CVE-2025-26311

Multiple memory leaks have been identified in the clip actions parsing functions parseSWFCLIPACTIONS and parseSWFCLIPACTIONRECORD in util/parser.c of libming v0.4.8, which allow attackers to cause a denial of service via a crafted SWF file...

CVE-2024-37361

The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid. CWE-502 Hitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.0 and 9.3.0.9, including 8.3.x, deserialize untrusted JSON data without constraining the parser to...

GHSA-C39W-3PJX-QC7M Leantime allows Stored Cross-Site Scripting (XSS)

Description Leantime allows stored cross-site scripting XSS in the API key name while generating the API key. Impact Any low privileged user like manager, or editor, can create an API key with XSS payload. When admin will visit the Company page, the XSS will automatically get triggerred leading t...

Leantime allows Stored Cross-Site Scripting (XSS)

Description Leantime allows stored cross-site scripting XSS in the API key name while generating the API key. Impact Any low privileged user like manager, or editor, can create an API key with XSS payload. When admin will visit the Company page, the XSS will automatically get triggerred leading t...

PT-2025-7575

Name of the Vulnerable Software and Affected Versions Wangmarket versions 4.10 through 5.0 Description The issue is related to a Cross-Site Request Forgery CSRF in the component /controller/UserController.java. This allows for unauthorized actions to be performed on behalf of a user...

PT-2025-7644 · Leantime · Leantime

Name of the Vulnerable Software and Affected Versions: Leantime affected versions not specified Description: The issue allows stored cross-site scripting XSS in the API key name while generating the API key. Any low-privileged user, such as a manager or editor, can create an API key with an XSS...

UBUNTU-CVE-2025-26311

Multiple memory leaks have been identified in the clip actions parsing functions parseSWFCLIPACTIONS and parseSWFCLIPACTIONRECORD in util/parser.c of libming v0.4.8, which allow attackers to cause a denial of service via a crafted SWF file...

CVE-2025-21105

Dell RecoverPoint for Virtual Machines 6.0.X contains a command execution vulnerability. A Low privileged malicious user with local access could potentially exploit this vulnerability by running the specific binary and perform any administrative action permitted by it resulting in shutting down t...

CVE-2024-37361

The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid. CWE-502 Hitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.0 and 9.3.0.9, including 8.3.x, deserialize untrusted JSON data without constraining the parser to...

PT-2025-7512

Name of the Vulnerable Software and Affected Versions mlflow/mlflow versions 2.17.0 through 2.20.1 Description A Cross-Site Request Forgery CSRF issue exists in the Signup feature. This allows an attacker to create a new account, which can be used to perform unauthorized actions on behalf of the...

WordPress Yoast SEO Plugin < 3.2.5 Information Disclosure Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:yoast:yoastseo"; if description...

CVE-2024-37361: Deserialization of Untrusted Data

The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid. CWE-502 Hitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.0 and 9.3.0.9, including 8.3.x, deserialize untrusted JSON data without constraining the parser to...

CVE-2024-37361 Hitachi Vantara Pentaho Business Analytics Server - Deserialization of Untrusted Data

The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid. CWE-502 Hitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.0 and 9.3.0.9, including 8.3.x, deserialize untrusted JSON data without constraining the parser to...

CVE-2024-37361

CVE-2024-37361 affects Hitachi Vantara Pentaho Business Analytics Server. The flaw is deserialization of untrusted JSON data caused by not constraining the parser to approved classes/methods, enabling potentially dangerous gadget chains during deserialization. Affected versions include before 10....

DRUPAL-CORE-2025-002

Bulk operations allow authorized users to modify several nodes at once from the Content page /admin/content. A site builder can also add bulk operations to other pages using Views. A bug in the core Actions system allows some users to modify some fields using bulk actions that they do not have...

Malware in web-actions-v4

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

PT-2025-7412 · Hitachi Vantara · Hitachi Vantara Pentaho Business Analytics Server

Name of the Vulnerable Software and Affected Versions: Hitachi Vantara Pentaho Business Analytics Server versions prior to 10.2.0.0 and 9.3.0.8, including 8.3.x Description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action. This...

Drupal core - Moderately critical - Access bypass - SA-CORE-2025-002

Bulk operations allow authorized users to modify several nodes at once from the Content page /admin/content. A site builder can also add bulk operations to other pages using Views. A bug in the core Actions system allows some users to modify some fields using bulk actions that they do not have...

PT-2025-6565 · WordPress · 1 Click Wordpress Migration Plugin

Name of the Vulnerable Software and Affected Versions: 1 Click WordPress Migration Plugin – 100% FREE for a limited time versions up to 2.1 Description: The issue is related to Cross-Site Request Forgery. This is due to missing or incorrect nonce validation on the cancel actions function. This...

PT-2025-6954

Name of the Vulnerable Software and Affected Versions: Smartarget versions prior to 1.4 Description: The issue is related to improper neutralization of input during web page generation, which allows stored Cross-site Scripting XSS. This enables attackers to inject malicious scripts into the...