PT-2025-19728

Name of the Vulnerable Software and Affected Versions Linkerd versions 2.16. through 2.16.4 Linkerd versions 2.17. through 2.17.1 Linkerd versions 2.18. no specific end version mentioned, but before 2.18.0 Buoyant Edge versions before edge-25.2.1 Description Resource exhaustion can occur for...

PT-2025-19771

Name of the Vulnerable Software and Affected Versions Misskey versions 12.31.0 through 2025.4.0 Description The issue is related to missing validation in Mk:api, which allows malicious AiScript code to access additional endpoints that it isn't designed to have access to. This is achieved by...

CVE-2024-11142

Cross-Site Request Forgery CSRF vulnerability in Gosoft Software Proticaret E-Commerce allows Cross Site Request Forgery. This issue affects Proticaret E-Commerce: before v6.0 NOTE: According to the vendor, fixing process is still ongoing for v4.05...

SUSE SLES15 / openSUSE 15 Security Update : govulncheck-vulndb (SUSE-SU-2025:1431-1)

The remote SUSE Linux SLES15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2025:1431-1 advisory. - Update to version 0.0.20250424T181457 jscPED-11136 GO-2025-3603 GO-2025-3604 GO-2025-3607 GO-2025-3608 GO-2025-3609 GO-2025-3610...

Hashicorp Vault Community vulnerable to Incorrect Authorization

Vault Community, Vault Enterprise “Vault” Azure Auth method did not correctly validate the claims in the Azure-issued token, resulting in the potential bypass of the boundlocations parameter on login. Fixed in Vault Community Edition 1.19.1 and Vault Enterprise 1.19.1, 1.18.7, 1.17.14, 1.16.18...

CVE-2025-2605

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Honeywell MB-Secure allows Privilege Abuse. This issue affects MB-Secure: from V11.04 before V12.53 and MB-Secure PRO from V01.06 before V03.09.Honeywell also recommends updating to the most...

CVE-2025-2605 Authenticated command injection

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Honeywell MB-Secure allows Privilege Abuse. This issue affects MB-Secure: from V11.04 before V12.53 and MB-Secure PRO from V01.06 before V03.09.Honeywell also recommends updating to the most...

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues: Update to version 0.0.20250424T181457 jscPED-11136 GO-2025-3603 GO-2025-3604 GO-2025-3607 GO-2025-3608 GO-2025-3609 GO-2025-3610 GO-2025-3611 GO-2025-3612 GO-2025-3615 GO-2025-3618 GO-2025-3619 GO-2025-3620 GO-2025-3621 GO-2025-3622...

CVE-2024-13860

The Buddyboss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘bbptopictitle’ parameter in all versions up to, and including, 2.8.50 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

PT-2025-18927 · Openvm · Openvm

Name of the Vulnerable Software and Affected Versions: OpenVM version 1.0.0 Description: The issue is related to an overflow vulnerability in the AUIPC instruction decomposition of the OpenVM framework. A typo in the code results in incorrect range checking of the highest limb of pc, leading to a...

PT-2025-18770 · Arm · Arm 5Th Gen Gpu Architecture Kernel Driver +2

Name of the Vulnerable Software and Affected Versions: Arm Ltd Bifrost GPU Kernel Driver versions r8p0 through r51p0 Arm Ltd Valhall GPU Kernel Driver versions r19p0 through r53p0 Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver versions r41p0 through r53p0 Description: The issue allows a local...

PT-2025-18771

Name of the Vulnerable Software and Affected Versions Yordam Informatics Library Automation System versions prior to 21.6 Description The issue affects the Library Automation System, allowing for Reflected XSS due to improper neutralization of input during web page generation. Recommendations For...

PT-2025-18923 · Unknown · Grokability Snipe-It

Name of the Vulnerable Software and Affected Versions: Grokability Snipe-IT versions prior to 8.1.0 Description: The issue concerns incorrect authorization for accessing asset information. Recommendations: For versions prior to 8.1.0, update to version 8.1.0 or later to resolve the issue...

SUSE: Security Advisory (SUSE-SU-2025:1419-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2025-46566

DataEase is an open-source BI tool alternative to Tableau. Prior to version 2.10.9, authenticated users can complete RCE through the backend JDBC link. This issue has been patched in version 2.10.9...

CVE-2025-46568

CVE-2025-46568 affects Stirling-PDF prior to version 0.45.0. The vulnerability arises from SSRF-induced arbitrary file read due to WeasyPrint redefining HTML tags (e.g., img, embed, object). References to internal files allow attaching content from any webpage or local file to a PDF, enabling an ...

@cloudflare/workers-oauth-provider missing validation of redirect_uri on authorize endpoint

Summary The OAuth implementation failed to check that redirecturi was among the allowed set for the clientid. Impact Under certain circumstances see below, if a victim had previously authorized with a server built on workers-oath-provider, and an attacker could later trick the victim into visitin...

PT-2025-18774 · Honeywell · Honeywell Mb-Secure +1

Name of the Vulnerable Software and Affected Versions: Honeywell MB-Secure versions V11.04 through V12.53 Honeywell MB-Secure PRO versions V01.06 through V03.09 Description: The issue is related to an OS Command Injection vulnerability, allowing privilege abuse due to improper neutralization of...

openSUSE 15 Security Update : libjxl (openSUSE-SU-2025:0139-1)

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2025:0139-1 advisory. - Update to release 0.8.4 Huffman lookup table size fix CVE-2024-11403 Check height limit in modular trees CVE-2024-11498 Tenable has extracted t...

PT-2025-18365 · WordPress · Wp Amaps

Name of the Vulnerable Software and Affected Versions: WP Maps versions prior to 4.7.2 Description: The WP Maps WordPress plugin does not sanitise and escape some of its Map settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the...