PT-2025-15872

Name of the Vulnerable Software and Affected Versions: Helm versions prior to 3.17.3 Description: A specially crafted chart archive file can cause Helm to exhaust its memory, leading to an out-of-memory termination. This occurs when the file expands to be significantly larger uncompressed than...

PT-2025-15706 · Dnn · Dnn

Name of the Vulnerable Software and Affected Versions: DNN formerly DotNetNuke versions prior to 9.13.8 Description: The issue concerns a possible denial of service that can be triggered by submitting specially crafted information in the public registration form. Recommendations: For versions pri...

PT-2025-15745 · Unknown · Script Compressor

Name of the Vulnerable Software and Affected Versions: Script Compressor versions 1.7.1 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS in the regen Script Compressor. Recommendations: For versions 1.7.1 and earlier, update to a version...

PT-2025-15979 · Gitlab · Gitlab Ce/Ee

Name of the Vulnerable Software and Affected Versions: GitLab EE versions 17.1 through 17.8.6 GitLab EE versions 17.9 through 17.9.5 GitLab EE versions 17.10 through 17.10.3 Description: An issue has been discovered in GitLab EE that allows attackers to perform targeted searches with sensitive...

CVE-2025-32035

DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem. Prior to 9.13.2, when uploading files e.g. when uploading assets, the file extension is checked to see if it's an allowed file type but the actual contents of the file aren't checked. This...

Shopware Broken ACL on Document retrieval to access other customers documents

Impact It's possible to guess the deepLinkCode of an Document to open documents of other customers Patches Update to Shopware 6.6.10.3 or 6.5.8.17 Workarounds For older versions of 6.4, corresponding security measures are also available via a plugin. For the full range of functions, we recommend...

CVE-2025-32025

bep/imagemeta is a Go library for reading EXIF, IPTC and XMP image meta data from JPEG, TIFF, PNG, and WebP files. The buffer created for parsing metadata for PNG and WebP images was only bounded by their input data type, which could lead to potentially large memory allocation, and unreasonably...

PT-2025-15597 · Otwthemes · Otwthemes Widgetize Pages Light

Name of the Vulnerable Software and Affected Versions: OTWthemes Widgetize Pages Light versions n/a through 3.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that an...

KLA82886 DoS vulnerability in Apache Tomcat

Out of bounds memory read vulnerability was found in Apache Tomcat. Malicious users can exploit this vulnerability to cause denial of service. Original advisories Denial of Service via invalid HTTP priority header Exploitation Public exploits exist for this vulnerability. Related products...

PT-2025-15621 · Adobe · Experience Manager Screens

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager Screens versions FP11.3 and earlier Description: The issue is a stored Cross-Site Scripting XSS vulnerability that could be exploited by a low-privileged attacker to inject malicious scripts into vulnerable form field...

PT-2025-15465 · Hax Cms · Hax Cms

Name of the Vulnerable Software and Affected Versions: HAX CMS PHP versions prior to 10.0.3 Description: The issue is related to the save function in HAXCMSFile.php, which allows for unrestricted file uploads due to a non-exhaustive denylist. This list only blocks files with .php, .sh, .js, and...

PT-2025-15445 · Unknown +1 · Crud-Query-Parser +1

Name of the Vulnerable Software and Affected Versions: crud-query-parser versions prior to 0.1.0 Description: The crud-query-parser library is affected by an issue where improper neutralization of the order/sort parameter in the TypeORM adapter allows SQL injection. This issue impacts users who a...

PT-2025-15469 · Joomla · Joomla!

Name of the Vulnerable Software and Affected Versions: Joomla versions up to 4.4.12 and 5.2.5 Description: The issue is related to insufficient state checks, which create a vector allowing attackers to bypass 2FA checks. This leads to improper authentication. Recommendations: For Joomla versions ...

PT-2025-15316 · WordPress · Streamit

Name of the Vulnerable Software and Affected Versions: Sreamit theme for WordPress versions prior to 4.0.2 Description: The issue is related to insufficient file validation in the st send download file function, allowing authenticated attackers with subscriber-level access or higher to download...

Windows App Client RCE Vulnerability (Apr 2025) - Windows

Windows App Client is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Siemens SIDIS Prime

SUMMARY SIDIS Prime before V4.0.700 is affected by multiple vulnerabilities in the components OpenSSL, SQLite, Boost C++ Libraries and several Microsoft components as described below. Siemens has released a new version of SIDIS Prime and recommends to update to the latest version. 2. GENERAL...

CVE-2025-32030

Apollo Gateway provides utilities for combining multiple GraphQL microservices into a single GraphQL endpoint. Prior to 2.10.1, a vulnerability in Apollo Gateway allowed queries with deeply nested and reused named fragments to be prohibitively expensive to query plan, specifically during named...

CVE-2025-32033

CVE-2025-32033 affects the Apollo Router Core. The root issue is that the operation limits plugin used unsigned 32-bit counters to track limits (e.g., query height). If a counter exceeded 4,294,967,295 it could wrap to 0, unintentionally bypassing configured thresholds. This vulnerability is expl...

estree-util-value-to-estree allows prototype pollution in generated ESTree

Impact When generating an ESTree from a value with a property named proto, valueToEstree would generate an object that specifies a prototype instead. Example: js import generate from 'astring' import valueToEstree from 'estree-util-value-to-estree' const estree = valueToEstree 'proto': const code...

SUSE-SU-2025:1153-1 Security update for go1.24

This update for go1.24 fixes the following issues: - Update to go1.24.2 - CVE-2025-22871: Fix an issue with request smuggling through invalid chunked data. bsc1240550...