CVE-2025-30166 Pimcore's Admin Classic Bundle allows HTML Injection

Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. An HTML injection issue allows users with access to the email sending functionality to inject arbitrary HTML code into emails sent via the admin interface, potentially leading to session cookie theft and the alteration of page...

CVE-2025-31475

CVE-2025-31475 affects tarteaucitron.js (prior to 1.20.1). The addOrUpdate function did not properly validate inputs, allowing an attacker with access to source or CMS plugins to perform prototype pollution, potentially modifying core JavaScript behavior, causing data corruption, crashes, or unin...

CVE-2025-30370

CVE-2025-30370 affects the jupyterlab-git JupyterLab extension. When a user opens a repository whose directory name contains a shell command substitution (e.g., $()) and selects “Git > Open Git Repository in Terminal,” the extension previously executed a shell command via a cd to the repositor...

Security Bulletin: IBM Maximo Application Suite - Predict Component vulnerable to jinja is an extensible templating engine.

Summary Security Bulletin: IBM Maximo Application Suite - Predict Component vulnerable to jinja is an extensible templating engine. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2025-27516 DESCRIPTION: Jinja is an extensible...

PT-2025-22238

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue concerns the Linux kernel, specifically the scsi: ufs: exynos component. It has been resolved by disabling iocc if the dma-coherent property isn't set. Without this fix, UFS ca...

CVE-2025-30218

Next.js (React framework) contains a vulnerability where x-middleware-subrequest-id is exposed to third-party destinations when a fetch to a different host occurs inside Middleware. Root cause: subrequest-id validation persisted across requests whereas destinations can differ, allowing informatio...

CVE-2025-29929

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap is missing CSRF protection on tracker hierarchy administration. An attacker could use this vulnerability to trick victims into submitting or editing artifacts or follow-up comments. This...

PT-2025-14457 · WordPress · Insert Headers/Footers Code – Ht Script

Name of the Vulnerable Software and Affected Versions: The Insert Headers and Footers Code – HT Script plugin for WordPress versions up to, and including, 1.1.2 Description: The issue is related to a missing capability check on the ajax dismiss function, allowing authenticated attackers with...

WordPress Gutentor plugin < 3.4.7 - Admin+ SQL Injection vulnerability

Admin+ SQL Injection vulnerability discovered by Greshow in WordPress Plugin Gutentor versions 3.4.7...

CVE-2025-30210 Bruno XSS On Environment Name

Bruno is an open source IDE for exploring and testing APIs. Prior to 1.39.1, the custom tool-tip components which internally use react-tooltip were setting the content in this case the Environment name as raw HTML which then gets injected into DOM on hover. This, combined with loose Content...

WordPress Bulk NoIndex & NoFollow Toolkit plugin <= 2.16 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Dimas Maulana in WordPress Plugin Bulk NoIndex & NoFollow Toolkit versions = 2.16...

Amazon Linux 2023 : python3-jinja2 (ALAS2023-2025-894)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-894 advisory. Jinja is an extensible templating engine. Prior to 3.1.6, an oversight in how the Jinja sandboxed environment interacts with the |attr filter allows an attacker that controls the content of a template t...

Security Bulletin: IBM Maximo Application Suite Ai-Broker Component vulnerable to vulnerable to Insertion of Sensitive Information into Log File where the redis password is being logged in the standard logging.

Summary Security Bulletin: IBM Maximo Application Suite Ai-Broker Component vulnerable to vulnerable to Insertion of Sensitive Information into Log File where the redis password is being logged in the standard logging. This bulletin contains information regarding the vulnerability and its fixture...

PT-2025-13547

Name of the Vulnerable Software and Affected Versions: Google gVisor affected versions not specified Description: The issue is related to a local privilege escalation due to incorrect handling of file access permissions in Google gVisor's runsc component. This allowed unprivileged users to access...

Security Bulletin: There is a vulnerability in Python wheel package for the aiohttp library affecting watsonx Code Assistant On Prem Extensions

Summary There is a vulnerablity in the Python wheel package for the aiohttp library affecting watsonx Code Assistant On Prem Extensions. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details CVEID:CVE-2024-52304 DESCRIPTION: aiohttp could allow a remote...

PT-2025-16744

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A read buffer overflow was possible in the Linux kernel due to the ibmvnic driver printing hex dumps using string formatters. The issue occurred when the buffer size was not a multiple o...

PT-2025-20495

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference issue in the Linux kernel has been resolved. The issue is related to the cifs server dbg function, which implies that the server should be non-NULL. To avoid t...

CVE-2024-8248

A vulnerability in the normalizePath function in mintplex-labs/anything-llm version git 296f041 allows for path traversal, leading to arbitrary file read and write in the storage directory. This can result in privilege escalation from manager to admin. The issue is fixed in version 1.2.2...

CVE-2025-24801

GLPI is a free asset and IT management software package. An authenticated user can upload and force the execution of .php files located on the GLPI server. This vulnerability is fixed in 10.0.18...

CVE-2025-30160 Redlib allows a Denial of Service via DEFLATE Decompression Bomb in restore_preferences Form

Redlib is an alternative private front-end to Reddit. A vulnerability has been identified in Redlib where an attacker can cause a denial-of-service DOS condition by submitting a specially crafted base2048-encoded DEFLATE decompression bomb to the restorepreferences form. This leads to excessive...