CVE-2025-36064 IBM Sterling Connect:Express for Microsoft Windows information disclosure

IBM Sterling Connect:Express for Microsoft Windows 3.1.0.0 through 3.1.0.22 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials...

Command Injection

Overview git-commiters is a Statistical summary of various infomation about git commiter. Affected versions of this package are vulnerable to Command Injection via the gitCommiters API which allows specifying options such as cwd for current working directory and revisionRange as a revision pointe...

GHSA-G38C-WXJF-XRH6 `git-comiters` Command Injection vulnerability

Background on the vulnerability This vulnerability manifests with the library's primary exported API: gitCommitersoptions, callback which allows specifying options such as cwd for current working directory and revisionRange as a revision pointer, such as HEAD. However, the library does not saniti...

PT-2026-2526

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The iomap adjust read range function incorrectly assumes that the position and length parameters are block-aligned. This can occur with the erofs filesystem. The incorrect calculation ca...

PT-2025-38786

Name of the Vulnerable Software and Affected Versions Meitar Subresource Integrity SRI Manager versions through 0.4.0 Description An authorization issue exists in Meitar Subresource Integrity SRI Manager, allowing exploitation due to incorrectly configured access control security levels...

PT-2025-38847

Name of the Vulnerable Software and Affected Versions Trustpilot Trustpilot Reviews versions through 2.5.925 Description A missing authorization issue exists in Trustpilot Trustpilot Reviews, stemming from incorrectly configured access control security levels. This allows for unauthorized access...

PT-2025-38820

Name of the Vulnerable Software and Affected Versions SALESmanago versions through 3.8.1 Description SALESmanago is susceptible to a Cross-Site Request Forgery CSRF issue. This allows an attacker to potentially perform actions on behalf of an authenticated user without their knowledge...

PT-2025-38788

Name of the Vulnerable Software and Affected Versions themewant Easy Hotel Booking versions through 1.6.9 Description An issue exists in themewant Easy Hotel Booking that allows for DOM-Based Cross-site Scripting XSS. This occurs due to improper neutralization of input during web page generation...

PT-2025-39025

Name of the Vulnerable Software and Affected Versions IP Based Login versions through 2.4.3 Description An issue exists in IP Based Login that allows for Stored Cross-site Scripting XSS. The flaw is due to improper neutralization of input during web page generation. This can allow an attacker to...

PT-2025-38997

Name of the Vulnerable Software and Affected Versions Binsaifullah Beaf versions through 1.6.2 Description A Server-Side Request Forgery SSRF issue exists in Binsaifullah Beaf. This allows for Server Side Request Forgery. The issue impacts the application's ability to properly validate server...

PT-2025-38961

Name of the Vulnerable Software and Affected Versions WP User Frontend versions through 4.1.11 Description An authorization issue exists in WP User Frontend, allowing exploitation due to incorrectly configured access control security levels. Recommendations Update WP User Frontend to a version...

PT-2025-38935

Name of the Vulnerable Software and Affected Versions chtombleson Mobi2Go versions through 1.0.0 Description The software contains a flaw related to improper input handling during web page generation, which allows for Stored Cross-site Scripting XSS. This means that malicious scripts can be...

CVE-2025-53692 Sitecore Experience Platform Cross-Site Scripting Vulnerability

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Sitecore Sitecore Experience Manager XM, Sitecore Experience Platform XP allows Cross-Site Scripting XSS.This issue affects Sitecore Experience Manager XM: from 9.2 through 10.4; Experience...

CVE-2025-7665

The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the 'handlemofirebaseformoptions' function in versions 3.1.0 to 3.6.2. This makes it possible for unauthenticated attackers to update the default role to...

CVE-2025-59714

In Internet2 Grouper 5.17.1 before 5.20.5, group admins who are not Grouper sysadmins can configure loader jobs...

Sitecore Experience Platform and Sitecore Experience Manager security vulnerabilities

Sitecore Experience Platform XP and Sitecore Experience Manager XM are both products of Sitecore, a Danish company.Sitecore Experience Platform is a suite of customer digital experience platforms.Sitecore Sitecore Experience Platform is a customer digital experience platform and Sitecore Experien...

smb3: fix temporary data corruption in collapse range

...

smb3: fix temporary data corruption in insert range

...

CVE-2025-7665 Miniorange OTP Verification with Firebase 3.1.0 - 3.6.2 - Unauthenticated Privilege Escalation

The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the 'handlemofirebaseformoptions' function in versions 3.1.0 to 3.6.2. This makes it possible for unauthenticated attackers to update the default role to...

Threat landscape for industrial automation systems in Q2 2025

Statistics across all threats In Q2 2025, the percentage of ICS computers on which malicious objects were blocked decreased by 1.4 pp from the previous quarter to 20.5%. Percentage of ICS computers on which malicious objects were blocked, Q2 2022–Q2 2025 Compared to Q2 2024, the rate decreased by...