CVE-2025-30107

On IROAD V9 devices, Managing Settings and Obtaining Sensitive Data and Sabotaging the Car Battery can be performed by unauthorized parties. A vulnerability in the dashcam's configuration management allows unauthorized users to modify settings, disable critical functions, and turn off battery...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the concatenateForRewrite method in JettyUtils when the management proxy is enabled - which it is in the default configuration. An attacker can manipulate the URL to redirect requests to an arbitrary...

PT-2025-12172

Name of the Vulnerable Software and Affected Versions h2oai/h2o-3 version 3.46.0 Description The issue allows an attacker to encrypt any files on the target server with a key of their choosing through an endpoint exposing a custom EncryptionTool. This can result in ransomware-like behavior, makin...

PT-2025-12302 · Pandas +1 · Pandas +1

Name of the Vulnerable Software and Affected Versions: Dify Tools versions prior to the fixed version Description: A vulnerability in the Dify Tools' Vanna module of the langgenius/dify repository allows for a Pandas Query Injection in the latest version. The vulnerability occurs in the function...

PT-2025-12077

Name of the Vulnerable Software and Affected Versions lm-sys/fastchat versions 0.2.36 and earlier Description The server fails to handle excessive characters appended to the end of multipart boundaries. This flaw can be exploited by sending malformed multipart requests with arbitrary characters a...

PT-2025-12007 · WordPress · Meintopf

Name of the Vulnerable Software and Affected Versions: mEintopf WordPress plugin versions 0.2.1 and earlier Description: The mEintopf WordPress plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used...

PT-2025-12052

Name of the Vulnerable Software and Affected Versions: gaizhenbiao/chuanhuchatgpt version git d4ec6a3 Description: The issue is related to a local file inclusion vulnerability due to the use of the gradio component gr.JSON. This vulnerability allows unauthenticated users to access arbitrary files...

FlatPress 跨站请求伪造漏洞

FlatPress is a lightweight, easy to set up flat file blogging engine from the FlatPress open source. A cross-site request forgery vulnerability exists in FlatPress. An attacker exploiting this vulnerability can enable or disable plugins...

Unexpected Status Code or Return Value

Overview Affected versions of this package are vulnerable to Unexpected Status Code or Return Value in initConn, which causes out of order responses when CLIENT SETINFO times out while establishing a connection. Workaround This vulnerability can be avoided by setting DisableIndentity to true when...

PT-2025-11700

Name of the Vulnerable Software and Affected Versions kin-openapi versions prior to 0.131.0 Description The issue arises when validating a request with a multipart/form-data schema. If the OpenAPI schema allows it, an attacker can upload a crafted ZIP file, such as a ZIP bomb, causing the server ...

CVE-2025-30235

The CVE-2025-30235 entry concerns Shearwater SecurEnvoy SecurAccess Enrol prior to version 9.4.515. The vulnerability arises from improper handling of concurrent authentication attempts, allowing hundreds of failed logins before detection rather than limiting to the intended threshold of 10. This...

kernel security update

4.18.0-553.45.110.OL8 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...

PT-2025-11462 · Totolink · Totolink Ex1800T

Name of the Vulnerable Software and Affected Versions: TOTOLINK EX1800T versions 9.1.0cu.2112 B20220316 and earlier Description: A critical issue has been found in the TOTOLINK EX1800T, affecting the function setPasswordCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument admpas...

PT-2025-11386

Name of the Vulnerable Software and Affected Versions tbeu matio version 1.5.28 Description A critical vulnerability has been found in tbeu matio, affecting the function Mat VarPrint of the file src/mat.c. The manipulation leads to a heap-based buffer overflow. The attack may be initiated remotel...

SUSE CVE-2025-24806

Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-on SSO for applications via a web portal. If users are allowed to sign in via both username and email the regulation system treats these as separate login events. This leads to t...

PT-2025-11148 · WordPress · Wp E-Customers Beta

Name of the Vulnerable Software and Affected Versions: WP e-Customers Beta WordPress plugin version 0.0.1 Description: The issue concerns a Reflected Cross-Site Scripting problem. It arises because the WP e-Customers Beta WordPress plugin does not properly sanitise and escape a parameter before...

python3 security update

3.6.8-21.0.3 - Fix DoS parsing crafted tarfile headers Orabug: 37626372CVE-2024-6232 - Disable testsocket in the PGO profile task...

CVE-2025-21850

In the Linux kernel, the following vulnerability has been resolved: nvmet: Fix crash when a namespace is disabled The namespace percpu counter protects pending I/O, and we can only safely diable the namespace once the counter drop to zero. Otherwise we end up with a crash when running...

UBUNTU-CVE-2025-21850

In the Linux kernel, the following vulnerability has been resolved: nvmet: Fix crash when a namespace is disabled The namespace percpu counter protects pending I/O, and we can only safely diable the namespace once the counter drop to zero. Otherwise we end up with a crash when running...

CVE-2025-21850 nvmet: Fix crash when a namespace is disabled

In the Linux kernel, the following vulnerability has been resolved: nvmet: Fix crash when a namespace is disabled The namespace percpu counter protects pending I/O, and we can only safely diable the namespace once the counter drop to zero. Otherwise we end up with a crash when running...