PT-2025-21569 · Spotipy · Spotipy

Name of the Vulnerable Software and Affected Versions: Spotipy versions prior to the commit that reverted the change commit 9dfb7177b8d7bb98a5a6014f8e6436812a47576f Description: The issue concerns the use of pull request target in .github/workflows/integration tests.yml, which can be exploited by...

Google Chrome Security Update (stable-channel-update-for-desktop_14-2025-05) - Mac OS X

Google Chrome is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:google:chrome"; ifdescription...

CVE-2025-3597

The Firelight Lightbox WordPress plugin before 2.3.15 does not prevent users with post writing capabilities from executing arbitrary Javascript when the jQuery Metadata library is enabled. While this feature is meant to only be available to Pro version users, it can be activated in the free versi...

Alibaba Cloud Linux 3 : 0209: gdk-pixbuf2 (ALINUX3-SA-2024:0209)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2024:0209 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2021-44648: GNOME gdk-pixbuf 2.42.6 is...

PT-2025-21919 · V-Sft · V-Sft

Name of the Vulnerable Software and Affected Versions: V-SFT versions 6.2.5.0 and earlier Description: The issue is related to an out-of-bounds read in the Conv Macro Data function. Opening specially crafted V7 or V8 files may lead to a crash, information disclosure, and arbitrary code execution...

Alibaba Cloud Linux 3 : 0205: zsh (ALINUX3-SA-2022:0205)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2022:0205 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2021-45444: In zsh before 5.8.1, an attacker ca...

Vulnerabilities fixed in Microsoft Edge

Microsoft has fixed vulnerabilities in Edge Chromium Based. A malicious person could exploit the vulnerabilities to impersonate the victim and gain access to sensitive data or execute arbitrary code in the victim's context. This update also incorporates the Chrome/Chromium vulnerabilities marked...

CVE-2025-30326 Photoshop Desktop | Access of Uninitialized Pointer (CWE-824)

Photoshop Desktop versions 26.5, 25.12.2 and earlier are affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

firefox: thunderbird: Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird 128.10

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Memory safety bug present in Firefox ESR 128.9, and Thunderbird 128.9. This bug showed evidence of memory corruption and we presume that with enough effort this could have been exploited to run...

PT-2025-21021 · Adobe · Animate

Name of the Vulnerable Software and Affected Versions: Animate versions 24.0.8, 23.0.11 and earlier Description: The issue is an Access of Uninitialized Pointer vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user...

PT-2025-20843 · Siemens · Desigo Cc

Name of the Vulnerable Software and Affected Versions: Desigo CC All versions if access from Installed Clients to Desigo CC server is allowed from networks outside of a highly protected zone Desigo CC All versions if access from Installed Clients to Desigo CC server is only allowed within highly...

Important: nvidia-kmod-common

Issue Overview: NVIDIA GPU Display Driver for Linux contains a vulnerability which could allow an unprivileged attacker to escalate permissions. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data...

PT-2025-23173 · Apache +1 · Apache Web Server +1

Name of the Vulnerable Software and Affected Versions: FreeScout versions prior to 1.8.179 Description: The issue concerns insufficient checking of files uploaded to the application, allowing files with phtml and phar extensions to be uploaded. This can lead to remote code execution if the Apache...

firefox: thunderbird: Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird 128.10

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Memory safety bug present in Firefox ESR 128.9, and Thunderbird 128.9. This bug showed evidence of memory corruption and we presume that with enough effort this could have been exploited to run...

CVE-2025-4098

Horner Automation Cscape version 10.0 10.0.415.2 SP1 is vulnerable to an out-of-bounds read vulnerability that could allow an attacker to disclose information and execute arbitrary code on affected installations of Cscape...

PT-2025-20375 · WordPress · Nex-Forms

Name of the Vulnerable Software and Affected Versions: NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress versions up to, and including, 8.9.1 Description: The issue is related to Limited Code Execution due to the unsanitized use of user-supplied input in the cal...

Exploit for Unrestricted Upload of File with Dangerous Type in Themefic Ultimate_Before_After_Image_Slider_\&_Gallery

Ultimate Before After Image Slider & Gallery – BEAF 1: lo: mt...

PT-2025-19899

Name of the Vulnerable Software and Affected Versions vllm versions 0.5.2 through 0.8.5.post1 Description The issue exists in the V0 engine of vLLM, which uses ZeroMQ for multi-node communication. When data is received on the SUB ZeroMQ socket, it is deserialized with pickle, allowing for potenti...

PT-2025-19751

Name of the Vulnerable Software and Affected Versions DBSyncer version 2.0.6 Description A stored cross-site scripting XSS issue in the Edit Profile feature allows attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the Nickname parameter. Recommendations For...

CVE-2025-23254

NVIDIA TensorRT-LLM for any platform contains a vulnerability in python executor where an attacker may cause a data validation issue by local access to the TRTLLM server. A successful exploit of this vulnerability may lead to code execution, information disclosure and data tampering...