CVE-2025-64762 authkit-nextjs may let session cookies be cached in CDNs

The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS & AuthKit with Next.js. In authkit-nextjs version 2.11.0 and below, authenticated responses do not defensively apply anti-caching headers. In environments where CDN caching is enable...

CVE-2025-64762

Summary: The vulnerability CVE-2025-64762 affects the authkit-nextjs package (versions ≤ 2.11.0). Authenticated responses in these versions do not apply anti-caching headers, allowing session tokens to be cached by CDNs and potentially exposed to other users. The issue is resolved in 2.11.1, whic...

Grub2: use-after-free in net_set_vlan

...

PT-2025-47682

The Cryptocurrency Token, Launchpad Presale, ICO & IDO, Airdrop by TokenICO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'saveDeployedContract' function in all versions up to, and including, 2.4.6. This makes it possible for...

WordPress plugin WP AUDIO GALLERY has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerabili...

PT-2025-47808

Name of the Vulnerable Software and Affected Versions PJSIP versions prior to 2.16 Description PJSIP is a multimedia communication library. Versions before 2.16 may experience a memory overwrite issue when using the Opus audio codec in receiving direction. This occurs because Opus PLC may zero-fi...

CVE-2025-36158

IBM Concert 1.0.0 through 2.0.0 could allow a local user with specific permission to obtain sensitive information from files due to uncontrolled recursive directory copying...

EUVD-2025-198293

Stored cross site scripting xss vulnerability in SWISH prolog thru 2.2.0 allowing attackers to execute arbitrary code via crafted web IDE notebook...

CVE-2025-64524 CUPS rastertopclx Filter Vulnerable to Heap Buffer Overflow Leading to Potential Arbitrary Code Execution

cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. In versions 2.0.1 and prior, a heap-buffer-overflow vulnerability in the rastertopclx filter causes the program to crash with a segmentation fault...

CVE-2025-64428

Dataease is an open source data visualization analysis tool. Versions prior to 2.10.17 are vulnerable to JNDI injection. A blacklist was added in the patch for version 2.10.14. However, JNDI injection remains possible via the iiop, corbaname, and iiopname schemes. The vulnerability has been fixed...

Hush Framework security vulnerabilities

Hush Framework is a web application framework by the individual developer of james.huang. A security vulnerability exists in Hush Framework version 2.0, which stems from improperly neutralized HTTP host headers and could lead to remote attacks...

RaidenFTPD Server >= 2.4.4005 Insecure Permissions Vulnerability

RaidenFTPD Server allows a local attacker to gain privileges and execute arbitrary code via crafted executable running from the installation directory. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

PT-2025-47729

Name of the Vulnerable Software and Affected Versions FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution plugin for WordPress versions through 2.9.84 Description The FluentCRM plugin for WordPress is susceptible to Stored Cross-Site Scripti...

PT-2025-47707

Name of the Vulnerable Software and Affected Versions 简数采集器 plugin for WordPress versions through 2.6.3 Description The 简数采集器 plugin for WordPress is susceptible to an issue allowing unauthorized access to files. This affects authenticated attackers with Administrator-level access or higher. The...

CVE-2025-51662

A stored cross-site scripting XSS vulnerability is found in the text sharing feature of FileCodeBox version 2.2 and earlier. Insufficient input validation allows attackers to inject arbitrary JavaScript code into shared text "codeboxes". The xss payload is automatically executed in the browsers o...

CVE-2025-65103 OpenSTAManager has an authenticated SQL Injection vulnerability in API via 'display' parameter

OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to version 2.9.5, an authenticated SQL Injection vulnerability in the API allows any user, regardless of permission level, to execute arbitrary SQL queries. By manipulating the display parameter in ...

CVE-2025-34335

AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 expose an authenticated command injection vulnerability in the license activation workflow handled by AudioCodesfiles/ActivateLicense.php. When a license file is uploaded, the application derives a new...

CVE-2025-34329

AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 expose an unauthenticated backup upload endpoint at AudioCodesfiles/ajaxBackupUploadFile.php in the F2MAdmin web interface. The script derives a backup folder path from application configuration, creates t...

PT-2025-47460

Name of the Vulnerable Software and Affected Versions ITEL ISO FM SFN Adapter versions ISO2 2.0.0.0 and WebServer 2.0 Description The ITEL ISO FM SFN Adapter is susceptible to session hijacking because of inadequate session management on the /home.html endpoint. An attacker can gain access to an...

AudioCodes Fax Server security vulnerability

AudioCodes Fax Server is a fax server from AudioCodes Israel. A security vulnerability exists in AudioCodes Fax Server version 2.6.23 and earlier, which stems from command injection in the license activation workflow and could lead to arbitrary command execution...