PT-2025-15306 · Renrenio · Renren-Security

Name of the Vulnerable Software and Affected Versions: renrenio renren-security versions up to 5.4.0 Description: A vulnerability has been found in renrenio renren-security, affecting an unknown part of the JSON Handler component. The manipulation leads to cross-site scripting attacks, which can ...

PT-2025-15294

Name of the Vulnerable Software and Affected Versions Apollo Gateway versions prior to 2.10.1 Description The issue concerns a vulnerability that allows queries with deeply nested and reused named fragments to be prohibitively expensive to query plan, specifically during named fragment expansion...

PT-2025-15290

Name of the Vulnerable Software and Affected Versions libvips versions prior to 8.16.1 Description The issue arises from the heifsave operation in libvips, which can incorrectly determine the presence of an alpha channel in a "multiband" input. This can occur with a well-crafted TIFF image, leadi...

PT-2025-15293 · Unknown · Apollo-Compiler

Name of the Vulnerable Software and Affected Versions: apollo-compiler versions prior to 1.27.0 Description: The issue concerns a query-based compiler for the GraphQL query language. Prior to version 1.27.0, a vulnerability allowed queries with deeply nested and reused named fragments to be...

PT-2025-15241 · Unknown · Estree-Util-Value-To-Estree

Name of the Vulnerable Software and Affected Versions: estree-util-value-to-estree versions prior to 3.3.3 Description: The issue arises when estree-util-value-to-estree converts a JavaScript value to an ESTree expression. Specifically, when generating an ESTree from a value with a property named...

PT-2025-15298 · Unknown · Apollo Router Core

Name of the Vulnerable Software and Affected Versions: Apollo Router Core versions prior to 1.61.2 Apollo Router Core versions prior to 2.1.1 Description: The issue concerns a vulnerability in the Apollo Router Core that allows queries with deeply nested and reused named fragments to be...

PT-2025-15888 · Dell · Dell Powerscale Onefs

Name of the Vulnerable Software and Affected Versions: Dell PowerScale OneFS versions 9.4.0.0 through 9.10.0.0 Description: The issue concerns an exposure of information through directory listing, which could be exploited by a low privileged attacker with local access, potentially leading to...

CVE-2025-31480

aiven-extras is a PostgreSQL extension. This is a privilege escalation vulnerability, allowing elevation to superuser inside PostgreSQL databases that use the aiven-extras package. The vulnerability leverages the format function not being schema-prefixed. Affected users should install 1.1.16 and...

PT-2025-15122

Name of the Vulnerable Software and Affected Versions mod auth openidc versions prior to 2.4.16.11 Description A bug in mod auth openidc results in disclosure of protected content to unauthenticated users. The conditions for disclosure include an OIDCProviderAuthRequestMethod POST, a valid accoun...

PT-2025-15082 · Unknown · Chainmaker

Name of the Vulnerable Software and Affected Versions: ChainMaker versions prior to 2.4.0 Description: The issue arises from concurrent writes to a map by logger.go when a node's configuration file is frequently updated and the node is restarted. This can lead to a read-write conflict, resulting ...

PT-2025-15070 · Zammad · Zammad

Name of the Vulnerable Software and Affected Versions: Zammad versions 6.4.0 through 6.4.1 Description: The issue allows an authenticated agent with knowledge base permissions to use the Zammad API to fetch knowledge base content that they have no permission for. Recommendations: For versions 6.4...

PT-2025-29223

Name of the Vulnerable Software and Affected Versions: Hugging Face Transformers versions 4.50.3 and earlier Hugging Face Transformers version 4.52.1 Description: A Regular Expression Denial of Service ReDoS vulnerability exists in the Hugging Face Transformers library, specifically within the...

CVE-2025-31480 aiven-extras allows PostgreSQL Privilege Escalation through format function

aiven-extras is a PostgreSQL extension. This is a privilege escalation vulnerability, allowing elevation to superuser inside PostgreSQL databases that use the aiven-extras package. The vulnerability leverages the format function not being schema-prefixed. Affected users should install 1.1.16 and...

CVE-2025-27520 BentoML Allows Remote Code Execution (RCE) via Insecure Deserialization

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. A Remote Code Execution RCE vulnerability caused by insecure deserialization has been identified in the latest version v1.4.2 of BentoML. It allows any unauthenticated user to execute...

Security update for google-guest-agent

This update for google-guest-agent fixes the following issues: CVE-2024-45337: golang.org/x/crypto/ssh: Fixed misuse of ServerConfig.PublicKeyCallback leading to authorization bypass bsc1234563. Other fixes: - Updated to version 20250327.01 bsc1239763, bsc1239866 Remove error messages from...

Security update for go1.23

This update for go1.23 fixes the following issues: Update to go1.23.8 CVE-2025-22871: Fix an issue with request smuggling through invalid chunked data. bsc1240550 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

PT-2025-14984 · Woocommerce · Ni Woocommerce Cost Of Goods

Name of the Vulnerable Software and Affected Versions: Anzar Ahmed Ni WooCommerce Cost Of Goods versions 3.2.8 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for Stored XSS attacks. This means that an attacker can inject...

PT-2025-14895 · Unknown · Shiptrack Booking Calendar/Notification

Name of the Vulnerable Software and Affected Versions: shiptrack Booking Calendar and Notification versions n/a through 4.0.3 Description: The issue is related to an SQL Injection vulnerability, specifically a Blind SQL Injection, due to the improper neutralization of special elements used in an...

PT-2025-14853 · M Files · M-Files Server Admin Tool

Name of the Vulnerable Software and Affected Versions: M-Files Server Admin tool versions prior to 25.3.14681.7 Description: The issue concerns a stored XSS in the desktop UI of the M-Files Server Admin tool. This allows authenticated local users to execute scripts through the UI. Recommendations...

PT-2025-14957 · Unknown · Tockify Events Calendar

Name of the Vulnerable Software and Affected Versions: Tockify Events Calendar versions through 2.2.13 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows DOM-Based XSS. This means that an attacker coul...