jooby-pac4j: deserialization of untrusted data

Impact Versions after 2.x and before 3.x of io.jooby:jooby-pac4j can cause deserialization of untrusted data Patches - 2.17.0 2.x - 3.7.0 3.x Workarounds - Not using io.jooby:jooby-pac4j until it gets patches. - Check what values you put/save on session References Version 2.x:...

PT-2025-14442 · Cryptolib · Cryptolib

Name of the Vulnerable Software and Affected Versions: CryptoLib versions 1.3.3 and earlier Description: The issue concerns a heap buffer overflow vulnerability in the Crypto TC ApplySecurity function due to an incomplete validation check on the fl frame length field. This allows an attacker to...

PT-2025-14013 · Unknown · Oretnom23/Sourcecodester Apartment Visitor Management System

Name of the Vulnerable Software and Affected Versions: oretnom23/SourceCodester Apartment Visitor Management System version 1.0 Description: A critical vulnerability was found in the oretnom23/SourceCodester Apartment Visitor Management System. The issue affects an unknown function of the file...

PT-2025-14375 · Zabbix +3 · Zabbix +3

Name of the Vulnerable Software and Affected Versions: Zabbix affected versions not specified Description: A low privilege Zabbix user with API access can use a SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL commands via the groupBy parameter...

PT-2025-14211 · Unknown · Beee Acf City Selector

Name of the Vulnerable Software and Affected Versions: Beee ACF City Selector versions 1.16.0 and earlier Description: The issue allows exposure of sensitive system information to an unauthorized control sphere, enabling the retrieval of embedded sensitive data. Recommendations: For Beee ACF City...

PT-2025-14119 · Openemr · Openemr

Name of the Vulnerable Software and Affected Versions: OpenEMR versions prior to 7.0.3.1 Description: The Patient Image feature in OpenEMR is vulnerable to cross-site scripting attacks via the EXIF title in an image. Recommendations: For versions prior to 7.0.3.1, update to version 7.0.3.1 to...

Medium: containerd

Issue Overview: containerd is an open-source container runtime. A bug was found in containerd prior to versions 1.6.38, 1.7.27, and 2.0.4 where containers launched with a User set as a UID:GID larger than the maximum 32-bit signed integer can cause an overflow condition where the container...

AWS SAM CLI Path Traversal allows file copy to build container

Summary The AWS Serverless Application Model Command Line Interface AWS SAM CLI is an open-source CLI tool that helps Lambda developers to build and develop Lambda applications locally on their computers using Docker. When running the AWS SAM CLI build process with Docker and symlinks are include...

PT-2025-13959 · Code Projects · Code-Projects Payroll Management System

Name of the Vulnerable Software and Affected Versions: code-projects Payroll Management System version 1.0 Description: A critical issue affects the processing of the file /view account.php, where the manipulation of the salary rate argument leads to SQL injection. The attack can be initiated...

PT-2025-13799 · Unknown · Tuleap Enterprise Edition +1

Name of the Vulnerable Software and Affected Versions: Tuleap Community Edition versions prior to 16.5.99.1742812323 Tuleap Enterprise Edition versions prior to 16.5-6 and 16.4-10 Description: The issue allows an attacker to access release notes content or information via the FRS REST endpoints...

PT-2025-13774 · Pytorch +1 · Pytorch +1

Name of the Vulnerable Software and Affected Versions: PyTorch version 2.6.0 Description: A critical issue has been identified, affecting the torch.nn.utils.rnn.pad packed sequence function, which can lead to memory corruption. This issue requires local access to exploit. Recommendations: For...

PT-2025-13784

Name of the Vulnerable Software and Affected Versions PyTorch version 2.6.0 Description An issue exists in the torch.jit.script function that can lead to memory corruption. This flaw allows an attack to be launched on the local host. Recommendations At the moment, there is no information about a...

PT-2025-13795 · Digital China · Dcme-520

Name of the Vulnerable Software and Affected Versions: Digital China DCME-520 up to 20250320 Description: A critical issue has been found in the processing of the file /usr/local/WWW/function/audit/newstatistics/mon merge stat hist.php. The manipulation of the type name argument leads to os comma...

PT-2025-14876 · Tenda · Tenda Fh1202

Name of the Vulnerable Software and Affected Versions: Tenda FH1202 version 1.2.0.14408 Description: A critical issue affects the processing of the file /goform/wrlwpsset, leading to improper access controls. The attack may be initiated remotely. Recommendations: For Tenda FH1202 version...

PT-2025-13623

Name of the Vulnerable Software and Affected Versions PyTorch version 2.6.0+cu124 Description A problematic issue has been found, affecting the function torch.mkldnn max pool2d, which can lead to denial of service. The manipulation requires a local approach. Recommendations For PyTorch version...

PT-2025-13631 · Trendnet · Trendnet Tew-410Apb

Name of the Vulnerable Software and Affected Versions: TRENDnet TEW-410APB version 1.3.06b Description: A vulnerability was found in the HTTP Request Handler component, specifically affecting the function sub 4019A0 of the file /usr/sbin/httpd. This issue leads to a null pointer dereference. The...

CVE-2025-30211 KEX init error results with excessive memory usage

Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.1, 26.2.5.10, and 25.3.2.19, a maliciously formed KEX init message can result with high memory usage. Implementation does not verify RFC specified limits on algorithm names 64 characters provided in K...

CVE-2025-30211 KEX init error results with excessive memory usage

Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.1, 26.2.5.10, and 25.3.2.19, a maliciously formed KEX init message can result with high memory usage. Implementation does not verify RFC specified limits on algorithm names 64 characters provided in K...

CVE-2025-30371 Metabase vulnerable to circumvention of local link access protection in GeoJson endpoint

Metabase is a business intelligence and embedded analytics tool. Versions prior to v0.52.16.4, v1.52.16.4, v0.53.8, and v1.53.8 are vulnerable to circumvention of local link access protection in GeoJson endpoint. Self hosted Metabase instances that are using the GeoJson feature could be potential...

CVE-2025-30371 Metabase vulnerable to circumvention of local link access protection in GeoJson endpoint

Metabase is a business intelligence and embedded analytics tool. Versions prior to v0.52.16.4, v1.52.16.4, v0.53.8, and v1.53.8 are vulnerable to circumvention of local link access protection in GeoJson endpoint. Self hosted Metabase instances that are using the GeoJson feature could be potential...