CVE-2024-50072 affecting package kernel for versions less than 6.6.64.2-1

CVE-2024-50072 affecting package kernel for versions less than 6.6.64.2-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-50232 affecting package kernel for versions less than 6.6.64.2-1

CVE-2024-50232 affecting package kernel for versions less than 6.6.64.2-1. An upgraded version of the package is available that resolves this issue...

PT-2025-1939 · WordPress · Infility Global Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Infility Global WordPress plugin versions 2.9.8 and earlier Description: The issue arises because the Infility Global WordPress plugin does not properly sanitise and escape a parameter before outputting it back in the page. This leads to a...

CVE-2025-22604

Cacti is an open source performance and fault management framework. Due to a flaw in multi-line SNMP result parser, authenticated users can inject malformed OIDs in the response. When processed by ssnetsnmpdiskio or ssnetsnmpdiskbytes, a part of each OID will be used as a key in an array that is...

PT-2025-5293

Name of the Vulnerable Software and Affected Versions macOS versions prior to 15.3 iPadOS versions prior to 17.7.4 macOS Sonoma versions prior to 14.7.3 macOS Sequoia versions prior to 15.3 Description The issue is a race condition within the kauth cred proc update function of the macOS and iPadO...

PT-2025-5390 · Seedprod · Seedprod Coming Soon Page

Name of the Vulnerable Software and Affected Versions: SeedProd Coming Soon Page, Under Construction & Maintenance Mode by SeedProd versions n/a through 6.18.9 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Cross Site Request Forgery. This problem affects th...

PT-2025-02: Access to files or directories to external paties in TCPDF

The vulnerability was identified in TCPDF, version 6.8.0. The discovered vulnerability allows an attacker to transmit a specially created HTML file containing an image in Base64 format. Using the specified payload, the attacker can access an arbitrary image outside of the directory. Vulnerability...

PT-2025-1313 · Cacti +1 · Cacti +1

Name of the Vulnerable Software and Affected Versions: Cacti versions prior to 1.2.29 Description: Cacti is an open source performance and fault management framework. It has a SQL injection vulnerability in the get discovery results function of automation devices.php using the network parameter...

PT-2025-1314 · Cacti +1 · Cacti +1

Name of the Vulnerable Software and Affected Versions: Cacti versions prior to 1.2.29 Description: Cacti is an open source performance and fault management framework. It has a SQL injection vulnerability in the template function of host templates.php using the graph template parameter. This issue...

PT-2025-1376

The libxml2 library, specifically versions up to 2.10.x, contains a use-after-free flaw in the xmlXIncludeAddNode function within the xinclude.c file. This flaw can potentially lead to remote code execution. The affected versions are all libxml2 versions before 2.11.0. An exploit for this issue i...

CVE-2025-22612

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.374, the missing authorization allows an authenticated user to retrieve any existing private keys on a coolify instance in plain text. If the server configuration of IP ...

CVE-2025-24025 Coolify Vulnerable to Reflected XSS on Tag Search

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.380, the tags page allows users to search for tags. If the search does not return any results, the query gets reflected on the error modal, which leads to cross-site...

CVE-2025-22610 Coolify Vulnerable to OAuth Secrets Leak

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.361, the missing authorization allows any authenticated user to fetch the global coolify instance OAuth configuration. This exposes the "client id" and "client secret" f...

CVE-2025-22607

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.361, the missing authorization allows any authenticated user to fetch the details page for any GitHub / GitLab configuration on a Coolify instance by only knowing the UU...

PT-2025-5412 · WordPress · Epsiloncool Wp Fast Total Search

Name of the Vulnerable Software and Affected Versions: Epsiloncool WP Fast Total Search versions 1.78.258 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. This can lead to...

PT-2025-5401 · Unknown · Subscription Dna

Name of the Vulnerable Software and Affected Versions: Subscription DNA versions n/a through 2.1 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability and Stored XSS in Subscription DNA. Recommendations: For versions n/a through 2.1, update to a version that include...

PT-2025-5345 · Hl7 · Hl7 Fhir Ig Publisher

Name of the Vulnerable Software and Affected Versions: HL7 FHIR IG publisher versions prior to 1.8.9 Description: The HL7 FHIR IG publisher has an issue where it exposes usernames and credentials in the built Implementation Guide when using git commands to determine the URL of the originating rep...

CVE-2025-24034 Himmelblau leaks credentials in the debug log

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Starting in version 0.7.0 and prior to versions 0.7.15 and 0.8.3, Himmelblau is vulnerable to leaking credentials in debug logs. When debug logging is enabled, user access tokens are inadvertently logged, potentially...

CVE-2025-24030

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. A user with access to the Kubernetes cluster can use a path traversal attack to execute Envoy Admin interface commands on proxies managed by any version of Envoy Gateway prior...

PT-2025-1591 · Uyumsoft · Uyumsoft Erp

Name of the Vulnerable Software and Affected Versions: Uyumsoft ERP versions prior to Erp4.2109.166p45 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for XSS using invalid characters and Reflect...