PT-2025-15019 · Jobwp · Jobwp

Name of the Vulnerable Software and Affected Versions: JobWP versions 2.3.9 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions to be performed on behalf of a user. Recommendations: For versions 2.3.9 and earlier, update to a versio...

CVE-2025-31483

Miniflux is a feed reader. Due to a weak Content Security Policy on the /proxy/ route, an attacker can bypass the CSP of the media proxy and execute cross-site scripting when opening external images in a new tab/window. To mitigate the vulnerability, the CSP for the media proxy has been changed...

WordPress CM Header and Footer plugin <= 1.2.4 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin CM Header and Footer versions = 1.2.4...

PT-2025-14723 · Peprodev · Peprodev Cf7 Database

Name of the Vulnerable Software and Affected Versions: PeproDev CF7 Database versions through 2.0.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS, which allows Stored XSS. This means that an attacker can...

PT-2025-14796

Name of the Vulnerable Software and Affected Versions API Platform Core versions prior to 4.0.22 Description The issue concerns a caching problem in GraphQL grants on properties, which can lead to incorrect caching with different objects. The...

PT-2025-14868 · Gitoxide · Gitoxide

Name of the Vulnerable Software and Affected Versions: gitoxide versions prior to 0.42.0 Description: The issue arises from gitoxide's use of SHA-1 hash implementations without collision detection, making it vulnerable to hash collision attacks. This means two distinct Git objects with colliding...

PT-2025-14755 · Unknown · Social Share/Social Locker

Name of the Vulnerable Software and Affected Versions: Social Share And Social Locker versions 1.4.2 and earlier Description: The issue is related to improper neutralization of special elements used in SQL commands, allowing Blind SQL Injection. This can be exploited due to the improper handling ...

PT-2025-27665

Name of the Vulnerable Software and Affected Versions: llama index versions prior to 0.12.28 llama index version 0.12.28 Description: The JSONReader in the affected software is vulnerable to a stack overflow due to uncontrolled recursive JSON parsing. This allows attackers to trigger a Denial of...

PT-2025-14777 · Jetbrains · Intellij Idea

Name of the Vulnerable Software and Affected Versions: JetBrains IntelliJ IDEA versions prior to 2024.3 JetBrains IntelliJ IDEA version 2024.2.4 Description: The issue concerns the logging of source code in the idea.log file. Recommendations: For versions prior to 2024.3, update to version 2024.3...

PT-2025-14609 · Fancybox +1 · Fancybox +1

Name of the Vulnerable Software and Affected Versions: Modula Image Gallery plugin for WordPress versions prior to 5.0.36 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the bundled FancyBox JavaScript library. This allows...

PT-2025-14784 · Dowisp · Dowisp

Name of the Vulnerable Software and Affected Versions: DoWISP versions prior to 1.16.2.50 Description: The issue is related to a Stored Cross-Site Scripting XSS in DoWISP, where an attacker can upload a profile picture in SVG format containing malicious JavaScript code, leading to the execution o...

PT-2025-94: Local Privilege Escalation in Pritunl

The vulnerability was identified in Pritunl, version 1.3.4099.99. The discovered vulnerability allows an attacker to escalate privileges from a normal user to root. Vulnerability status: Confirmed by vendor Date of vulnerability remediation: 03.04.2025 Recommendations: Update to version 1.3.4220....

PT-2025-09: Path Traversal in TCPDF

The application performs insufficient validation of relative paths when processing SVG image. Bypassing validation using the payload allows an attacker to form a path to an arbitrary image on the server, access to which is not provided by the logic of the application, with subsequent inclusion of...

PT-2025-14711 · Unknown · Cm Header/Footer

Name of the Vulnerable Software and Affected Versions: CM Header and Footer versions 1.2.4 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can...

PT-2025-14741 · Frank P. Walentynowicz · Fpw Category Thumbnails

Name of the Vulnerable Software and Affected Versions: Frank P. Walentynowicz FPW Category Thumbnails versions 1.9.5 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploitation of incorrectly configured access control security levels...

PT-2025-14786

Name of the Vulnerable Software and Affected Versions Vite versions 6.0.0 through 6.0.13 Vite versions 6.1.0 through 6.1.3 Vite versions 6.2.0 through 6.2.4 Vite version 4.5.11 and earlier Vite version 5.4.16 and earlier Description The issue allows the contents of arbitrary files to be returned ...

canonical/get-workflow-version-action can leak a partial GITHUB_TOKEN in exception output

Impact Users using the github-token input are impacted. If the get-workflow-version-action step fails, the exception output may include the GITHUBTOKEN. If the full token is included in the exception output, GitHub will automatically redact the secret from the GitHub Actions logs. However, the...

CVE-2025-29908

Netty QUIC codec is a QUIC codec for netty which makes use of quiche. An issue was discovered in the codec. A hash collision vulnerability in the hash map used to manage connections allows remote attackers to cause a considerable CPU load on the server a Hash DoS attack by initiating connections...

CVE-2025-29766

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap has missing CSRF protections on artifact submission & edition from the tracker view. An attacker could use this vulnerability to trick victims into submitting or editing artifacts or follow-up...

Jenkins Cadence vManager Plugin Stores Verisium Manager vAPI keys Unencrypted

Jenkins Cadence vManager Plugin 4.0.0-282.v5096ac2db275 and earlier stores Verisium Manager vAPI keys unencrypted in job config.xml files on the Jenkins controller as part of its configuration. These API keys can be viewed by users with Item/Extended Read permission or access to the Jenkins...