PT-2025-18158

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 138 Thunderbird versions prior to 138 Description The issue arises from insufficient escaping of special characters in the "copy as cURL" feature. This could allow an attacker to trick a user into executing a command,...

GHSA-WMJQ-JRM2-9WFR NodeJS Driver for Snowflake has race condition when checking access to Easy Logging configuration file

Issue Snowflake discovered and remediated a vulnerability in the NodeJS Driver for Snowflake “Driver”. When using the Easy Logging feature on Linux and macOS the Driver didn’t correctly verify the permissions of the logging configuration file, potentially allowing an attacker with local access to...

GHSA-6JGM-J7H2-2FQG Go Snowflake Driver has race condition when checking access to Easy Logging configuration file

Issue Snowflake discovered and remediated a vulnerability in the Go Snowflake Driver “Driver”. When using the Easy Logging feature on Linux and macOS, the Driver didn’t correctly verify the permissions of the logging configuration file, potentially allowing an attacker with local access to...

Go Snowflake Driver has race condition when checking access to Easy Logging configuration file

Issue Snowflake discovered and remediated a vulnerability in the Go Snowflake Driver “Driver”. When using the Easy Logging feature on Linux and macOS, the Driver didn’t correctly verify the permissions of the logging configuration file, potentially allowing an attacker with local access to...

CVE-2025-31651

CVE-2025-31651 affects Apache Tomcat and allows bypass of rewrite rules for a subset of unlikely configurations. Affected branches include Tomcat 11.0.0-M1–11.0.5, 10.1.0-M1–10.1.39, and 9.0.0.M1–9.0.102; Debian and Amazon advisories confirm Tomcat9/10 updates addressing this issue. The connected...

CVE-2025-43854 DIFY vulnerable to Clickjacking Attack

DIFY is an open-source LLM app development platform. Prior to version 1.3.0, a clickjacking vulnerability was found in the default setup of the DIFY application, allowing malicious actors to trick users into clicking on elements of the web page without their knowledge or consent. This can lead to...

RUSTSEC-2025-0027 Panic in mp3-metadata due to the lack of bounds checking

The getid3 methods used by mp3metadata::readfromslice does not perform adequate bounds checking when recreating the tag due to the use of desynchronization. Fixed in Fix index error, released as part of 0.4.0...

PT-2025-18044 · WordPress · Wordpress Tag

Name of the Vulnerable Software and Affected Versions: The WordPress Tag, Category, and Taxonomy Manager versions prior to 3.30.0 Description: The issue concerns the WordPress Tag, Category, and Taxonomy Manager plugin, which does not properly sanitise and escape some of its Widgets settings. Thi...

PT-2025-18136 · N8N · N8N

Name of the Vulnerable Software and Affected Versions: n8n versions prior to 1.90.0 Description: The issue concerns stored Cross-Site Scripting XSS through the attachments view endpoint. n8n workflows can store and serve binary files, accessible to authenticated users. However, there is no...

PT-2025-18042 · WordPress · Admin/Site Enhancements (Ase) Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Admin and Site Enhancements ASE WordPress plugin versions prior to 7.6.10 Description: The issue concerns the use of a hardcoded password in the Password Protection feature of the Admin and Site Enhancements ASE WordPress plugin. This allows ...

PT-2025-18120 · Snowflake · Snowflake-Connector-Net

Name of the Vulnerable Software and Affected Versions: snowflake-connector-net versions 2.1.2 through 4.4.0 Description: The issue concerns a Time-of-Check to Time-of-Use TOCTOU race condition. When using the Easy Logging feature on Linux and macOS, the connector reads logging configuration from ...

PT-2025-18069 · Ipw Systems · Ipw Systems Metazo

Name of the Vulnerable Software and Affected Versions: IPW Systems Metazo versions 8.1.3 and earlier Description: The issue allows for unauthenticated Remote Code Execution because smartyValidator.php enables the attacker to provide template expressions, also known as Server-Side...

CVE-2025-43862

Dify is an open-source LLM app development platform. Prior to version 0.6.12, a normal user is able to access and modify APP orchestration, even though the web UI of APP orchestration is not presented for a normal user. This access control flaw allows non-admin users to make unauthorized access a...

PT-2025-17972 · Nasa · Nasa Cryptolib

Name of the Vulnerable Software and Affected Versions: NASA CryptoLib versions prior to 1.3.2 Description: The issue is related to the key state not being checked before use in NASA CryptoLib, potentially leading to spacecraft hijacking. Recommendations: For NASA CryptoLib versions prior to 1.3.2...

PT-2025-17962

Name of the Vulnerable Software and Affected Versions Formidable versions 2.1.0 through 3.x before 3.5.3 Description The issue relies on hexoid to prevent guessing of filenames for untrusted executable content. However, hexoid is documented as not cryptographically secure. There is a scenario in...

CVE-2025-30357

NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In version 2.1.4 and prior, if a malicious user is leaving spam comments on many topics then an administrator, unable to manually remove each spam comment, may delete the malicious account. Once an administrator...

CVE-2025-43862 Dify Allows Unauthorized Access and Modification of APP Orchestration

Dify is an open-source LLM app development platform. Prior to version 0.6.12, a normal user is able to access and modify APP orchestration, even though the web UI of APP orchestration is not presented for a normal user. This access control flaw allows non-admin users to make unauthorized access a...

CVE-2025-43862 Dify Allows Unauthorized Access and Modification of APP Orchestration

Dify is an open-source LLM app development platform. Prior to version 0.6.12, a normal user is able to access and modify APP orchestration, even though the web UI of APP orchestration is not presented for a normal user. This access control flaw allows non-admin users to make unauthorized access a...

Craft CMS Allows Remote Code Execution

Impact This is an additional fix for https://github.com/craftcms/cms/security/advisories/GHSA-4w8r-3xrw-v25g This is a high-impact, low-complexity attack vector. To mitigate the issue, users running Craft installations before the fixed versions are encouraged to update to at least that version...

PT-2025-10: Server-Side Request Forgery (SSRF) in HTML2PDF

The application performs insufficient validation of the destination address before sending an HTTP request. The vulnerability exploitation leads to the disclosure of sensitive data, denial of service, and etc. Vulnerability status: Confirmed by vendor Date of vulnerability remediation: 25.04.2025...