PT-2025-27147 · Unknown · Sfturing Hosp Order

Name of the Vulnerable Software and Affected Versions: sfturing hosp order versions up to 627f426331da8086ce8fff2017d65b1ddef384f8 Description: A critical issue was found in the getOfficeName function of the OfficeServiceImpl.java file, which is vulnerable to SQL injection through the manipulatio...

PT-2025-27165 · Wow Company · Hover Effects

Name of the Vulnerable Software and Affected Versions: Wow-Company Hover Effects versions n/a through 2.1.2 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...

PT-2025-27145 · Hikvision · Hikvision Ds-2Cd1321-I

Name of the Vulnerable Software and Affected Versions: Hikvision DS-2CD1321-I version 5.7.21 build 230819 Description: The issue allows attackers to cause a Denial of Service DoS via sending a crafted POST request to the endpoint "/ISAPI/Security/challenge". Recommendations: For Hikvision...

PT-2025-27063 · WordPress · A/B Testing For Wordpress

Name of the Vulnerable Software and Affected Versions: A/B Testing for WordPress plugin versions up to and including 1.18.2 Description: The issue is related to stored cross-site scripting due to insufficient input sanitization and output escaping on the id parameter in the...

PT-2025-27219 · Unknown · Pre-Publish Checklist

Name of the Vulnerable Software and Affected Versions: Pre-Publish Post Checklist versions 3.1 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For versions 3.1 a...

PT-2025-27270 · Marvell · Marvell Qconvergeconsole

Name of the Vulnerable Software and Affected Versions: Marvell QConvergeConsole affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole. The specific flaw exists within the implementation of th...

PT-2025-27172 · Virusdie · Virusdie

Name of the Vulnerable Software and Affected Versions: Virusdie versions 1.1.3 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. Recommendations: For Virusdie versions 1.1.3 and...

SUSE CVE-2025-52894

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. OpenBao before v2.3.0 allowed an attacker to perform unauthenticated, unaudited cancellation of root rekey and recovery rekey operations, effecting a denial of...

Missing Authentication for Critical Function

Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the rekey process. An attacker can disrupt critical security operations by sending unauthenticated requests to cancel root rekey and recovery rekey operations. This can result in denial o...

Missing Authentication for Critical Function

Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the rekey process. An attacker can disrupt critical security operations by sending unauthenticated requests to cancel root rekey and recovery rekey operations. This can result in denial o...

OpenBao allows cancellation of root rekey and recovery rekey operations without authentication

Impact OpenBao and HashiCorp Vault allowed an attacker to perform unauthenticated, unaudited cancellation of root rekey and recovery rekey operations, effecting a denial of service. Patches In OpenBao v2.2.2 and later, manually setting the configuration option disableunauthedrekeyendpoints=true...

CVE-2025-53013

Summary (CVE-2025-53013, Himmelblau) : Versions 0.9.10–0.9.16 allow offline authentication to a Linux host via Himmelblau using an invalid Linux Hello PIN. The root cause is an incorrect handling in acquire_token_by_hello_for_business_key: offline, a TPMFail is expected for an invalid key, but a ...

CVE-2025-53013 Himmelblau offline auth permits authentication with invalid Hello PIN

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. A vulnerability present in versions 0.9.10 through 0.9.16 allows a user to authenticate to a Linux host via Himmelblau using an invalid Linux Hello PIN, provided the host is offline. While the user gains access to th...

Critical RCE Flaws in Cisco ISE and ISE-PIC Allow Unauthenticated Attackers to Gain Root Access

Cisco has released updates to address two maximum-severity security flaws in Identity Services Engine ISE and ISE Passive Identity Connector ISE-PIC that could permit an unauthenticated attacker to execute arbitrary commands as the root user. The vulnerabilities, assigned the CVE identifiers...

PT-2025-26975 · Unknown · Netbox Community

Name of the Vulnerable Software and Affected Versions: Netbox Community versions 4.1.7 through 4.2.1 Description: The issue is related to Cross Site Scripting XSS via the RSS feed widget. This allows for potential malicious script execution. Recommendations: For Netbox Community version 4.1.7,...

PT-2025-27634 · Dataease · Dataease

Name of the Vulnerable Software and Affected Versions: DataEase versions prior to 2.10.11 Description: DataEase is an open source business intelligence and data visualization tool. The issue lies in parameters like sslfactory and sslfactoryarg, which have similar functionality to socketfactory an...

PT-2025-27005

Name of the Vulnerable Software and Affected Versions: Himmelblau versions 0.9.10 through 0.9.16 Description: A vulnerability in Himmelblau allows a user to authenticate to a Linux host using an invalid Linux Hello PIN when the host is offline. This issue arises from an incorrect assumption in th...

PT-2025-26985 · Unknown · Labredescefetrj Wegia

Name of the Vulnerable Software and Affected Versions: LabRedesCefetRJ WeGIA version 3.4.0 Description: A vulnerability was found in the file /html/matPat/adicionar tipoEntrada.php of the component Adicionar tipo. The manipulation of the argument Insira o novo tipo leads to cross site scripting...

PT-2025-26981 · Unknown · Labredescefetrj Wegia

Name of the Vulnerable Software and Affected Versions: LabRedesCefetRJ WeGIA version 3.4.0 Description: A vulnerability was found in the Cadastro de Atendio component, specifically in the file /html/atendido/Cadastro Atendido.php. The manipulation of the Nome/Sobrenome argument leads to cross-sit...

PT-2025-26988 · Unknown · Labredescefetrj Wegia

Name of the Vulnerable Software and Affected Versions: LabRedesCefetRJ WeGIA version 3.4.0 Description: A problematic vulnerability has been found in the Cadastro de Funcionário component, specifically affecting the /html/funcionario/cadastro funcionario.php file. The issue is related to the...