PT-2025-21352 · Automattic · Automattic Tours

Name of the Vulnerable Software and Affected Versions: Automattic Tours versions n/a through 1.0.0 Description: The issue is related to a Missing Authorization vulnerability. This means that there is a lack of proper authorization checks, potentially allowing unauthorized access to certain featur...

PT-2025-21548 · WordPress · Ekc Tournament Manager

Name of the Vulnerable Software and Affected Versions: EKC Tournament Manager WordPress plugin versions prior to 2.2.2 Description: The issue is related to the lack of a CSRF check when updating settings in the EKC Tournament Manager WordPress plugin. This could allow attackers to make a logged-i...

PT-2025-21538 · WordPress · Maspik

Name of the Vulnerable Software and Affected Versions: Maspik WordPress plugin versions prior to 2.1.3 Description: The issue concerns the Maspik WordPress plugin, where certain settings are not properly sanitized and escaped. This could allow high-privilege users, such as administrators, to...

PT-2025-21442 · WordPress · Buddyboss Platform

Name of the Vulnerable Software and Affected Versions: buddyboss-platform versions prior to 2.7.60 Description: The issue is related to improper access controls in the buddyboss-platform WordPress plugin, allowing a logged-in user to view comments on private posts. Recommendations: For versions...

PT-2025-21439 · WordPress · Mobile Contact Bar

Name of the Vulnerable Software and Affected Versions: Mobile Contact Bar WordPress plugin versions prior to 3.0.5 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This is possible because some settings are not properly sanitised...

PT-2025-21452 · WordPress · Aweber Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: AWeber WordPress plugin versions 7.3.20 and earlier Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capability is disallowed, for...

PT-2025-21393 · WordPress · Happyforms

Name of the Vulnerable Software and Affected Versions: Happyforms versions prior to 1.26.3 Description: The issue concerns the Happyforms plugin for WordPress, where certain settings are not properly sanitized and escaped. This could allow high-privilege users, such as administrators, to perform...

PT-2025-21462 · WordPress · Memberspace

Name of the Vulnerable Software and Affected Versions: MemberSpace WordPress plugin versions prior to 2.1.14 Description: The issue arises from the plugin's failure to sanitise and escape a parameter before outputting it back in the page. This leads to a Reflected Cross-Site Scripting issue that...

PT-2025-21372

Name of the Vulnerable Software and Affected Versions: LogDash Activity Log WordPress plugin versions prior to 1.1.4 Description: The issue concerns a SQL injection vulnerability. It occurs because the plugin does not properly escape the username when performing SQL requests, specifically when...

RHEL 8 / 9 : updated discovery-cli RPMs (Important) (RHSA-2025:7630)

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:7630 advisory. New version of Discovery CLI dsc and installer are now available for RHEL 8 and RHEL 9 for Discovery 1.14. Tenable has extracted the preceding...

PT-2025-21562 · WordPress · Plugin Oficial Wordpress

Name of the Vulnerable Software and Affected Versions: Plugin Oficial WordPress plugin through 1.7.3 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This is possible because some settings are not properly sanitised and escaped, a...

WordPress SureTriggers Plugin < 1.0.83 Privilege Escalation Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:suretriggers:suretriggers"; if description...

Mozilla Thunderbird ESR Security Update (mfsa_2025-34) - Windows

Mozilla Thunderbird ESR is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

PT-2025-21440 · WordPress · Mailpoet

Name of the Vulnerable Software and Affected Versions: MailPoet WordPress plugin versions prior to 5.5.2 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capability is disallowed, for...

Security Bulletin: Vulnerability in Netty affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerability in Netty has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional information. Vulnerability...

CLSA-2025-1747251120 buildah: Fix of 2 CVEs

Rebuild with new golang version to address the following CVEs: - CVE-2023-45287: Timing Side Channel attack in RSA based TLS key exchanges - CVE-2024-34156: panic due to stack exhaustion for Decoder.Decode...

[SECURITY] [DLA 4165-1] open-vm-tools security update

Debian LTS Advisory DLA-4165-1 [email protected] https://www.debian.org/lts/security/ Jochen Sprickerhof May 14, 2025 https://wiki.debian.org/LTS Package : open-vm-tools Version : 2:11.2.5-2+deb11u4 CVE ID : CVE-2025-22247 Debian Bug : 1105159 open-vm-tools is a package that provides Op...

CVE-2025-47775 Bullfrog's DNS over TCP bypasses domain filtering

Bullfrog is a GithHb Action to block unauthorized outbound traffic in GitHub workflows. Prior to version 0.8.4, using tcp breaks blocking and allows DNS exfiltration. This can result in sandbox bypass. Version 0.8.4 fixes the issue...

CVE-2025-24026

iTop is an web based IT Service Management tool. Versions prior to 3.2.1 are vulnerable to regular expression denial of service ReDoS that may, under some circumstances, affect iTop server. Version 3.2.1 doesn't use the affected variable in the regular expression. As a workaround, if iTop...

CVE-2024-56157

iTop is an web based IT Service Management tool. Prior to versions 3.1.3 and 3.2.1, by filling malicious code in a CSV content, a cross-site scripting attack can be performed when importing this content. The issue is fixed in versions 3.1.3 and 3.2.1. As a workaround, check CSV content before...