization and output escaping. This allows authenticat...

PT-2025-29127 · Advantech · Iview

Name of the Vulnerable Software and Affected Versions: Advantech iView versions prior to 5.7.05 build 7057 Description: A flaw exists that could allow a reflected cross-site scripting XSS attack. Exploitation of this issue may allow an attacker to execute unauthorized scripts in the user's browse...

PT-2025-25423 · Unknown · Cookies Consent Management

Name of the Vulnerable Software and Affected Versions: COOKiES Consent Management versions 0.0.0 through 1.2.14 Description: The issue affects the COOKiES Consent Management module, allowing for Cross-Site Scripting XSS due to improper neutralization of input during web page generation...

QNAP QTS Multiple OpenSSH Vulnerabilities (QSA-25-14)

QNAP QTS is prone to multiple vulnerabilities in OpenSSH. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:qnap:qts"; ifdescriptio...

CVE-2025-49143

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to v2.4.10 and v1.6.32 , files uploaded by users to Nautobot's MEDIAROOT directory, including DeviceType image attachments as well as images attached to a Location, Device, or Rack, are served to users via a URL endpoint...

CVE-2024-37396

A stored cross-site scripting XSS vulnerability in the Calendar function of REDCap 13.1.9 allows authenticated users to execute arbitrary web script or HTML by injecting a crafted payload into the 'Notes' field of a calendar event. This could lead to the execution of malicious scripts when the...

CVE-2024-37394

A stored cross-site scripting XSS vulnerability in the Project Dashboards of REDCap 13.1.9 allows authenticated users to execute arbitrary web script or HTML by injecting a crafted payload into the 'Dashboard title' and 'Dashboard content' text boxes. This can lead to the execution of malicious...

PT-2025-25350 · Aveva · Aveva Pi Connector For Cygnet

Name of the Vulnerable Software and Affected Versions: AVEVA PI Connector for CygNet versions 1.6.14 and prior Description: A cross-site scripting issue exists that could allow an administrator with local access to the connector admin portal to persist arbitrary JavaScript code, which will be...

PT-2025-25346 · Mediawiki · Mediawiki Citizen Skin

Name of the Vulnerable Software and Affected Versions: MediaWiki Citizen Skin versions prior to 3.3.1 Description: The issue concerns the Citizen MediaWiki skin, which allows extensions to be part of a cohesive experience. Specifically, the citizen-search-noresults-title and...

PT-2025-43168

Name of the Vulnerable Software and Affected Versions Themefic Hydra Booking versions through 1.1.9 Description A missing authorization issue exists in Themefic Hydra Booking, allowing exploitation due to incorrectly configured access control security levels. Recommendations Update Themefic Hydra...

PT-2025-25348 · Mediawiki +1 · Mediawiki +1

Name of the Vulnerable Software and Affected Versions: Citizen versions prior to 3.3.1 Description: The issue affects the Citizen MediaWiki skin, where system messages in menu headings using the Menu.mustache template are inserted as raw HTML. This allows users with the editinterface right to...

PT-2025-25343 · Vantage6 · Vantage6

Name of the Vulnerable Software and Affected Versions: vantage6 versions prior to 4.11.0 Description: The vantage6 server has a predictable JWT secret key generation issue. The auto-generated key is a UUID1, which is not cryptographically secure as it is predictable to some extent. This issue...