PT-2025-31166 · WordPress · Elementor Website Builder

Name of the Vulnerable Software and Affected Versions: Elementor Website Builder – More Than Just a Page Builder plugin for WordPress versions prior to 3.30.3 Description: The Elementor Website Builder plugin for WordPress is susceptible to Stored Cross-Site Scripting via the data-text DOM elemen...

PT-2025-31335 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 15.6 Description: An injection issue was addressed with improved validation. An app may be able to access sensitive user data. Recommendations: Update to macOS version 15.6...

PT-2025-31316

Name of the Vulnerable Software and Affected Versions macOS versions prior to 15.6 Description A logic issue existed due to insufficient checks, potentially leading to incorrect association of a download’s origin. Recommendations Update to macOS version 15.6...

PT-2025-31259 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 3.4.7 on the stable branch Discourse versions prior to 3.5.0.beta.8 on the tests-passed branch Description: Discourse is an open-source community discussion platform. Upon issuing a physical security key for...

PT-2025-31201 · Progress · Hybrid Data Pipeline Server

Name of the Vulnerable Software and Affected Versions: Progress Software Hybrid Data Pipeline Server versions 4.6.2.3226 and below Description: The Hybrid Data Pipeline Server is susceptible to unauthorized access and impersonation. Attackers can combine credentials from multiple sources,...

PT-2025-31227 · Glpi +1 · Glpi +1

Name of the Vulnerable Software and Affected Versions: GLPI versions 9.5.0 through 10.0.18 Description: GLPI is an Asset and IT Management Software package. A technician can utilize a malicious payload to trigger a stored Cross-Site Scripting XSS issue on the project's kanban. Recommendations:...

PT-2025-31164 · WordPress · Elementor Website Builder

Name of the Vulnerable Software and Affected Versions: Elementor Website Builder – More Than Just a Page Builder plugin for WordPress versions prior to 3.29.1 Description: The Elementor Website Builder plugin for WordPress is susceptible to Stored Cross-Site Scripting via the elementor-element...

Opencast < 17.6 Information Disclosure Vulnerability (GHSA-j63h-hmgw-x4j7)

Opencast is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:opencast:opencast";...

CVE-2025-54423

CVE-2025-54423 affects the Copyparty portable file server. Versions up to and including 1.18.4 allow an unauthenticated attacker to execute arbitrary JavaScript in a victim’s browser due to improper sanitization of multimedia tags in music files (including m3u). This is a DOM-based XSS vulnerabil...

PT-2025-31128 · Jetbrains · Teamcity

Name of the Vulnerable Software and Affected Versions: JetBrains TeamCity versions prior to 2025.07 Description: A security issue was identified in JetBrains TeamCity where password exposure was possible via the command line during the "hg pull" command. Recommendations: Update JetBrains TeamCity...

PT-2025-31119 · Jetbrains · Teamcity

Name of the Vulnerable Software and Affected Versions: TeamCity versions prior to 2025.07 Description: A Cross-Site Request Forgery CSRF issue existed in the external OAuth login integration. Recommendations: Update TeamCity to version 2025.07 or later...

PT-2025-31118 · Jetbrains · Teamcity

Name of the Vulnerable Software and Affected Versions: TeamCity versions prior to 2025.07 Description: A Cross-Site Request Forgery CSRF issue existed in the GitHub App connection flow. Recommendations: Update to TeamCity version 2025.07 or later...

PT-2025-31109 · Gitlab · Gitlab Language Server

Name of the Vulnerable Software and Affected Versions: GitLab Language Server versions 7.6.0 through 7.29.0 Description: Insufficient input validation within GitLab Language Server allows arbitrary GraphQL query execution. Recommendations: Update to GitLab Language Server version 7.30.0 or later...

CVE-2025-54380 Opencast still publishes global system account credentials

Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to version 17.6, Opencast would incorrectly send the hashed global system account credentials ie: org.opencastproject.security.digest.user and org.opencastproject.security.digest.pass...

PT-2025-30965 · WordPress · Woodmart

Name of the Vulnerable Software and Affected Versions: WoodMart versions prior to 8.2.7 Description: The WoodMart theme for WordPress is susceptible to improper input validation. Insufficient validation of the qty parameter within the woodmart update cart item function allows unauthenticated...

PT-2025-30967 · WordPress · Educenter

Name of the Vulnerable Software and Affected Versions: Educenter theme for WordPress versions prior to 1.6.3 Description: The Educenter theme for WordPress is susceptible to Stored Cross-Site Scripting through the Circle Counter Block. Insufficient input sanitization and output escaping allows...

Fedora 41 : thunderbird (2025-a9d97ce15f)

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-a9d97ce15f advisory. Update to 128.13.0 https://www.thunderbird.net/en-US/thunderbird/128.13.0esr/releasenotes/...

Fedora 42 : thunderbird (2025-fd004806e3)

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-fd004806e3 advisory. Update to 128.13.0 https://www.thunderbird.net/en-US/thunderbird/128.13.0esr/releasenotes/...

PT-2025-30957 · WordPress · Melapress Login Security

Name of the Vulnerable Software and Affected Versions: Melapress Login Security versions 2.1.0 through 2.1.1 Description: The Melapress Login Security plugin for WordPress is susceptible to authentication bypass due to missing authorization within the get valid user based on token function. This...

PT-2025-30898 · Unknown · Simplehelp

Name of the Vulnerable Software and Affected Versions: Simplehelp versions prior to 5.5.12 Description: The software contains an inclusion of functionality from an untrusted control sphere issue. Recommendations: Update Simplehelp to version 5.5.12 or later...